From 4cec1122d717b70045cb28df296e7b32c303060c Mon Sep 17 00:00:00 2001 From: Public Source Publisher Date: Sat, 3 Oct 2026 21:40:39 +0000 Subject: [PATCH] Publish curated Unraid-AppOps-Gateway source from 892631aa317c21f6ba0787d25a7140ee18f90b75 --- PUBLIC_SOURCE_EXPORT.md | 2 +- PUBLIC_SOURCE_MANIFEST.json | 6 +- .../test_controller_artifact_bootstrap.py | 154 +++++++++++++++++- 3 files changed, 149 insertions(+), 13 deletions(-) diff --git a/PUBLIC_SOURCE_EXPORT.md b/PUBLIC_SOURCE_EXPORT.md index bc04c9f..2623090 100644 --- a/PUBLIC_SOURCE_EXPORT.md +++ b/PUBLIC_SOURCE_EXPORT.md @@ -1,3 +1,3 @@ # Public source export -This source snapshot was generated from the private canonical repository at revision `4f159a7e60d5becc5218ef4c541e2005d733a537`. It contains no private Git history or operational evidence. Changes are published from the canonical repository. +This source snapshot was generated from the private canonical repository at revision `892631aa317c21f6ba0787d25a7140ee18f90b75`. It contains no private Git history or operational evidence. Changes are published from the canonical repository. diff --git a/PUBLIC_SOURCE_MANIFEST.json b/PUBLIC_SOURCE_MANIFEST.json index fe19ee7..5d44458 100644 --- a/PUBLIC_SOURCE_MANIFEST.json +++ b/PUBLIC_SOURCE_MANIFEST.json @@ -1,6 +1,6 @@ { "schemaVersion": 1, - "sourceRevision": "4f159a7e60d5becc5218ef4c541e2005d733a537", + "sourceRevision": "892631aa317c21f6ba0787d25a7140ee18f90b75", "files": [ { "path": ".dockerignore", @@ -854,8 +854,8 @@ }, { "path": "backend/tests/test_controller_artifact_bootstrap.py", - "sha256": "e198bfef1b404005472f56e7c399055b665e0004317bbc890bc7ba73f7e74fa9", - "bytes": 44333 + "sha256": "09b4691f9505d561bc63e1383ea199d5dcb090dac4e42baac062c03fd4b09421", + "bytes": 48924 }, { "path": "backend/tests/test_controller_artifact_promoter.py", diff --git a/backend/tests/test_controller_artifact_bootstrap.py b/backend/tests/test_controller_artifact_bootstrap.py index b1933a2..99f58e3 100644 --- a/backend/tests/test_controller_artifact_bootstrap.py +++ b/backend/tests/test_controller_artifact_bootstrap.py @@ -28,6 +28,7 @@ REVISION = "a" * 40 TREE = "b" * 40 CALLER_ID = "c" * 64 MODERN_HELPER_ID = "f" * 64 +HOST_HOSTNAME = "Tower" LEGACY_HELPER_SOURCE_FIXTURE = ''' @@ -364,6 +365,7 @@ def _inspect_from_spec( spec: dict[str, Any], *, state: dict[str, Any], + hostname: str | None = None, ) -> dict[str, Any]: return { "Id": identifier, @@ -375,7 +377,7 @@ def _inspect_from_spec( "User": spec["User"], "Cmd": spec["Cmd"], "Labels": {**_controller_labels(), **spec["Labels"]}, - "Hostname": identifier[:12], + "Hostname": hostname if hostname is not None else identifier[:12], }, "HostConfig": {"ReadonlyRootfs": False, **spec["HostConfig"]}, } @@ -383,16 +385,19 @@ def _inspect_from_spec( class FakeDocker: def __init__(self, caller_spec: dict[str, Any], *, existing_child: dict[str, Any] | None = None): + legacy_caller = _inspect_from_spec( + "itworx-controller-artifact-promoter", + CALLER_ID, + CONTROLLER_IMAGE_ID, + caller_spec, + state={"Running": True}, + hostname=HOST_HOSTNAME, + ) self.containers = { APPOPS_CONTAINER_ID: _appops_inspect(), "gitea-deploy-control": _controller_inspect(), - CALLER_ID[:12]: _inspect_from_spec( - "itworx-controller-artifact-promoter", - CALLER_ID, - CONTROLLER_IMAGE_ID, - caller_spec, - state={"Running": True}, - ), + bootstrap.LEGACY_HELPER_NAME: legacy_caller, + CALLER_ID[:12]: legacy_caller, } self.images = { APPOPS_IMAGE_ID: _image(_appops_labels()), @@ -404,13 +409,19 @@ class FakeDocker: self.existing_child = existing_child self.created: list[dict[str, Any]] = [] self.started: list[str] = [] + self.inspected: list[str] = [] + self.host_name = HOST_HOSTNAME self.log_bytes = b"controller_v2_ready revision=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\n" def inspect_container(self, reference: str) -> dict[str, Any] | None: + self.inspected.append(reference) if reference == "itworx-controller-artifact-promoter-modern": return self.existing_child return self.containers.get(reference) + def daemon_name(self) -> str: + return self.host_name + def inspect_image(self, image_id: str) -> dict[str, Any] | None: return self.images.get(image_id) @@ -507,7 +518,7 @@ def _run_bootstrap( *, health: dict[str, Any] | None = None, initial_health: dict[str, Any] | None = None, - hostname: str = CALLER_ID[:12], + hostname: str = HOST_HOSTNAME, ): source = (ROOT / "backend/app/services/controller_artifact_helper_spec.py").read_text( encoding="utf-8" @@ -573,6 +584,131 @@ def test_immutable_legacy_helper_source_fixture_passes_bootstrap_identity_guard( ] +def test_host_network_legacy_caller_is_resolved_by_fixed_name_not_host_hostname(): + docker = FakeDocker(_legacy_helper_spec()) + git = FakeProtectedGit("") + + result = _run_bootstrap(docker, git, hostname=HOST_HOSTNAME) + + assert result["status"] == "promoted" + assert bootstrap.LEGACY_HELPER_NAME in docker.inspected + assert HOST_HOSTNAME not in docker.inspected + assert docker.created + + +def test_docker_info_hostname_reader_returns_only_bounded_name(monkeypatch: pytest.MonkeyPatch): + client = object.__new__(bootstrap.DockerSocketClient) + requests: list[tuple[str, str, int]] = [] + + def fake_request(method: str, path: str, *, max_bytes: int) -> tuple[int, bytes]: + requests.append((method, path, max_bytes)) + return 200, json.dumps({"Name": HOST_HOSTNAME, "ID": "must-not-be-returned"}).encode() + + monkeypatch.setattr(client, "_request", fake_request) + + assert client.daemon_name() == HOST_HOSTNAME + assert requests == [("GET", "/info", bootstrap.MAX_DOCKER_JSON_BYTES)] + + +@pytest.mark.parametrize( + "name", + ["", "Tower/other", "Tower\n", "Töwer", "bad..name", "-tower", "tower-", "a" * 254], +) +def test_docker_info_hostname_reader_rejects_malformed_or_non_ascii_names( + monkeypatch: pytest.MonkeyPatch, name: str +): + client = object.__new__(bootstrap.DockerSocketClient) + monkeypatch.setattr( + client, + "_request", + lambda *_args, **_kwargs: (200, json.dumps({"Name": name}).encode()), + ) + + with pytest.raises(bootstrap.BootstrapError): + client.daemon_name() + + +def test_docker_info_hostname_reader_rejects_oversized_response(monkeypatch: pytest.MonkeyPatch): + read_limits: list[int] = [] + + class Response: + status = 200 + + def read(self, limit: int) -> bytes: + read_limits.append(limit) + return b"x" * limit + + class Connection: + def __init__(self, _socket_path: str): + pass + + def request(self, *_args: Any, **_kwargs: Any) -> None: + pass + + def getresponse(self) -> Response: + return Response() + + def close(self) -> None: + pass + + monkeypatch.setattr(bootstrap, "_UnixHTTPConnection", Connection) + + with pytest.raises(bootstrap.BootstrapError, match="response_too_large"): + bootstrap.DockerSocketClient().daemon_name() + + assert read_limits == [bootstrap.MAX_DOCKER_JSON_BYTES + 1] + + +@pytest.mark.parametrize( + ("daemon_name", "process_hostname", "caller_hostname"), + [ + ("Tower", "tower", "Tower"), + ("OtherHost", "Tower", "Tower"), + ("Tower", "Tower", "OtherHost"), + ("bad/name", "bad/name", "bad/name"), + ("Töwer", "Töwer", "Töwer"), + ], +) +def test_legacy_caller_rejects_hostname_source_disagreement_without_creating_child( + daemon_name: str, process_hostname: str, caller_hostname: str +): + docker = FakeDocker(_legacy_helper_spec()) + docker.host_name = daemon_name + docker.containers[bootstrap.LEGACY_HELPER_NAME]["Config"]["Hostname"] = caller_hostname + git = FakeProtectedGit("") + + with pytest.raises(bootstrap.BootstrapError): + _run_bootstrap(docker, git, hostname=process_hostname) + + assert bootstrap.LEGACY_HELPER_NAME in docker.inspected + assert process_hostname not in docker.inspected + assert docker.created == [] + + +def test_legacy_caller_rejects_malformed_container_id_without_creating_child(): + docker = FakeDocker(_legacy_helper_spec()) + docker.containers[bootstrap.LEGACY_HELPER_NAME]["Id"] = "not-a-container-id" + git = FakeProtectedGit("") + + with pytest.raises(bootstrap.BootstrapError): + _run_bootstrap(docker, git) + + assert docker.created == [] + + +def test_missing_fixed_legacy_name_does_not_fall_back_to_process_hostname(): + docker = FakeDocker(_legacy_helper_spec()) + docker.containers[HOST_HOSTNAME] = docker.containers.pop(bootstrap.LEGACY_HELPER_NAME) + git = FakeProtectedGit("") + + with pytest.raises(bootstrap.BootstrapError): + _run_bootstrap(docker, git, hostname=HOST_HOSTNAME) + + assert bootstrap.LEGACY_HELPER_NAME in docker.inspected + assert HOST_HOSTNAME not in docker.inspected + assert docker.created == [] + + @pytest.mark.parametrize( "mutation", [