Publish curated Unraid-AppOps-Gateway source from 034c9f844d2455850ba37b31379b7edaa786583e

backend/tests/test_mcp_rag_n8n_integrations.py

@@ -37,8 +37,6 @@ def integration_client(tmp_path, monkeypatch):
         "mcp_token": settings.mcp_token,
         "n8n_enabled": settings.n8n_enabled,
         "n8n_token": settings.n8n_token,
-        "operator_token": settings.operator_token,
-        "operator_auth_required": settings.operator_auth_required,
         "environment": settings.environment,
         "mutation_rate_limit_per_minute": settings.mutation_rate_limit_per_minute,
     }
@@ -50,8 +48,6 @@ def integration_client(tmp_path, monkeypatch):
     settings.mcp_token = MCP_TOKEN
     settings.n8n_enabled = True
     settings.n8n_token = N8N_TOKEN
-    settings.operator_token = OPERATOR_TOKEN
-    settings.operator_auth_required = True
     settings.environment = "production"
     settings.mutation_rate_limit_per_minute = 10
     security.settings = settings
@@ -61,6 +57,13 @@ def integration_client(tmp_path, monkeypatch):
     init_db()
     with TestClient(app) as client:
         settings.mcp_enabled = True
+        from backend.app.db.models import GatewayUser
+        from backend.app.services.user_access import issue_session
+        with Session(engine) as session:
+            user = GatewayUser(id="integration-admin", provider="authentik", issuer="test", subject="integration-admin", role="admin")
+            session.add(user)
+            session.commit()
+            client.appops_admin_cookie = issue_session(session, user)
         yield client, engine
 
     db_session.engine = previous_engine
@@ -70,6 +73,10 @@ def integration_client(tmp_path, monkeypatch):
     app_main._MUTATION_WINDOWS.clear()
 
 
+def human_headers(client):
+    return {"Cookie": f"appops_user_session={client.appops_admin_cookie}", "X-AppOps-Session-CSRF": "1"}
+
+
 def test_integrations_use_separate_auth_scopes(integration_client):
     client, _ = integration_client
 
@@ -77,7 +84,7 @@ def test_integrations_use_separate_auth_scopes(integration_client):
     assert (
         client.get(
             "/api/integrations/status",
-            headers={"Authorization": f"Bearer {OPERATOR_TOKEN}"},
+            headers=human_headers(client),
         ).status_code
         == 200
     )
@@ -105,7 +112,7 @@ def test_deployment_http_surface_requires_operator_and_rejects_raw_fields(integr
     response = client.post(
         "/api/deployments",
         headers={
-            "Authorization": f"Bearer {OPERATOR_TOKEN}",
+            **human_headers(client),
             "Idempotency-Key": "deployment-schema-test-0001",
         },
         json={
@@ -213,7 +220,7 @@ def test_n8n_uses_the_shared_grounded_knowledge_service(integration_client):
 
     evaluation = client.get(
         "/api/ai/rag/evaluate",
-        headers={"X-AppOps-Operator-Token": OPERATOR_TOKEN},
+        headers=human_headers(client),
     )
     assert evaluation.status_code == 200
     assert evaluation.json()["total"] == 5
@@ -709,7 +716,7 @@ def test_n8n_event_and_audit_fields_are_redacted(integration_client):
 def test_n8n_heartbeat_makes_reachability_truthful(integration_client):
     client, _ = integration_client
     n8n_headers = {"Authorization": f"Bearer {N8N_TOKEN}"}
-    operator_headers = {"Authorization": f"Bearer {OPERATOR_TOKEN}"}
+    operator_headers = human_headers(client)
 
     before = client.get("/api/integrations/status", headers=operator_headers).json()
     assert before["n8n"]["state"] == "configured"
@@ -768,8 +775,8 @@ def test_audit_endpoint_is_paginated(integration_client):
             )
         session.commit()
 
-    first = client.get("/api/audit?limit=2&offset=0").json()
-    second = client.get("/api/audit?limit=2&offset=2").json()
+    first = client.get("/api/audit?limit=2&offset=0", headers=human_headers(client)).json()
+    second = client.get("/api/audit?limit=2&offset=2", headers=human_headers(client)).json()
     assert len(first) == 2
     assert len(second) == 2
     assert {item["id"] for item in first}.isdisjoint({item["id"] for item in second})
@@ -865,12 +872,12 @@ def test_workmesh_promotion_preflight_creates_sha_bound_approval_and_receipt_job
 
     monkeypatch.setattr(DeploymentBrokerClient, "workmesh_promotion_preflight", preflight)
     preflight_headers = {
-        "Authorization": f"Bearer {OPERATOR_TOKEN}",
+        **human_headers(client),
         "Idempotency-Key": "workmesh-promote-preflight-0001",
     }
     direct_action = client.post(
         "/api/actions/execute",
-        headers={"Authorization": f"Bearer {OPERATOR_TOKEN}"},
+        headers=human_headers(client),
         json={
             "plan": {
                 "intent": "deployment.target.promote_workmesh",
@@ -914,7 +921,7 @@ def test_workmesh_promotion_preflight_creates_sha_bound_approval_and_receipt_job
 
     listed = client.get(
         "/api/deployments/workmesh/promotions",
-        headers={"Authorization": f"Bearer {OPERATOR_TOKEN}"},
+        headers=human_headers(client),
     )
     assert listed.status_code == 200
     assert listed.json()["items"][0]["promotionId"] == requested["promotionId"]
@@ -979,7 +986,7 @@ def test_workmesh_promotion_preflight_creates_sha_bound_approval_and_receipt_job
 
     monkeypatch.setattr(DeploymentBrokerClient, "workmesh_promotion_apply", apply)
     monkeypatch.setattr(DeploymentBrokerClient, "workmesh_promotion_status", status)
-    auth = {"Authorization": f"Bearer {OPERATOR_TOKEN}"}
+    auth = human_headers(client)
     assert client.patch(
         f"/api/approvals/{requested['approvalId']}",
         headers=auth,
@@ -1057,7 +1064,7 @@ def test_workmesh_ambiguous_controller_apply_is_consumed_and_only_reconciled(
     monkeypatch.setattr(DeploymentBrokerClient, "workmesh_promotion_apply", apply)
     monkeypatch.setattr(DeploymentBrokerClient, "workmesh_promotion_status", status)
 
-    auth = {"Authorization": f"Bearer {OPERATOR_TOKEN}"}
+    auth = human_headers(client)
     requested = client.post(
         "/api/deployments/workmesh/promotions/preflight",
         headers={**auth, "Idempotency-Key": "workmesh-promote-uncertain-0001"},
@@ -1155,7 +1162,7 @@ def test_workmesh_changed_preflight_expires_approval_before_apply(
 
     monkeypatch.setattr(DeploymentBrokerClient, "workmesh_promotion_preflight", preflight)
     monkeypatch.setattr(DeploymentBrokerClient, "workmesh_promotion_apply", apply)
-    auth = {"Authorization": f"Bearer {OPERATOR_TOKEN}"}
+    auth = human_headers(client)
     requested = client.post(
         "/api/deployments/workmesh/promotions/preflight",
         headers={**auth, "Idempotency-Key": "workmesh-promote-drift-0001"},
@@ -1239,7 +1246,7 @@ def test_controller_preflight_changed_identity_expires_approval_without_unknown_
 
     monkeypatch.setattr(DeploymentBrokerClient, "workmesh_promotion_preflight", preflight)
     monkeypatch.setattr(DeploymentBrokerClient, "workmesh_promotion_apply", apply)
-    auth = {"Authorization": f"Bearer {OPERATOR_TOKEN}"}
+    auth = human_headers(client)
     requested = client.post(
         "/api/deployments/workmesh/promotions/preflight",
         headers={**auth, "Idempotency-Key": "workmesh-promote-controller-drift-01"},