Publish curated Unraid-AppOps-Gateway source from 034c9f844d2455850ba37b31379b7edaa786583e

backend/tests/test_deployment_contract.py

@@ -1,5 +1,9 @@
+import shutil
+import subprocess
 from pathlib import Path
 
+import pytest
+
 ROOT = Path(__file__).resolve().parents[2]
 
 
@@ -39,8 +43,10 @@ def test_canonical_compose_forwards_trusted_operator_proxy_configuration():
 
     assert 'APPOPS_OPERATOR_PROXY_AUTH: "${APPOPS_OPERATOR_PROXY_AUTH:-false}"' in compose
     assert 'APPOPS_OPERATOR_PROXY_TRUSTED_NETWORKS: "${APPOPS_OPERATOR_PROXY_TRUSTED_NETWORKS:-}"' in compose
-    assert 'APPOPS_OPERATOR_PROXY_USERS: "${APPOPS_OPERATOR_PROXY_USERS:-}"' in compose
-    assert 'APPOPS_OPERATOR_PROXY_GROUPS: "${APPOPS_OPERATOR_PROXY_GROUPS:-appops-operators}"' in compose
+    assert 'APPOPS_AUTH_ADMIN_SUBJECTS: "${APPOPS_AUTH_ADMIN_SUBJECTS:-}"' in compose
+    assert 'APPOPS_AUTHENTIK_CLIENT_SECRET_FILE: /data/authentik-oidc-secret' in compose
+    assert 'APPOPS_OPERATOR_PROXY_USERS:' not in compose
+    assert 'APPOPS_OPERATOR_PROXY_GROUPS:' not in compose
 
 
 def test_canonical_compose_mounts_only_the_file_based_gitea_observer_secret():
@@ -73,7 +79,7 @@ def test_runtime_image_label_matches_the_app_version():
         assert f'{build_argument}: "${{{build_argument}:-' in compose
 
     assert 'io.itworx.app.version="1.8.0"' in dockerfile
-    assert 'io.itworx.app.operator-auth="http-only-session"' in dockerfile
+    assert 'io.itworx.app.user-auth="oidc-rbac"' in dockerfile
     assert 'APP_VERSION = "1.8.0"' in version
 
 
@@ -83,3 +89,28 @@ def test_unraid_upgrade_can_restore_voice_token_without_logging_it():
     assert "for env_key in \\\n  APP_OPS_VOICE_TOKEN \\" in script
     assert 'printf \'%s=%s\\n\' "$env_key" "$env_value" >> "$ENV_FILE"' in script
     assert 'log "${env_value}"' not in script
+
+
+def test_upgrade_preserves_file_based_voice_credential(tmp_path):
+    bash = shutil.which("bash")
+    git_bash = Path("C:/Program Files/Git/bin/bash.exe")
+    if git_bash.exists():
+        bash = str(git_bash)
+    if not bash:
+        pytest.skip("Bash is unavailable")
+    script = (ROOT / "scripts" / "upgrade_single_1216.sh").read_text(encoding="utf-8")
+    voice = script.split('VOICE_TOKEN_VALUE="$(awk', 1)[1].split("# Optional, explicit deployment-time overrides.", 1)[0]
+    voice = 'VOICE_TOKEN_VALUE="$(awk' + voice
+    credential = "existing-service-credential-must-survive-upgrade"
+    (tmp_path / "voice-token").write_text(credential)
+    (tmp_path / "runtime.env").write_text("APP_OPS_VOICE_TOKEN_FILE=/data/voice-token\n")
+    result = subprocess.run([bash, "-s"], input=f'''set -eu
+APPDATA='{tmp_path.as_posix()}'
+ENV_FILE="$APPDATA/runtime.env"
+log() {{ echo unexpected_rotation; }}
+{voice}
+test "$VOICE_TOKEN_VALUE" = '{credential}'
+! grep -q '^APP_OPS_VOICE_TOKEN=' "$ENV_FILE"
+''', text=True, capture_output=True, check=False)
+    assert result.returncode == 0, result.stderr
+    assert "unexpected_rotation" not in result.stdout