Initial curated Unraid-AppOps-Gateway source from 3bd6f6fee310125bfbb4d4650389a817f498724d

backend/tests/test_repopulse_target_credential.py

@@ -0,0 +1,71 @@
+from __future__ import annotations
+
+import pytest
+from sqlmodel import Session, SQLModel, create_engine
+
+from backend.app.db.models import Secret
+from backend.app.services import repopulse_target_credential as target
+
+
+def test_fixed_target_credential_is_durable_and_collision_safe(tmp_path, monkeypatch):
+    monkeypatch.setattr(
+        target.secret_store,
+        "secret_storage_status",
+        lambda: {"productionReady": True},
+    )
+    engine = create_engine(f"sqlite:///{tmp_path / 'credentials.db'}")
+    SQLModel.metadata.create_all(engine)
+    first_intent = "rpa-" + "a" * 20
+
+    with Session(engine) as session:
+        first_id, first_secret = target.get_or_create_repopulse_target_credential(
+            session, intent_id=first_intent
+        )
+        row = session.get(Secret, "ENROLL_REPOPULSE_TARGET_HMAC")
+        assert row is not None
+        assert first_secret.decode("ascii") not in row.encrypted_value
+
+    with Session(engine) as session:
+        replay_id, replay_secret = target.get_or_create_repopulse_target_credential(
+            session, intent_id=first_intent
+        )
+        assert (replay_id, replay_secret) == (first_id, first_secret)
+        with pytest.raises(
+            target.RepoPulseTargetCredentialError, match="target_credential_collision"
+        ):
+            target.get_or_create_repopulse_target_credential(
+                session, intent_id="rpa-" + "b" * 20
+            )
+
+    with Session(engine) as session:
+        row = session.get(Secret, "ENROLL_REPOPULSE_TARGET_HMAC")
+        assert row is not None
+        row.metadata_json = {}
+        session.add(row)
+        session.commit()
+        with pytest.raises(
+            target.RepoPulseTargetCredentialError, match="target_credential_collision"
+        ):
+            target.get_or_create_repopulse_target_credential(
+                session, intent_id=first_intent
+            )
+
+
+def test_fixed_target_credential_requires_production_secret_store(
+    tmp_path, monkeypatch
+):
+    monkeypatch.setattr(
+        target.secret_store,
+        "secret_storage_status",
+        lambda: {"productionReady": False},
+    )
+    engine = create_engine(f"sqlite:///{tmp_path / 'credentials.db'}")
+    SQLModel.metadata.create_all(engine)
+    with Session(engine) as session:
+        with pytest.raises(
+            target.RepoPulseTargetCredentialError, match="secret_store_not_ready"
+        ):
+            target.get_or_create_repopulse_target_credential(
+                session, intent_id="rpa-" + "a" * 20
+            )
+        assert session.get(Secret, "ENROLL_REPOPULSE_TARGET_HMAC") is None