Publish curated Unraid-AppOps-Gateway source from a506550ef83ef2d81651e37c98a89f7ee330c730

backend/tests/test_mcp_hub_governed_topology.py

@@ -48,6 +48,138 @@ def _legacy_target(controller):
         "source_dir": (controller.EXACT_SOURCE_ROOT / "itworx-mcp-hub").as_posix(),
     }
 
+
+@pytest.mark.skipif(
+    os.name == "nt" or not hasattr(os, "geteuid") or os.geteuid() != 0,
+    reason="backup ownership contract requires root-owned POSIX fixtures",
+)
+def test_hub_backup_child_is_created_with_controller_owner_and_private_mode(
+    controller, tmp_path, monkeypatch
+):
+    state_root = tmp_path / "controller-state"
+    backup_root = state_root / "mcp-hub-backups"
+    state_root.mkdir(mode=0o700)
+    backup_root.mkdir(mode=0o700)
+    monkeypatch.setattr(controller, "STATE_ROOT", state_root)
+    monkeypatch.setattr(controller, "MCP_HUB_BACKUP_ROOT", backup_root)
+    monkeypatch.setattr(controller, "_mcp_hub_require_trusted_state_root", lambda: None)
+
+    attempt = backup_root / "attempt"
+    controller._mcp_hub_private_directory(attempt, create=True, root=backup_root)
+
+    metadata = attempt.stat()
+    assert (metadata.st_uid, metadata.st_gid) == (0, 0)
+    assert stat.S_IMODE(metadata.st_mode) == 0o700
+    controller._mcp_hub_private_directory(attempt, root=backup_root)
+
+
+@pytest.mark.skipif(
+    os.name == "nt" or not hasattr(os, "geteuid") or os.geteuid() != 0,
+    reason="backup root contract requires fixed-owner POSIX fixtures",
+)
+def test_hub_backup_root_rejects_group_readable_root(controller, tmp_path, monkeypatch):
+    state_root = tmp_path / "controller-state"
+    backup_root = state_root / "mcp-hub-backups"
+    state_root.mkdir(mode=0o700)
+    backup_root.mkdir(mode=0o750)
+    monkeypatch.setattr(controller, "STATE_ROOT", state_root)
+    monkeypatch.setattr(controller, "MCP_HUB_BACKUP_ROOT", backup_root)
+    monkeypatch.setattr(controller, "_mcp_hub_require_trusted_state_root", lambda: None)
+
+    with pytest.raises(controller.DeployError, match="not private and canonical"):
+        controller._mcp_hub_private_directory(backup_root, root=backup_root)
+
+
+@pytest.mark.skipif(
+    os.name == "nt" or not hasattr(os, "geteuid") or os.geteuid() != 0,
+    reason="fixed Hub backup owner contract requires root-owned POSIX fixtures",
+)
+def test_hub_backup_root_rejects_runtime_owner_even_when_it_matches_parent(
+    controller, tmp_path, monkeypatch
+):
+    state_root = tmp_path / "controller-state"
+    backup_root = state_root / "mcp-hub-backups"
+    state_root.mkdir(mode=0o700)
+    backup_root.mkdir(mode=0o700)
+    os.chown(state_root, 99, 100)
+    os.chown(backup_root, 99, 100)
+    monkeypatch.setattr(controller, "STATE_ROOT", state_root)
+    monkeypatch.setattr(controller, "MCP_HUB_BACKUP_ROOT", backup_root)
+    monkeypatch.setattr(controller, "_mcp_hub_require_trusted_state_root", lambda: None)
+
+    with pytest.raises(controller.DeployError, match="owner differs"):
+        controller._mcp_hub_private_directory(backup_root, root=backup_root)
+
+
+@pytest.mark.skipif(
+    os.name == "nt" or not hasattr(os, "geteuid") or os.geteuid() != 0,
+    reason="descriptor-relative private storage requires root-owned POSIX fixtures",
+)
+def test_hub_backup_anchor_is_created_under_the_pinned_controller_state(
+    controller, tmp_path, monkeypatch
+):
+    state_root = tmp_path / "controller-state"
+    state_root.mkdir(mode=0o755)
+    backup_root = state_root / "mcp-hub-backups"
+    monkeypatch.setattr(controller, "STATE_ROOT", state_root)
+    monkeypatch.setattr(controller, "MCP_HUB_BACKUP_ROOT", backup_root)
+    monkeypatch.setattr(controller, "_mcp_hub_require_trusted_state_root", lambda: None)
+
+    controller._mcp_hub_private_directory(backup_root, create=True)
+
+    metadata = backup_root.stat()
+    assert (metadata.st_uid, metadata.st_gid) == (0, 0)
+    assert stat.S_IMODE(metadata.st_mode) == 0o700
+    assert stat.S_IMODE(state_root.stat().st_mode) == 0o755
+
+
+@pytest.mark.skipif(
+    os.name == "nt" or not hasattr(os, "geteuid") or os.geteuid() != 0,
+    reason="descriptor-relative path replacement requires root-owned POSIX fixtures",
+)
+def test_hub_backup_child_rejects_parent_replacement_during_creation(
+    controller, tmp_path, monkeypatch
+):
+    state_root = tmp_path / "controller-state"
+    state_root.mkdir(mode=0o700)
+    backup_root = state_root / "mcp-hub-backups"
+    backup_root.mkdir(mode=0o700)
+    monkeypatch.setattr(controller, "STATE_ROOT", state_root)
+    monkeypatch.setattr(controller, "MCP_HUB_BACKUP_ROOT", backup_root)
+    monkeypatch.setattr(controller, "_mcp_hub_require_trusted_state_root", lambda: None)
+    real_mkdir = controller.os.mkdir
+
+    def replace_parent(path, mode=0o777, *, dir_fd=None):
+        real_mkdir(path, mode, dir_fd=dir_fd)
+        if path == "attempt" and dir_fd is not None:
+            backup_root.rename(state_root / "replaced-backups")
+            real_mkdir(backup_root, 0o700)
+
+    monkeypatch.setattr(controller.os, "mkdir", replace_parent)
+
+    with pytest.raises(controller.DeployError, match="could not be created safely"):
+        controller._mcp_hub_private_directory(backup_root / "attempt", create=True)
+    assert not (backup_root / "attempt").exists()
+
+
+@pytest.mark.skipif(os.name == "nt", reason="release receipt storage requires POSIX mode and ACL metadata")
+def test_hub_backup_receipt_directory_is_guarded_by_its_release_volume_parent(
+    controller, tmp_path, monkeypatch
+):
+    volume_root = tmp_path / "controller-hub-releases"
+    state_root = volume_root / "state"
+    receipt_root = state_root / "backup-receipts"
+    receipt_root.mkdir(mode=0o700, parents=True)
+    volume_root.chmod(0o700)
+    state_root.chmod(0o700)
+    monkeypatch.setattr(controller, "MCP_HUB_RELEASE_STORE_STATE_ROOT", state_root)
+    monkeypatch.setattr(controller, "MCP_HUB_BACKUP_RECEIPT_ROOT", receipt_root)
+
+    controller._mcp_hub_private_directory(receipt_root, root=state_root)
+    with pytest.raises(controller.DeployError, match="escapes its fixed parent"):
+        controller._mcp_hub_private_directory(receipt_root, root=controller.STATE_ROOT)
+
+
 def _valid_model(controller):
     services = {}
     for service_name in controller.MCP_HUB_SERVICES:
@@ -159,14 +291,11 @@ def test_installed_legacy_registry_shape_is_adapted_only_in_memory(controller):
             "docker-compose.prod.yml",
             "docker-compose.autodeploy.yml",
         ],
-        "exact_source": None,
-        "verify_oci_revision": None,
         "manual": False,
         "deploy_script": "",
         "archive_deploy_script": "",
         "live_probe": None,
         "managed_plan_version": "",
-        "clean_untracked_paths": None,
         "env_source": "/srv/example/appdata/itworx-mcp-hub/deploy.env",
     }
     original = copy.deepcopy(target)
@@ -182,8 +311,15 @@ def test_installed_legacy_registry_shape_is_adapted_only_in_memory(controller):
     for field, value in (
         ("source_dir", "/srv/example/appdata/other/repository"),
         ("compose_files", ["docker-compose.yml", "unexpected.yml"]),
+        ("exact_source", None),
+        ("exact_source", False),
         ("exact_source", True),
+        ("verify_oci_revision", None),
         ("verify_oci_revision", False),
+        ("verify_oci_revision", True),
+        ("clean_untracked_paths", None),
+        ("clean_untracked_paths", False),
+        ("clean_untracked_paths", []),
         ("env_source", "/tmp/untrusted.env"),
     ):
         changed = {**original, field: value}
@@ -921,14 +1057,28 @@ def test_database_size_query_is_limited_to_two_fixed_database_names(controller,
     assert "pg_database_size" in query
     assert captured["timeout"] == 30
 
+
+@pytest.mark.skipif(
+    os.name != "nt" and (not hasattr(os, "geteuid") or os.geteuid() != 0),
+    reason="backup cleanup ownership fixture requires root on POSIX",
+)
 def test_failed_backup_attempt_removes_only_its_unique_private_directory(
     controller, monkeypatch, tmp_path
 ):
-    backup_root = tmp_path / "backups"
+    appdata_root = tmp_path / "hub-appdata"
+    backup_root = appdata_root / "backups"
+    appdata_root.mkdir(mode=0o700)
     backup_root.mkdir(mode=0o700)
     monkeypatch.setattr(controller, "MCP_HUB_BACKUP_ROOT", backup_root)
-    monkeypatch.setattr(controller, "MCP_HUB_APPDATA_ROOT", tmp_path)
-    monkeypatch.setattr(controller, "_mcp_hub_private_directory", lambda *_args, **_kwargs: None)
+    monkeypatch.setattr(controller, "STATE_ROOT", appdata_root)
+    monkeypatch.setattr(controller, "_mcp_hub_require_trusted_state_root", lambda: None)
+    monkeypatch.setattr(controller, "MCP_HUB_APPDATA_ROOT", appdata_root)
+    private_directory = controller._mcp_hub_private_directory
+    monkeypatch.setattr(
+        controller,
+        "_mcp_hub_private_directory",
+        lambda path, **kwargs: private_directory(path, **{"root": backup_root, **kwargs}),
+    )
     monkeypatch.setattr(controller, "mcp_hub_validate_secret_files", lambda _model: 21)
     monkeypatch.setattr(
         controller,