Publish curated Unraid-AppOps-Gateway source from a506550ef83ef2d81651e37c98a89f7ee330c730

backend/tests/test_controller_bootstrap_import_host.py

@@ -2,6 +2,7 @@ from __future__ import annotations
 
 import importlib.util
 import json
+import os
 from pathlib import Path
 
 import pytest
@@ -41,3 +42,43 @@ def test_bootstrap_passes_only_on_stdin(monkeypatch):
     assert observed["input"] == b"sensitive-test-value"
     assert "sensitive-test-value" not in " ".join(observed["argv"])
     assert observed["capture_output"] is True
+
+
+@pytest.mark.skipif(os.name == "nt", reason="POSIX metadata and symlinks")
+def test_bootstrap_import_rejects_symlinks_and_multiple_links(tmp_path, monkeypatch):
+    monkeypatch.setattr(host_import.os, "geteuid", lambda: 0)
+    secret = tmp_path / "bootstrap"
+    secret.write_bytes(b"x" * 64)
+    secret.chmod(0o600)
+    link = tmp_path / "link"
+    link.symlink_to(secret)
+    with pytest.raises(ValueError):
+        host_import.read_bootstrap(link)
+    link.unlink()
+    os.link(secret, link)
+    with pytest.raises(ValueError):
+        host_import.read_bootstrap(secret)
+
+
+def test_host_import_uses_protected_volume_configuration():
+    assert host_import.BOOTSTRAP_FILE.as_posix() == (
+        "/var/lib/docker/volumes/itworx-controller-hub-releases/_data/controller-config/"
+        "appops-enrollment-bootstrap"
+    )
+
+
+@pytest.mark.skipif(os.name == "nt", reason="POSIX mode checks")
+def test_bootstrap_import_rechecks_private_mode_after_open(tmp_path, monkeypatch):
+    secret = tmp_path / "bootstrap"
+    secret.write_bytes(b"x" * 64)
+    secret.chmod(0o600)
+    monkeypatch.setattr(host_import.os, "geteuid", lambda: 0)
+    original_open = host_import.os.open
+
+    def change_mode_before_open(path, flags):
+        secret.chmod(0o644)
+        return original_open(path, flags)
+
+    monkeypatch.setattr(host_import.os, "open", change_mode_before_open)
+    with pytest.raises(ValueError, match="changed while opening"):
+        host_import.read_bootstrap(secret)