Initial curated Unraid-AppOps-Gateway source from 3bd6f6fee310125bfbb4d4650389a817f498724d

backend/tests/test_run_repopulse_adoption.py

@@ -0,0 +1,123 @@
+from __future__ import annotations
+
+import importlib.util
+import json
+from pathlib import Path
+from types import SimpleNamespace
+
+import pytest
+
+_SCRIPT = Path(__file__).resolve().parents[2] / "scripts" / "run_repopulse_adoption.py"
+_SPEC = importlib.util.spec_from_file_location("run_repopulse_adoption", _SCRIPT)
+assert _SPEC is not None and _SPEC.loader is not None
+handoff = importlib.util.module_from_spec(_SPEC)
+_SPEC.loader.exec_module(handoff)
+
+
+def test_fixed_operator_sequence_keeps_credential_out_of_result(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.setattr(handoff, "_require_root", lambda: None)
+    intent_id = "rpa-" + "a" * 20
+    calls: list[str] = []
+    secret = "operator-secret-value" * 4
+
+    def appops(
+        *arguments: str, payload: bytes | None = None, **_kwargs: object
+    ) -> dict:
+        if "prepare" in arguments:
+            calls.append("prepare")
+            return {"status": "prepared", "intentId": intent_id}
+        if "backend.app.services.repopulse_proxy_stage" in arguments:
+            calls.append("proxy")
+            return {"status": "ready", "intentId": intent_id}
+        if "-c" in arguments:
+            calls.append("handoff")
+            return {
+                "intentId": intent_id,
+                "idempotencySha256": "b" * 64,
+                "preflightSha256": "c" * 64,
+                "preflightProjection": {},
+                "targetCredential": secret,
+            }
+        assert "finalize" in arguments
+        assert payload is not None and secret.encode() not in payload
+        calls.append("finalize")
+        return {"status": "completed", "intentId": intent_id}
+
+    def controller(
+        command: list[str], *, payload: bytes | None = None, **_kwargs: object
+    ) -> dict:
+        if command[-1].endswith("stage_repopulse_target_attestation.py"):
+            calls.append("attestation")
+            return {"status": "staged", "intentId": intent_id}
+        assert command[-1].endswith("repopulse_adoption_cli.py")
+        assert json.loads(payload or b"{}")["targetCredential"] == secret
+        calls.append("controller")
+        return {"status": "deployment_verified", "intentId": intent_id}
+
+    monkeypatch.setattr(handoff, "_appops", appops)
+    monkeypatch.setattr(handoff, "_run", controller)
+    result = handoff.run()
+    assert result == {"status": "completed", "intentId": intent_id}
+    assert secret not in json.dumps(result)
+    assert calls == [
+        "prepare",
+        "proxy",
+        "attestation",
+        "handoff",
+        "controller",
+        "finalize",
+    ]
+
+
+def test_proxy_failure_prevents_secret_handoff(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr(handoff, "_require_root", lambda: None)
+    calls: list[str] = []
+
+    def appops(*arguments: str, **_kwargs: object) -> dict:
+        calls.append(arguments[-1])
+        if "prepare" in arguments:
+            return {"status": "prepared", "intentId": "rpa-" + "a" * 20}
+        return {"status": "blocked"}
+
+    monkeypatch.setattr(handoff, "_appops", appops)
+    monkeypatch.setattr(
+        handoff,
+        "_run",
+        lambda *_args, **_kwargs: pytest.fail("controller must not execute"),
+    )
+    with pytest.raises(handoff.AdoptionHandoffError, match="operator_step_blocked"):
+        handoff.run()
+    assert len(calls) == 2
+
+
+def test_operator_subprocess_uses_a_fixed_environment(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.setenv("PYTHONPATH", "/untrusted/modules")
+    observed: dict = {}
+
+    def invoke(command, **kwargs):
+        observed.update(kwargs)
+        assert command == ["python3", "fixed.py"]
+        return SimpleNamespace(returncode=0, stdout=b'{"status":"ready"}', stderr=b"")
+
+    monkeypatch.setattr(handoff.subprocess, "run", invoke)
+    assert handoff._run(["python3", "fixed.py"]) == {"status": "ready"}
+    assert "PYTHONPATH" not in observed["env"]
+    assert observed["env"]["PATH"].startswith("/usr/local/sbin:")
+
+
+def test_operator_rejects_ambiguous_child_json(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr(
+        handoff.subprocess,
+        "run",
+        lambda *_args, **_kwargs: SimpleNamespace(
+            returncode=0,
+            stdout=b'{"status":"ready","status":"blocked"}',
+            stderr=b"",
+        ),
+    )
+    with pytest.raises(handoff.AdoptionHandoffError, match="operator_result_invalid"):
+        handoff._run(["python3", "fixed.py"])