Publish curated Unraid-AppOps-Gateway source from af7a7bd69966cb9939bf331cab169e2ec61e8f26

backend/tests/test_runner_fleet_specialize.py

@@ -18,6 +18,87 @@ from types import SimpleNamespace
 import pytest
 
 
+@pytest.mark.parametrize("reason", [
+    "resource_cgroup_process_mapping_invalid", "resource_cgroup_probe_identity_invalid",
+    "resource_cgroup_attestation_failed", "resource_cgroup_v2_unavailable",
+    "Bearer secret-value", None,
+])
+def test_build_resource_refusal_keeps_only_allowlisted_private_cause(specialize, monkeypatch, reason):
+    monkeypatch.setattr(specialize, "_docker_outer_inventory", lambda: ([], []))
+    monkeypatch.setattr(specialize, "attest_build_probe_workload", lambda *_a, **_k: {
+        "ready": False, "reason": reason,
+    })
+    with pytest.raises(specialize.RunnerFleetSpecializeError) as error:
+        specialize._build_probe_resource_attestation({"containerId": "a" * 64}, {"State": {"Pid": 77}})
+    assert str(error.value) == "runner_fleet_specialization_build_probe_cgroup_untrusted"
+    if reason in specialize._RESOURCE_FAILURE_CODES:
+        assert str(error.value.__cause__) == reason
+    else:
+        assert error.value.__cause__ is None
+    records = []
+    monkeypatch.setattr(specialize, "_trusted_directory", lambda _path: None)
+    monkeypatch.setattr(specialize, "_write_private_atomic", lambda _path, raw: records.append(json.loads(raw)))
+    specialize._record_migration_failure({
+        "backupDirectory": str(specialize._SPECIALIZED_BACKUP_ROOT / "specialized-bound"),
+        "sourceRevision": "a" * 40, "sourceTree": "b" * 40,
+        "stage": "build_probe_pending",
+    }, error.value)
+    assert len(records) == 1
+    assert records[0]["causeCode"] == (reason if reason in specialize._RESOURCE_FAILURE_CODES else str(error.value))
+    assert "secret-value" not in json.dumps(records)
+
+
+@pytest.mark.parametrize("case", ["released", "busy", "untrusted"])
+def test_rollback_waits_only_for_natural_maintenance_release(specialize, monkeypatch, case):
+    deploy = SimpleNamespace(load_projects=lambda: {})
+    monkeypatch.setitem(sys.modules, "deploy", deploy)
+    import runner_acceptance_quiescence as q
+
+    events = []
+    now = [0.0]
+
+    class Driver:
+        @contextmanager
+        def maintenance(self):
+            events.append("acquire")
+            if case == "untrusted":
+                raise q.QuiescenceError("dispatch_lock_untrusted")
+            if case == "busy" or events.count("acquire") < 3:
+                raise q.QuiescenceError("dispatch_maintenance_busy")
+            events.append("owned")
+            try:
+                yield
+            finally:
+                events.append("release")
+
+        def remaining(self):
+            return 240 - now[0]
+
+        def assert_barrier(self):
+            assert "owned" in events
+
+    def sleep(seconds):
+        assert 0 < seconds <= 1
+        events.append("wait")
+        now[0] += seconds
+
+    monkeypatch.setattr(deploy, "load_projects", lambda: {})
+    monkeypatch.setattr(q, "ControllerDriver", lambda _projects: Driver())
+    monkeypatch.setattr(specialize.time, "monotonic", lambda: now[0])
+    monkeypatch.setattr(specialize.time, "sleep", sleep)
+    if case == "released":
+        with specialize._rollback_maintenance() as barrier:
+            barrier()
+            events.append("rollback-effect")
+        assert events == ["acquire", "wait", "acquire", "wait", "acquire", "owned", "rollback-effect", "release"]
+    else:
+        with pytest.raises(q.QuiescenceError, match="dispatch_maintenance_busy" if case == "busy" else "dispatch_lock_untrusted"):
+            with specialize._rollback_maintenance():
+                pytest.fail("No effect before exclusive acquisition")
+        assert "owned" not in events
+        assert now[0] == (90 if case == "busy" else 0)
+
+
 @pytest.fixture
 def controller_only_source(specialize, tmp_path, monkeypatch):
     image = "sha256:" + "a" * 64