Initial curated Unraid-AppOps-Gateway source from 3bd6f6fee310125bfbb4d4650389a817f498724d

backend/tests/test_controller_bootstrap_import_host.py

@@ -0,0 +1,43 @@
+from __future__ import annotations
+
+import importlib.util
+import json
+from pathlib import Path
+
+import pytest
+
+SCRIPT = Path(__file__).resolve().parents[2] / "scripts" / "import_controller_bootstrap.py"
+SPEC = importlib.util.spec_from_file_location("controller_bootstrap_import_host", SCRIPT)
+assert SPEC is not None and SPEC.loader is not None
+host_import = importlib.util.module_from_spec(SPEC)
+SPEC.loader.exec_module(host_import)
+
+
+def test_reads_root_private_bootstrap_without_newline(tmp_path, monkeypatch):
+    path = tmp_path / "bootstrap"
+    path.write_bytes(b"x" * 64 + b"\n")
+    path.chmod(0o600)
+    monkeypatch.setattr(host_import.os, "geteuid", lambda: 0, raising=False)
+    assert host_import.read_bootstrap(path) == b"x" * 64
+    path.write_bytes(b"short\n")
+    with pytest.raises(ValueError):
+        host_import.read_bootstrap(path)
+
+
+def test_bootstrap_passes_only_on_stdin(monkeypatch):
+    observed = {}
+
+    def fake_run(argv, *, input, capture_output, check, timeout):
+        observed.update({"argv": argv, "input": input, "capture_output": capture_output})
+
+        class Result:
+            returncode = 0
+            stdout = json.dumps({"status": "imported", "secretRef": "ENROLLMENT_BOOTSTRAP"}).encode()
+
+        return Result()
+
+    monkeypatch.setattr(host_import.subprocess, "run", fake_run)
+    assert host_import.import_bootstrap(b"sensitive-test-value") == "imported"
+    assert observed["input"] == b"sensitive-test-value"
+    assert "sensitive-test-value" not in " ".join(observed["argv"])
+    assert observed["capture_output"] is True