Publish curated Unraid-AppOps-Gateway source from f8f5bf0a29159bd69accd7e58f6427ec32140640

backend/tests/test_controller_hub_release_volume.py

@@ -3,6 +3,8 @@ from __future__ import annotations
 import importlib.util
 import json
 import os
+import sys
+import types
 from pathlib import Path
 
 import pytest
@@ -415,6 +417,85 @@ def test_source_compose_preflight_rejects_host_file_reads_before_compose(compose
     assert calls == []
 
 
+@pytest.mark.parametrize(
+    "source",
+    [
+        b"services:\n  app:\n    'env_file': /tmp/secret\n",
+        b"services: {app: {\"include\": ./untrusted.yml}}\n",
+        b"services:\n  - \"build\": ./untrusted\n",
+        b"services:\n  app:\n    \"\\u0065nv_file\": /tmp/secret\n",
+    ],
+)
+def test_source_compose_preflight_rejects_quoted_or_escaped_file_keys(source):
+    with pytest.raises(module.VolumeTransitionError):
+        module._preflight_source_compose(source)
+
+
+def test_preparer_uses_the_pinned_bundled_yaml_parser():
+    assert module.yaml.__version__ == "6.0.2"
+    assert module.yaml.__name__.startswith("_appops_controller_yaml_")
+    assert module.yaml.__with_libyaml__ is False
+    assert Path(module.yaml.__file__).resolve().parent == ROOT / "scripts/vendor/yaml"
+
+
+def test_preparer_does_not_replace_a_host_cached_yaml_module(monkeypatch):
+    host_yaml = types.ModuleType("yaml")
+    host_yaml.__file__ = "/host/site-packages/yaml/__init__.py"
+    monkeypatch.setitem(sys.modules, "yaml", host_yaml)
+    original_sys_path = sys.path.copy()
+    module_name = "_controller_volume_import_isolation_test"
+    spec = importlib.util.spec_from_file_location(
+        module_name, ROOT / "scripts/prepare_controller_hub_release_volume.py"
+    )
+    assert spec is not None and spec.loader is not None
+    isolated_module = importlib.util.module_from_spec(spec)
+    monkeypatch.setitem(sys.modules, module_name, isolated_module)
+    spec.loader.exec_module(isolated_module)
+    assert sys.modules["yaml"] is host_yaml
+    assert isolated_module.yaml.__name__.startswith("_appops_controller_yaml_")
+    assert isolated_module.yaml.safe_load(b"services: {}") == {"services": {}}
+    assert sys.path == original_sys_path
+
+
+def test_source_compose_preflight_ignores_comments_strings_and_block_scalars():
+    source = (
+        b"name: gitea-deploy-runners\n"
+        b"# include: ./disabled.yml\n"
+        b"services:\n  app:\n"
+        b"    command: |\n"
+        b"      echo 'env_file: is command text'\n"
+        b"      echo include: is command text\n"
+        b"    labels: {note: \"build: is a label value\"}\n"
+    )
+    module._preflight_source_compose(source)
+
+
+def test_source_compose_preflight_rejects_unresolvable_alias_keys():
+    source = b"services:\n  app:\n    *unsafe-key: value\n"
+    with pytest.raises(module.VolumeTransitionError, match="compose_source_invalid"):
+        module._preflight_source_compose(source)
+
+
+@pytest.mark.parametrize(
+    "source",
+    [
+        b"services: {}\nconfigs:\n  tls-material:\n    file: /etc/ssl/private/key.pem\n",
+        b"services: {}\nsecrets: {gitea-token: {environment: GITEA_TOKEN}}\n",
+    ],
+)
+def test_source_compose_preflight_rejects_local_config_and_secret_sources(source):
+    with pytest.raises(module.VolumeTransitionError, match="external_source_invalid"):
+        module._preflight_source_compose(source)
+
+
+def test_source_compose_preflight_allows_external_config_and_service_environment_fields():
+    source = (
+        b"configs:\n  tls-material:\n    external: true\n"
+        b"services:\n  app:\n    environment:\n      file: no-local-file-read\n"
+    )
+    module._preflight_source_compose(source)
+
+
 def test_capture_program_is_fixed_descriptor_based_and_compiles():
     legacy = module._controller_capture_source(config_root_in_code=True)
     protected = module._controller_capture_source(config_root_in_code=False)