Publish curated Unraid-AppOps-Gateway source from a480f280f26f4aa48c61394fa841d2233067c208
This commit is contained in:
Public Source Publisher committed
1 parent
e73772cdf2
commit
820244dbb3
13 files changed
+2141
-26
No files matched your search
@@ -2059,3 +2059,227 @@ def test_authentik_readiness_requires_exact_mapping_key_and_redirect_contract(
|
||||
payloads[certificate_url]["data"] = "x" * (64 * 1024)
|
||||
assert status_module._forge_oidc_attestation() == ("unknown", None)
|
||||
assert opener.responses[certificate_url].read_sizes[-1] == 65537
|
||||
|
||||
|
||||
def test_current_runtime_readiness_requires_a_fresh_six_container_snapshot(
|
||||
controller_module, tmp_path
|
||||
):
|
||||
profile = _profile(controller_module)
|
||||
calls = []
|
||||
|
||||
def inspect_runner(arguments, **kwargs):
|
||||
calls.append((arguments, kwargs))
|
||||
container = arguments[-1]
|
||||
service = {
|
||||
"itworx-forge-itworx-forge-1": "itworx-forge",
|
||||
"itworx-forge-postgres-1": "postgres",
|
||||
"itworx-forge-migrate-1": "migrate",
|
||||
"itworx-forge-api-1": "api",
|
||||
"itworx-forge-worker-1": "worker",
|
||||
"itworx-forge-dashboard-1": "dashboard",
|
||||
}[container]
|
||||
app_service = True
|
||||
item = {
|
||||
"image": controller_module.ForgeFirstInstallController._expected_image(
|
||||
profile, service, _FORGE_PRIVATE_OWNER
|
||||
),
|
||||
"project": controller_module.PROJECT_NAME,
|
||||
"service": service,
|
||||
"source": _FORGE_SOURCE_URL if app_service else None,
|
||||
"revision": profile["revision"] if app_service else None,
|
||||
"running": service != "migrate",
|
||||
"status": "exited" if service == "migrate" else "running",
|
||||
"health": "healthy",
|
||||
"exitCode": 0,
|
||||
}
|
||||
return subprocess.CompletedProcess(arguments, 0, json.dumps(item), "")
|
||||
|
||||
controller = _controller(controller_module, tmp_path, profile)
|
||||
controller.readiness_command_runner = inspect_runner
|
||||
_write_protected_config(controller.config_path, _forge_config())
|
||||
request = controller_module.request_id(profile, "runtime-readiness-test")
|
||||
controller._write_record(
|
||||
{
|
||||
"schema": controller_module.STATE_SCHEMA,
|
||||
"kind": "request",
|
||||
"request": request,
|
||||
"repository": controller_module.REPOSITORY,
|
||||
"operation": controller_module.OPERATION,
|
||||
"profile": profile,
|
||||
"status": "deployed",
|
||||
"phase": "verified_deployed",
|
||||
"mutationStarted": True,
|
||||
"migrationStarted": True,
|
||||
"migrationCompleted": True,
|
||||
}
|
||||
)
|
||||
record_before = controller._read_record(request)
|
||||
|
||||
result = controller.runtime_readiness(request)
|
||||
|
||||
assert result == {
|
||||
"status": "ready",
|
||||
"request": request,
|
||||
"repository": controller_module.REPOSITORY,
|
||||
"operation": controller_module.OPERATION,
|
||||
"profile": {
|
||||
"revision": profile["revision"],
|
||||
"workspaceImageDigest": profile["workspace_image_digest"],
|
||||
"frontdoorImageDigest": profile["frontdoor_image_digest"],
|
||||
},
|
||||
"health": {
|
||||
"status": "healthy",
|
||||
"services": [
|
||||
{"name": name, "status": "healthy"}
|
||||
for name in controller_module.RUNTIME_SERVICES
|
||||
],
|
||||
},
|
||||
"migrationCompleted": True,
|
||||
}
|
||||
assert len(calls) == 6
|
||||
assert all(call[0][:3] == ["docker", "inspect", "--type"] for call in calls)
|
||||
assert all(call[0][4] == "--format" for call in calls)
|
||||
assert all(".Config.Env" not in call[0][5] and ".Config.Labels" in call[0][5] for call in calls)
|
||||
assert [call[0][-1] for call in calls] == list(controller_module.CONTAINER_NAMES)
|
||||
assert controller._read_record(request) == record_before
|
||||
|
||||
|
||||
@pytest.mark.parametrize(
|
||||
("change", "expected", "service_status"),
|
||||
[
|
||||
("image", "not_ready", "not_ready"),
|
||||
("source", "not_ready", "not_ready"),
|
||||
("running", "not_ready", "not_ready"),
|
||||
("health", "not_ready", "not_ready"),
|
||||
("migration_exit", "not_ready", "healthy"),
|
||||
("boolean_exit", "unavailable", "healthy"),
|
||||
("malformed", "unavailable", "unavailable"),
|
||||
],
|
||||
)
|
||||
def test_current_readiness_rejects_changed_live_identity_and_bad_migration(
|
||||
controller_module, tmp_path, change, expected, service_status
|
||||
):
|
||||
profile = _profile(controller_module)
|
||||
|
||||
def inspect_runner(arguments, **_kwargs):
|
||||
container = arguments[-1]
|
||||
service = controller_module.RUNTIME_CONTAINER_SERVICES[container]
|
||||
item = {
|
||||
"image": controller_module.ForgeFirstInstallController._expected_image(
|
||||
profile, service, _FORGE_PRIVATE_OWNER
|
||||
),
|
||||
"project": controller_module.PROJECT_NAME,
|
||||
"service": service,
|
||||
"source": _FORGE_SOURCE_URL if service != "postgres" else None,
|
||||
"revision": profile["revision"] if service != "postgres" else None,
|
||||
"running": service != "migrate",
|
||||
"status": "exited" if service == "migrate" else "running",
|
||||
"health": None if service == "migrate" else "healthy",
|
||||
"exitCode": 0,
|
||||
}
|
||||
if container == "itworx-forge-api-1":
|
||||
if change == "image":
|
||||
item["image"] = "gitea.example.com/itworx-forge@sha256:" + "0" * 64
|
||||
elif change == "source":
|
||||
item["source"] = "https://attacker.invalid/repository"
|
||||
elif change == "running":
|
||||
item["running"] = False
|
||||
elif change == "health":
|
||||
item["health"] = None
|
||||
elif change == "malformed":
|
||||
return subprocess.CompletedProcess(arguments, 0, '{"status":"deployed"}', "")
|
||||
if container == "itworx-forge-migrate-1":
|
||||
if change == "migration_exit":
|
||||
item["exitCode"] = 1
|
||||
elif change == "boolean_exit":
|
||||
item["exitCode"] = True
|
||||
return subprocess.CompletedProcess(arguments, 0, json.dumps(item), "")
|
||||
|
||||
controller = _controller(controller_module, tmp_path, profile)
|
||||
controller.readiness_command_runner = inspect_runner
|
||||
_write_protected_config(controller.config_path, _forge_config())
|
||||
request = controller_module.request_id(profile, "runtime-mismatch-test")
|
||||
controller._write_record(
|
||||
{
|
||||
"schema": controller_module.STATE_SCHEMA,
|
||||
"kind": "request",
|
||||
"request": request,
|
||||
"repository": controller_module.REPOSITORY,
|
||||
"operation": controller_module.OPERATION,
|
||||
"profile": profile,
|
||||
"status": "deployed",
|
||||
"phase": "verified_deployed",
|
||||
"mutationStarted": True,
|
||||
"migrationStarted": True,
|
||||
"migrationCompleted": True,
|
||||
}
|
||||
)
|
||||
|
||||
result = controller.runtime_readiness(request)
|
||||
|
||||
assert result["status"] == expected
|
||||
api = next(item for item in result["health"]["services"] if item["name"] == "api")
|
||||
assert api["status"] == service_status
|
||||
assert result["migrationCompleted"] is (change not in {"migration_exit", "boolean_exit"})
|
||||
|
||||
|
||||
def test_non_deployed_controller_record_is_unavailable_without_inspection(
|
||||
controller_module, tmp_path
|
||||
):
|
||||
profile = _profile(controller_module)
|
||||
controller = _controller(controller_module, tmp_path, profile)
|
||||
controller.readiness_command_runner = lambda *_args, **_kwargs: pytest.fail(
|
||||
"non-deployed journal must not trigger Docker inspection"
|
||||
)
|
||||
_write_protected_config(controller.config_path, _forge_config())
|
||||
request = controller_module.request_id(profile, "runtime-nondeployed-test")
|
||||
controller._write_record(
|
||||
{
|
||||
"schema": controller_module.STATE_SCHEMA,
|
||||
"kind": "request",
|
||||
"request": request,
|
||||
"repository": controller_module.REPOSITORY,
|
||||
"operation": controller_module.OPERATION,
|
||||
"profile": profile,
|
||||
"status": "outcome_unknown",
|
||||
"phase": "worker_state_not_recoverable",
|
||||
"mutationStarted": True,
|
||||
"migrationStarted": True,
|
||||
"migrationCompleted": True,
|
||||
}
|
||||
)
|
||||
|
||||
result = controller.runtime_readiness(request)
|
||||
|
||||
assert result["status"] == "unavailable"
|
||||
assert result["migrationCompleted"] is False
|
||||
|
||||
|
||||
def test_invalid_protected_config_is_unavailable_without_inspection(controller_module, tmp_path):
|
||||
profile = _profile(controller_module)
|
||||
controller = _controller(controller_module, tmp_path, profile)
|
||||
controller.readiness_command_runner = lambda *_args, **_kwargs: pytest.fail(
|
||||
"invalid protected config must block readiness before Docker inspection"
|
||||
)
|
||||
_write_protected_config(controller.config_path, {"schema": "wrong"})
|
||||
request = controller_module.request_id(profile, "runtime-invalid-config")
|
||||
controller._write_record(
|
||||
{
|
||||
"schema": controller_module.STATE_SCHEMA,
|
||||
"kind": "request",
|
||||
"request": request,
|
||||
"repository": controller_module.REPOSITORY,
|
||||
"operation": controller_module.OPERATION,
|
||||
"profile": profile,
|
||||
"status": "deployed",
|
||||
"phase": "verified_deployed",
|
||||
"mutationStarted": True,
|
||||
"migrationStarted": True,
|
||||
"migrationCompleted": True,
|
||||
}
|
||||
)
|
||||
|
||||
result = controller.runtime_readiness(request)
|
||||
|
||||
assert result["status"] == "unavailable"
|
||||
assert result["migrationCompleted"] is False
|
||||
Reference in new issue
Block a user