Initial curated Unraid-AppOps-Gateway source from 3bd6f6fee310125bfbb4d4650389a817f498724d

backend/tests/test_media_codec_dashboard_reconciliation_action.py

@@ -0,0 +1,117 @@
+from sqlmodel import Session, SQLModel, create_engine
+
+from backend.app.services import action_execution
+from backend.app.services.action_execution import approval_execution_supported
+from backend.app.services.action_registry import (
+    ACTION_RISK,
+    ACTIONS,
+    action_default_target,
+)
+
+
+def test_media_codec_dashboard_reconciliation_is_fixed_high_risk_typed_action():
+    action = "deployment.target.reconcile_media_codec_dashboard"
+    assert action in ACTIONS
+    assert ACTION_RISK[action] == "high"
+    assert action_default_target(action) == "jens/media-codec-dashboard"
+    assert approval_execution_supported(action) is True
+
+
+def test_media_codec_dashboard_reconciliation_rejects_any_other_target():
+    result = action_execution.execute_governed_action(
+        None,  # type: ignore[arg-type]
+        action="deployment.target.reconcile_media_codec_dashboard",
+        target="jens/not-media-codec-dashboard",
+        source="chatgpt-mcp",
+        risk="high",
+        reason="Regression test for exact-target enforcement.",
+        original_policy_decision="allowed",
+    )
+
+    assert result["success"] is False
+    assert result["result"] == "blocked"
+    assert result["message"] == (
+        "Media Codec Dashboard reconciliation accepts only "
+        "jens/media-codec-dashboard."
+    )
+
+
+def test_media_codec_dashboard_reconciliation_dispatches_fixed_executor(
+    monkeypatch, tmp_path
+):
+    engine = create_engine(f"sqlite:///{tmp_path / 'dashboard-reconciliation.db'}")
+    SQLModel.metadata.create_all(engine)
+
+    class FakeReconciliation:
+        def run(self):
+            return {
+                "status": "reconciled",
+                "repository": "jens/media-codec-dashboard",
+                "container": "Media-Codec-Dashboard",
+            }
+
+    import backend.app.services.media_codec_dashboard_deployment_reconciliation as module
+
+    monkeypatch.setattr(
+        module,
+        "MediaCodecDashboardDeploymentReconciliation",
+        FakeReconciliation,
+    )
+
+    with Session(engine) as session:
+        result = action_execution.execute_governed_action(
+            session,
+            action="deployment.target.reconcile_media_codec_dashboard",
+            target="jens/media-codec-dashboard",
+            source="chatgpt-mcp",
+            risk="high",
+            reason="Re-attest only the bounded dashboard controller state.",
+            original_policy_decision="allowed",
+        )
+
+    assert result["success"] is True
+    assert result["status"] == "success"
+    assert result["result"] == "success"
+    assert result["policyDecision"] == "allowed"
+    assert result["originalPolicyDecision"] == "allowed"
+    assert result["jobId"].startswith("job-")
+    assert result["auditId"].startswith("audit-")
+
+
+def test_media_codec_dashboard_reconciliation_propagates_fail_closed_result(
+    monkeypatch, tmp_path
+):
+    engine = create_engine(f"sqlite:///{tmp_path / 'dashboard-failure.db'}")
+    SQLModel.metadata.create_all(engine)
+
+    class FakeReconciliation:
+        def run(self):
+            return {
+                "status": "validation_failed",
+                "reason": "controller state for the current live revision is internally inconsistent",
+            }
+
+    import backend.app.services.media_codec_dashboard_deployment_reconciliation as module
+
+    monkeypatch.setattr(
+        module,
+        "MediaCodecDashboardDeploymentReconciliation",
+        FakeReconciliation,
+    )
+
+    with Session(engine) as session:
+        result = action_execution.execute_governed_action(
+            session,
+            action="deployment.target.reconcile_media_codec_dashboard",
+            target="jens/media-codec-dashboard",
+            source="chatgpt-mcp",
+            risk="high",
+            reason="Verify fail-closed propagation.",
+            original_policy_decision="allowed",
+        )
+
+    assert result["success"] is False
+    assert result["status"] == "failed"
+    assert result["message"] == (
+        "controller state for the current live revision is internally inconsistent"
+    )