Publish curated Unraid-AppOps-Gateway source from 5572962b172902d61bdd220ceb8fb69426f17b5f

backend/tests/test_runner_fleet_specialize.py

@@ -2151,6 +2151,179 @@ def test_execute_runs_only_approved_shell_then_requires_verified_postcondition(s
     assert shell_calls == [script]
 
 
+@pytest.fixture
+def profile_registration(specialize, monkeypatch):
+    rows = []
+    commands = []
+    journals = []
+    state = {"check_host_paths": False, "missing_label": None}
+    token = "private-registration-canary"
+    monkeypatch.setattr(specialize, "_runner_rows", lambda: copy.deepcopy(rows))
+    monkeypatch.setattr(specialize, "_registration_token", lambda: token)
+    def register(args, data, **kwargs):
+        assert kwargs == {"timeout": 90, "max_output": 32 * 1024}
+        assert data == (token + "\n").encode() and token not in " ".join(args)
+        profile_id = next(key for key, value in specialize.RUNNER_PROFILES.items() if value.container_name == args[args.index("--name") + 1])
+        profile = specialize.RUNNER_PROFILES[profile_id]
+        if state["check_host_paths"]:
+            mounts = [args[index + 1] for index, argument in enumerate(args) if argument == "--volume"]
+            assert mounts == [f"{specialize._host_volume_path(specialize._SPECIALIZED_DATA_ROOT / profile_id)}:/data",
+                              f"{specialize._host_volume_path(specialize.RUNNER_CONFIG_ROOT / (profile_id + '.yaml'))}:/runner-config.yaml:ro"]
+            assert all("/controller-hub-releases/" not in mount.replace("\\", "/") for mount in mounts)
+        assert args[-2] == profile.display_name
+        assert args[-1] == specialize._profile_labels_for_registration(profile_id, "a" * 40)
+        required = {profile.runner_label, *profile.legacy_labels}
+        if state["missing_label"] == profile_id:
+            required.remove(profile.runner_label)
+        rows.append({"id": 100 + len(rows), "name": profile.container_name, "displayName": profile.display_name,
+                     "labels": sorted(required), "disabled": False, "busy": False})
+        commands.append(profile_id)
+        return "registered"
+    monkeypatch.setattr(specialize, "_run_with_input", register)
+    def disable(identifier, disabled):
+        assert disabled is True
+        next(row for row in rows if row["id"] == identifier)["disabled"] = True
+    monkeypatch.setattr(specialize, "_disable_registration", disable)
+    def journal(value):
+        for profile_id, identifier in value["newRegistrationIds"].items():
+            matching = next(row for row in rows if row["id"] == identifier)
+            assert matching["disabled"] is True and matching["busy"] is False
+            assert matching["name"] == specialize.RUNNER_PROFILES[profile_id].container_name
+        journals.append(copy.deepcopy(value))
+    monkeypatch.setattr(specialize, "_write_journal", journal)
+    return rows, commands, journals, state
+
+
+def test_new_profile_registration_uses_daemon_visible_volume_children(specialize, profile_registration):
+    rows, commands, journals, state = profile_registration
+    state["check_host_paths"] = True
+    journal = {"sourceRevision": "a" * 40, "newRegistrationIds": {}}
+    specialize._register_profiles(journal)
+    assert commands == list(specialize.PROFILE_IDS)
+    assert len(rows) == 6 and set(journal["newRegistrationIds"]) == set(specialize.PROFILE_IDS)
+    assert journals[-1]["stage"] == "registrations_created"
+
+
+@pytest.mark.parametrize("existing", [False, True])
+def test_new_registration_label_verification_is_initialized_for_each_profile(specialize, profile_registration, existing):
+    rows, commands, journals, _state = profile_registration
+    journal = {"sourceRevision": "a" * 40, "newRegistrationIds": {}}
+    if existing:
+        key = specialize.PROFILE_IDS[0]
+        profile = specialize.RUNNER_PROFILES[key]
+        rows.append({"id": 9, "name": profile.container_name, "displayName": profile.display_name,
+                     "labels": sorted({profile.runner_label, *profile.legacy_labels}), "disabled": True, "busy": False})
+        journal["newRegistrationIds"][key] = 9
+    specialize._register_profiles(journal)
+    assert len(rows) == 6 and len(commands) == (5 if existing else 6)
+    assert set(journal["newRegistrationIds"]) == set(specialize.PROFILE_IDS)
+    assert journals[-1]["stage"] == "registrations_created"
+    before = copy.deepcopy(journal)
+    specialize._register_profiles(journal)
+    assert journal == before and len(commands) == (5 if existing else 6)
+
+
+@pytest.mark.parametrize("profile_id", ["checks", "backend", "frontend", "security", "browser", "build"])
+def test_new_profile_missing_own_required_label_is_not_recorded(specialize, profile_registration, profile_id):
+    _rows, commands, journals, state = profile_registration
+    state["missing_label"] = profile_id
+    journal = {"sourceRevision": "a" * 40, "newRegistrationIds": {}}
+    with pytest.raises(specialize.RunnerFleetSpecializeError, match="registration_create_unverified"):
+        specialize._register_profiles(journal)
+    assert profile_id == commands[-1] and profile_id not in journal["newRegistrationIds"]
+    assert all(profile_id not in value["newRegistrationIds"] for value in journals)
+
+
+@pytest.mark.parametrize("reason", ["command_failed", "command_unavailable"])
+def test_registration_command_failure_is_finite_and_does_not_record_registration(
+    specialize, profile_registration, monkeypatch, reason,
+):
+    def fail(*_args, **_kwargs):
+        raise specialize.RunnerFleetSpecializeError("runner_fleet_specialization_" + reason)
+    monkeypatch.setattr(specialize, "_run_with_input", fail)
+    journal = {"sourceRevision": "a" * 40, "newRegistrationIds": {}}
+    with pytest.raises(specialize.RunnerFleetSpecializeError) as caught:
+        specialize._register_profiles(journal)
+    assert str(caught.value) == "runner_fleet_specialization_registration_command_failed"
+    assert str(caught.value) in specialize._PUBLIC_SPECIALIZATION_FAILURES
+    assert caught.value.__suppress_context__ is True
+    assert journal["newRegistrationIds"] == {}
+
+
+@pytest.fixture
+def cleanup_workspace(specialize, tmp_path, monkeypatch):
+    workspace = tmp_path / "workspaces"
+    profile = workspace / specialize.RUNNER_PROFILES["checks"].container_name
+    nested = profile / "checkout"
+    nested.mkdir(parents=True)
+    (nested / "output").write_bytes(b"preserved-until-owned-cleanup")
+    monkeypatch.setattr(specialize, "_SPECIALIZED_WORKSPACE_ROOT", workspace)
+    owners = {profile: 1000, nested: 1000}
+    original = Path.lstat
+    def owned(path, *args, **kwargs):
+        value = list(original(path, *args, **kwargs))
+        value[4] = owners.get(path, 0)
+        return os.stat_result(value)
+    monkeypatch.setattr(Path, "lstat", owned)
+    return workspace, profile, nested, owners
+
+
+def test_owned_profile_workspace_cleanup_accepts_prepared_uid1000_directories(specialize, cleanup_workspace):
+    workspace, _profile, _nested, _owners = cleanup_workspace
+    specialize._remove_fixed_private_tree(workspace)
+    assert not workspace.exists()
+
+
+@pytest.mark.parametrize("mutation", ["root_owner", "profile_owner", "nested_owner", "foreign_profile", "outside_workspace"])
+def test_workspace_cleanup_keeps_exact_root_profile_and_owner_boundary(specialize, cleanup_workspace, mutation):
+    workspace, profile, nested, owners = cleanup_workspace
+    target = workspace
+    if mutation == "root_owner":
+        owners[workspace] = 1000
+    elif mutation == "profile_owner":
+        owners[profile] = 0
+    elif mutation == "nested_owner":
+        owners[nested] = 1001
+    elif mutation == "foreign_profile":
+        foreign = workspace / "foreign-runner"
+        profile.rename(foreign)
+        owners[foreign] = 1000
+    else:
+        target = workspace.parent / "runner-data"
+        target.mkdir()
+        child = target / "checks"
+        child.mkdir()
+        owners[child] = 1000
+    with pytest.raises(specialize.RunnerFleetSpecializeError, match="rollback_path_untrusted"):
+        specialize._remove_fixed_private_tree(target)
+    assert target.exists()
+
+
+@pytest.mark.skipif(os.name != "posix", reason="requires POSIX symlinks")
+def test_workspace_cleanup_refuses_symlink_without_touching_target(specialize, cleanup_workspace, tmp_path):
+    workspace, _profile, nested, _owners = cleanup_workspace
+    outside = tmp_path / "outside"
+    outside.mkdir()
+    preserved = outside / "preserved"
+    preserved.write_bytes(b"foreign")
+    (nested / "foreign-link").symlink_to(outside, target_is_directory=True)
+    with pytest.raises(specialize.RunnerFleetSpecializeError, match="rollback_path_untrusted"):
+        specialize._remove_fixed_private_tree(workspace)
+    assert preserved.read_bytes() == b"foreign"
+
+
+@pytest.mark.skipif(os.name != "posix" or os.geteuid() != 0, reason="requires POSIX root ownership")
+def test_workspace_cleanup_removes_real_prepared_runner_owned_tree(specialize, tmp_path, monkeypatch):
+    workspace = tmp_path / "workspaces"
+    nested = workspace / specialize.RUNNER_PROFILES["checks"].container_name / "checkout"
+    nested.mkdir(parents=True, mode=0o700)
+    os.chown(nested.parent, 1000, 1000)
+    os.chown(nested, 1000, 1000)
+    monkeypatch.setattr(specialize, "_SPECIALIZED_WORKSPACE_ROOT", workspace)
+    specialize._remove_fixed_private_tree(workspace)
+    assert not workspace.exists()
+
+
 def test_run_with_input_keeps_registration_secret_out_of_command_arguments(specialize, monkeypatch):
     observed = {}