Publish curated Unraid-AppOps-Gateway source from 451646fee806a47e3256731766980a05a262dcdd

backend/tests/test_runner_fleet_specialize.py

@@ -421,6 +421,119 @@ def test_successful_main_run_accepts_actual_gitea_run_without_workflow_id(
     assert calls[1].endswith("/actions/runs?branch=main&limit=100&page=1")
 
 
+def test_source_image_fetch_accepts_actual_gitea_commit_tree_shape(
+    specialize, monkeypatch, tmp_path
+):
+    revision = "a" * 40
+    tree = "b" * 40
+    calls = []
+    workflow_calls = []
+
+    def api(path):
+        calls.append(path)
+        if path.endswith("/branches/main"):
+            return {"commit": {"id": revision}}
+        if path.endswith(f"/git/commits/{revision}"):
+            return {"sha": revision, "commit": {"tree": {"sha": tree}}}
+        if "/actions/runs/" in path and "/artifacts?" in path:
+            return {
+                "artifacts": [
+                    {
+                        "name": specialize.IMAGE_ARTIFACT_PREFIX + revision,
+                        "expired": False,
+                        "id": 44,
+                        "size_in_bytes": 1,
+                    }
+                ]
+            }
+        raise AssertionError(f"unexpected fixed Gitea API path: {path}")
+
+    def successful_run(workflow_path, requested_revision):
+        assert requested_revision == revision
+        workflow_calls.append(workflow_path)
+        return {"id": 41 if workflow_path == specialize.IMAGE_WORKFLOW else 42}
+
+    class ReachedArtifactDownload(Exception):
+        pass
+
+    def download(_artifact_id, _destination):
+        raise ReachedArtifactDownload
+
+    monkeypatch.setattr(specialize, "_api_json", api)
+    monkeypatch.setattr(specialize, "_successful_main_run", successful_run)
+    monkeypatch.setattr(specialize, "_download_artifact_zip", download)
+
+    with pytest.raises(ReachedArtifactDownload):
+        specialize._fetch_source_image_artifact(revision, tree, tmp_path)
+
+    assert workflow_calls == [specialize.IMAGE_WORKFLOW, specialize.FULL_WORKFLOW]
+    assert calls == [
+        f"/repos/{specialize.SOURCE_REPOSITORY_API}/branches/main",
+        f"/repos/{specialize.SOURCE_REPOSITORY_API}/git/commits/{revision}",
+        f"/repos/{specialize.SOURCE_REPOSITORY_API}/actions/runs/41/artifacts?name={specialize.IMAGE_ARTIFACT_PREFIX}{revision}",
+    ]
+
+
+@pytest.mark.parametrize(
+    ("commit_value", "error"),
+    [
+        ({"sha": "a" * 40}, "source_tree_mismatch"),
+        ({"sha": "a" * 40, "commit": {}}, "source_tree_mismatch"),
+        (
+            {"sha": "a" * 40, "commit": {"tree": {"sha": "c" * 40}}},
+            "source_tree_mismatch",
+        ),
+        (
+            {"sha": "a" * 40, "tree": {"sha": "b" * 40}},
+            "source_tree_mismatch",
+        ),
+        (
+            {"sha": "c" * 40, "commit": {"tree": {"sha": "b" * 40}}},
+            "source_revision_mismatch",
+        ),
+        (
+            {"commit": {"tree": {"sha": "b" * 40}}},
+            "source_revision_mismatch",
+        ),
+    ],
+)
+def test_source_image_fetch_rejects_noncanonical_gitea_commit_payload_before_artifact_lookup(
+    specialize, monkeypatch, tmp_path, commit_value, error
+):
+    revision = "a" * 40
+    calls = []
+    workflow_calls = []
+
+    def api(path):
+        calls.append(path)
+        if path.endswith("/branches/main"):
+            return {"commit": {"id": revision}}
+        if path.endswith(f"/git/commits/{revision}"):
+            return commit_value
+        raise AssertionError(f"unexpected fixed Gitea API path: {path}")
+
+    def unexpected_workflow(*_args):
+        workflow_calls.append(True)
+        raise AssertionError("workflow lookup must not follow an untrusted commit response")
+
+    monkeypatch.setattr(specialize, "_api_json", api)
+    monkeypatch.setattr(specialize, "_successful_main_run", unexpected_workflow)
+    monkeypatch.setattr(
+        specialize,
+        "_download_artifact_zip",
+        lambda *_args: pytest.fail("artifact download must not follow an untrusted commit response"),
+    )
+
+    with pytest.raises(specialize.RunnerFleetSpecializeError, match=error):
+        specialize._fetch_source_image_artifact(revision, "b" * 40, tmp_path)
+
+    assert calls == [
+        f"/repos/{specialize.SOURCE_REPOSITORY_API}/branches/main",
+        f"/repos/{specialize.SOURCE_REPOSITORY_API}/git/commits/{revision}",
+    ]
+    assert workflow_calls == []
+
+
 @pytest.mark.parametrize(
     "changes",
     [