Publish curated Unraid-AppOps-Gateway source from a506550ef83ef2d81651e37c98a89f7ee330c730

backend/tests/test_controller_config_paths.py

@@ -1,7 +1,15 @@
 from __future__ import annotations
 
+import ast
 import importlib.util
+import json
+import os
+import subprocess
+import sys
 from pathlib import Path
+from types import SimpleNamespace
+
+import pytest
 
 ROOT = Path(__file__).resolve().parents[2]
 
@@ -114,3 +122,64 @@ def test_status_reads_hub_state_through_the_fixed_pinned_adapter(monkeypatch, tm
 
     monkeypatch.setattr(mcp_hub_release_store, "read_hub_state_bytes", lambda: b'\xff')
     assert controller._deployment_state("itworx-mcp-hub") == {}
+
+
+@pytest.mark.skipif(os.name == "nt", reason="the registration script uses POSIX flock")
+@pytest.mark.parametrize("matching_aliases", [True, False])
+def test_embedded_registry_writer_uses_protected_aliases_and_preserves_code(
+    monkeypatch, tmp_path, matching_aliases
+):
+    from backend.app.services.deployment_target_registry import _REGISTER_SCRIPT
+
+    registry = tmp_path / "protected" / "projects.json"
+    registry.parent.mkdir(mode=0o755)
+    registry.write_text("{}\n")
+    registry.chmod(0o600)
+    readonly = registry if matching_aliases else tmp_path / "different-registry.json"
+    if not matching_aliases:
+        readonly.write_text("{}\n")
+        readonly.chmod(0o600)
+    code = tmp_path / "old-code"
+    code.mkdir()
+    old_registry = code / "projects.json"
+    old_registry.write_text('{"old":"must stay unchanged"}\n')
+    original = old_registry.read_bytes()
+    old_host_registry = tmp_path / "old-host-registry.json"
+    old_host_registry.write_text("{}\n")
+    repositories = tmp_path / "repositories"
+    bare = repositories / "jens" / "example.git"
+    bare.mkdir(parents=True)
+    paths = {
+        "/controller-config/projects.json": readonly,
+        "/controller-hub-releases/controller-config/projects.json": registry,
+        "/opt/gitea-deploy/projects.json": old_registry,
+        "/mnt/cache/appdata/gitea-deploy-runners/controller/projects.json": old_host_registry,
+        "/mnt/cache/appdata/gitea-deploy-runners/deploy.lock": tmp_path / "deploy.lock",
+        "/gitea-repositories": repositories,
+    }
+
+    def fixture_path(value):
+        return paths.get(str(value), Path(value))
+
+    revision = "a" * 40
+    monkeypatch.setattr(
+        subprocess, "run", lambda *_args, **_kwargs: SimpleNamespace(returncode=0, stdout=revision + "\n")
+    )
+    project = {"branch": "main", "slug": "example", "compose_files": ["docker-compose.yml"]}
+    monkeypatch.setattr(sys, "argv", ["script", "jens/example", revision, "main", json.dumps(project)])
+    tree = ast.parse(_REGISTER_SCRIPT)
+    # Redirect only filesystem paths into disposable fixtures. All production
+    # validation, locking, backup, atomic replace and readback code executes.
+    tree.body = [node for node in tree.body if not (isinstance(node, ast.ImportFrom) and node.module == "pathlib")]
+    if matching_aliases:
+        exec(compile(tree, "registry-writer", "exec"), {"Path": fixture_path})
+        assert json.loads(registry.read_text()) == {"jens/example": project}
+        assert registry.stat().st_mode & 0o777 == 0o600
+        assert list(registry.parent.glob("projects.json.appops-backup-*"))
+    else:
+        with pytest.raises(SystemExit) as error:
+            exec(compile(tree, "registry-writer", "exec"), {"Path": fixture_path})
+        assert error.value.code == 36
+        assert registry.read_text() == "{}\n"
+    assert old_registry.read_bytes() == original
+    assert old_host_registry.read_text() == "{}\n"