Publish curated Unraid-AppOps-Gateway source from 451646fee806a47e3256731766980a05a262dcdd

backend/tests/test_forge_bootstrap_preflight.py

@@ -2,6 +2,7 @@ from __future__ import annotations
 
 from sqlmodel import Session, SQLModel, create_engine
 
+from backend.app.core.config import settings
 from backend.app.db.models import DeploymentJob
 from backend.app.schemas.enrollment import EnrollmentTrustConfigV1
 from backend.app.schemas.forge_bootstrap import ForgeBootstrapPreflightV1
@@ -10,6 +11,9 @@ from backend.app.services.forge_bootstrap_preflight import (
     ForgeBootstrapPreflightService,
 )
 
+_PRIVATE_OWNER = "itworx-forge-private"
+_SOURCE_URL = "https://gitea.example.com/Jens/itworx-forge"
+
 
 def _profile(**overrides):
     value = {
@@ -58,6 +62,67 @@ def test_forge_profile_is_strict_and_cannot_select_runtime_inputs():
             raise AssertionError(f"invalid {field} must be rejected")
 
 
+def test_preflight_registry_attestation_binds_protected_owner_and_both_image_labels(monkeypatch):
+    from backend.app.services.forge_bootstrap_preflight import (
+        _checked_controller_result,
+    )
+
+    profile = _profile()
+    checks = {
+        name: {"status": "unknown"}
+        for name in (
+            "exact_main", "source_manifest", "managed_appdata", "proxy_network",
+            "resource_collisions", "push_validation", "image_registry", "oidc",
+            "secret_delivery",
+        )
+    }
+    checks["image_registry"] = {"status": "passed"}
+    registry = {
+        "owner": _PRIVATE_OWNER,
+        "ownerVisibility": "private",
+        "workspaceDigest": profile.workspace_image_digest,
+        "frontdoorDigest": profile.frontdoor_image_digest,
+        "workspacePullable": True,
+        "frontdoorPullable": True,
+        "workspaceSource": _SOURCE_URL,
+        "workspaceRevision": profile.revision,
+        "frontdoorSource": _SOURCE_URL,
+        "frontdoorRevision": profile.revision,
+    }
+    result = {
+        "apiVersion": "itworx.forge-bootstrap-preflight/v1",
+        "status": "preflight_unknown",
+        "revision": profile.revision,
+        "workspaceImageDigest": profile.workspace_image_digest,
+        "frontdoorImageDigest": profile.frontdoor_image_digest,
+        "checks": checks,
+        "evidence": {"attestations": {"image_registry": registry}},
+    }
+    monkeypatch.setitem(settings.apis, "FORGE_PRIVATE_PACKAGE_OWNER", _PRIVATE_OWNER)
+    accepted = _checked_controller_result(result, profile)
+    assert accepted is not None
+    assert accepted[1]["attestations"]["image_registry"] == registry
+
+    for protected_owner in (None, "Jens", "owner.with.dot", "a" * 40):
+        monkeypatch.setitem(settings.apis, "FORGE_PRIVATE_PACKAGE_OWNER", protected_owner)
+        assert _checked_controller_result(result, profile) is None
+    monkeypatch.setitem(settings.apis, "FORGE_PRIVATE_PACKAGE_OWNER", _PRIVATE_OWNER)
+
+    for field, invalid in (
+        ("owner", "another-owner"),
+        ("workspaceSource", "https://attacker.invalid/repo"),
+        ("frontdoorRevision", "d" * 40),
+        ("workspaceDigest", profile.frontdoor_image_digest),
+        ("workspacePullable", 1),
+        ("frontdoorPullable", 1),
+        ("workspacePullable", "true"),
+        ("frontdoorPullable", None),
+    ):
+        bad = {**registry, field: invalid}
+        result["evidence"]["attestations"]["image_registry"] = bad
+        assert _checked_controller_result(result, profile) is None
+
+
 class _Broker:
     def __init__(self, result):
         self.result = result