Initial curated Unraid-AppOps-Gateway source from 3bd6f6fee310125bfbb4d4650389a817f498724d

backend/tests/test_portfolio_deployment_recovery.py

@@ -0,0 +1,62 @@
+from pathlib import Path
+
+from backend.app.services.portfolio_deployment_recovery import (
+    _FAILED_REVISION,
+    _FAILURE_MESSAGE,
+    _LIVE_REVISION,
+    _REATTEST_SCRIPT,
+    _REPOSITORY,
+)
+
+
+def test_portfolio_recovery_is_pinned_to_exact_observed_incident():
+    assert _REPOSITORY == "jens/portfolio"
+    assert _LIVE_REVISION == "52c6f2fc74a1e39ad288f1c5e987a9cd5b072d3e"
+    assert _FAILED_REVISION == "b7955d90b63860ffff8e0bd84be123aaba632043"
+    assert _FAILURE_MESSAGE == "Existing production containers require a valid healthy live deployment state"
+    assert 'main.stdout.strip() != failed_revision' in _REATTEST_SCRIPT
+    assert 'state.get("live_status") == "unknown"' in _REATTEST_SCRIPT
+    assert 'attempt.get("revision") == failed_revision' in _REATTEST_SCRIPT
+    assert 'attempt.get("message") == failure_message' in _REATTEST_SCRIPT
+    assert '/mnt/cache/appdata/gitea-deploy-runners/state' in _REATTEST_SCRIPT
+    assert '/srv/example/appdata/gitea-deploy-runners/deploy.lock' not in _REATTEST_SCRIPT
+    assert '/mnt/cache/appdata/gitea-deploy-runners/deploy.lock' in _REATTEST_SCRIPT
+
+
+def test_portfolio_recovery_reuses_controller_receipt_verifiers():
+    assert "controller.validate_recorded_receipt" in _REATTEST_SCRIPT
+    assert "controller.verify_deployment" in _REATTEST_SCRIPT
+    assert "expected_image_ids=expected_image_ids" in _REATTEST_SCRIPT
+    assert "controller.deployment_artifacts" in _REATTEST_SCRIPT
+    assert "controller.verified_current_receipt" in _REATTEST_SCRIPT
+
+
+def test_portfolio_recovery_allows_only_ephemeral_container_identity_change():
+    assert 'if key != "container_id"' in _REATTEST_SCRIPT
+    assert "container_id_changed = False" in _REATTEST_SCRIPT
+    assert "if not container_id_changed" in _REATTEST_SCRIPT
+    assert 'artifacts.get("compose_sha256") != observed_artifacts.get("compose_sha256")' in _REATTEST_SCRIPT
+    assert 'repaired["live_receipt"] = observed_receipt' in _REATTEST_SCRIPT
+    assert 'repaired["live_artifacts"] = observed_artifacts' in _REATTEST_SCRIPT
+
+
+def test_portfolio_recovery_has_no_application_runtime_mutation_commands():
+    forbidden = (
+        "docker restart",
+        "docker stop",
+        "docker rm",
+        "docker compose up",
+        "docker compose down",
+        "subprocess.run([\"docker\", \"restart\"",
+        "subprocess.run([\"docker\", \"rm\"",
+    )
+    assert all(value not in _REATTEST_SCRIPT for value in forbidden)
+    assert "shutil.copy2(state_path, backup)" in _REATTEST_SCRIPT
+    assert "os.fsync" in _REATTEST_SCRIPT
+
+
+def test_portfolio_action_execution_accepts_reconciled_status():
+    source = Path("backend/app/services/action_execution.py").read_text(encoding="utf-8")
+    assert "from .portfolio_deployment_recovery import PortfolioDeploymentRecovery" in source
+    assert "PortfolioDeploymentRecovery().run()" in source
+    assert 'status in {"enrolled", "already-enrolled", "reconciled"}' in source