Publish curated Unraid-AppOps-Gateway source from a506550ef83ef2d81651e37c98a89f7ee330c730

backend/tests/test_mcp_hub_candidate_preparation.py

@@ -272,6 +272,122 @@ def test_plan_freezes_protected_metadata_without_candidate_or_approval(harness):
     assert h.state.mutations == []
 
 
+def test_plan_candidate_freezes_the_selected_workflow_creation_timestamp(
+    harness, monkeypatch
+):
+    h = harness
+    revision = h.revision
+    built_at = "2026-10-03T12:34:56.789Z"
+    observed = []
+    metadata = {
+        "id": revision[:12],
+        "repository": h.controller.MCP_HUB_REPOSITORY,
+        "revision": revision,
+        "tree": "d" * 40,
+        "treeDigest": hashlib.sha256(("git-tree:" + "d" * 40).encode()).hexdigest(),
+        "builtAt": built_at,
+    }
+    monkeypatch.setattr(h.controller, "output", lambda _args: revision)
+    monkeypatch.setattr(h.controller, "validate_commit", lambda _repo, _branch, commit: commit)
+
+    def deployment_metadata(_repo, supplied_revision, repository, *, built_at=None):
+        observed.append(built_at)
+        assert supplied_revision == revision
+        assert repository == h.controller.MCP_HUB_REPOSITORY
+        return dict(metadata)
+
+    monkeypatch.setattr(h.controller, "deployment_metadata", deployment_metadata)
+    monkeypatch.setattr(h.controller, "mcp_hub_stage_release_source", lambda *_args: h.state.source)
+    monkeypatch.setattr(h.controller, "exact_source_matches_revision", lambda *_args: True)
+    compose_calls = []
+
+    def fixed_compose_modeler(project, revision, repository):
+        compose_calls.append((project, revision, repository))
+        return {
+            "services": {
+                service: {"image": f"fixture/{service}:candidate"}
+                for service in h.controller.MCP_HUB_SERVICES
+            }
+        }
+
+    monkeypatch.setattr(
+        h.controller,
+        "mcp_hub_compose_model",
+        lambda *_args: pytest.fail("plan used the ambient Compose renderer"),
+    )
+
+    staging = (
+        h.controller.STATE_ROOT
+        / "mcp-hub-release-imports"
+        / revision
+        / ("1" * 32)
+        / revision
+    )
+    h.utility.plan_candidate(
+        h.controller.MCP_HUB_REPOSITORY,
+        revision,
+        built_at=built_at,
+        staging_directory=staging,
+        compose_modeler=fixed_compose_modeler,
+    )
+
+    plan = json.loads(
+        (staging / "build.json").read_text()
+    )
+    assert observed == [built_at]
+    assert plan["build"]["builtAt"] == built_at
+    assert len(compose_calls) == 1
+
+
+def test_candidate_preparation_rejects_staging_path_outside_private_import_anchor(
+    harness,
+):
+    h = harness
+    revision = h.revision
+    staging = h.controller.STATE_ROOT / "outside-imports" / revision
+    with pytest.raises(h.controller.DeployError, match="private anchor|staging path"):
+        h.utility.plan_candidate(
+            h.controller.MCP_HUB_REPOSITORY,
+            revision,
+            staging_directory=staging,
+        )
+    assert not staging.exists()
+
+
+def test_candidate_preparation_rejects_symlinked_staging_destination(harness):
+    h = harness
+    revision = h.revision
+    anchor = h.controller.STATE_ROOT / "mcp-hub-release-imports" / revision
+    token = anchor / ("2" * 32)
+    token.mkdir(parents=True, mode=0o700)
+    target = h.controller.STATE_ROOT / "untrusted-target"
+    target.mkdir(mode=0o700)
+    staging = token / revision
+    staging.symlink_to(target, target_is_directory=True)
+    with pytest.raises(h.controller.DeployError):
+        h.utility.plan_candidate(
+            h.controller.MCP_HUB_REPOSITORY,
+            revision,
+            staging_directory=staging,
+        )
+
+
+def test_candidate_preparation_rejects_nonprivate_staging_parent(harness):
+    h = harness
+    revision = h.revision
+    anchor = h.controller.STATE_ROOT / "mcp-hub-release-imports" / revision
+    token = anchor / ("3" * 32)
+    token.mkdir(parents=True, mode=0o700)
+    token.chmod(0o755)
+    staging = token / revision
+    with pytest.raises(h.controller.DeployError, match="private|safe|canonical"):
+        h.utility.plan_candidate(
+            h.controller.MCP_HUB_REPOSITORY,
+            revision,
+            staging_directory=staging,
+        )
+
+
 def test_wrong_repository_and_nonroot_fail_before_controller_access(
     modules, monkeypatch
 ):
@@ -354,6 +470,37 @@ def test_capture_emits_candidate_and_pending_only_envelope_without_apply_calls(
     }
 
 
+def test_capture_can_use_the_importers_fixed_image_inspector(harness, monkeypatch):
+    h = harness
+    inspected = []
+
+    def fixed_inspector(reference):
+        inspected.append(reference)
+        return h.state.images.get(reference)
+
+    monkeypatch.setattr(
+        h.controller,
+        "inspect_image",
+        lambda _reference: pytest.fail("capture used the ambient Docker context"),
+    )
+    monkeypatch.setattr(
+        h.controller,
+        "mcp_hub_compose_model",
+        lambda *_args: pytest.fail("capture used the ambient Compose renderer"),
+    )
+    result = h.utility.capture_candidate(
+        h.controller.MCP_HUB_REPOSITORY,
+        h.revision,
+        image_inspector=fixed_inspector,
+        compose_modeler=lambda *_args: h.model,
+    )
+    assert result["status"] == "pending_review"
+    assert len(inspected) == 17
+    assert set(inspected) == {
+        row["image"] for row in h.model["services"].values()
+    }
+
+
 @pytest.mark.parametrize("mutation", ["label", "root"])
 def test_capture_rejects_contextforge_provenance_drift_without_candidate(
     harness, mutation