Publish curated Unraid-AppOps-Gateway source from ba66029223865607deddc234e283c11127324eb8

backend/tests/test_mcp_hub_deployment_reconciliation.py

@@ -385,10 +385,25 @@ def test_external_candidate_pins_are_exact_and_declared_by_protected_main():
         node for node in parsed.body
         if isinstance(node, ast.FunctionDef) and node.name == "fixed_image_reference"
     )
-    declared = {
-        "postgres:18.6@sha256:0377e72c5289ed2f98cf61b1a9c2db9eb9d300317fe14244492fbc94343b3d04",
-        "redis:8.10.2@sha256:7ef5b5cec96495a04ca7feff88a9492efeab8053fb284d24bdd73344c9245a48",
-    }
+    postgres = (
+        "gitea.example.com/jens/itworx-mcp-hub/postgres:"
+        "wp400-gosu-v2-20261002-a94e0b4d2029@sha256:"
+        "a60d81e06987671ae903757f1b71cdfbbff4d481b42610e4de2b7dcfa32aad73"
+    )
+    redis = (
+        "gitea.example.com/jens/itworx-mcp-hub/redis:"
+        "wp400-remediation-20261002-4e18f61c@sha256:"
+        "7d826b44f245ad32e8fe4bf40d42eae95855c3942c5f2e42784ee8fd3f9547a2"
+    )
+    previous_postgres = (
+        "postgres:18.6@sha256:"
+        "0377e72c5289ed2f98cf61b1a9c2db9eb9d300317fe14244492fbc94343b3d04"
+    )
+    previous_redis = (
+        "redis:8.10.2@sha256:"
+        "7ef5b5cec96495a04ca7feff88a9492efeab8053fb284d24bdd73344c9245a48"
+    )
+    declared = {previous_postgres, previous_redis, postgres, redis}
     namespace = {
         "re": re,
         "main_declares_external_image": lambda image_ref: image_ref in declared,
@@ -399,13 +414,19 @@ def test_external_candidate_pins_are_exact_and_declared_by_protected_main():
     fixed = namespace["fixed_image_reference"]
 
     assert fixed("postgres", "postgres:18.4@sha256:3a82e1f56c8f0f5616a11103ac3d47e632c3938698946a7ad26da0df1334744a")
-    assert fixed(
-        "postgres",
-        "postgres:18.6@sha256:0377e72c5289ed2f98cf61b1a9c2db9eb9d300317fe14244492fbc94343b3d04",
-    )
+    assert fixed("postgres", "postgres:18.6@sha256:0377e72c5289ed2f98cf61b1a9c2db9eb9d300317fe14244492fbc94343b3d04")
     assert fixed("redis", "redis:8.10.0@sha256:c29e49ab2f85760a3827b53882e6dd9f5c6c3f0bb7d724e07bb31cbf275a5236")
     assert fixed("redis", "redis:8.10.2@sha256:7ef5b5cec96495a04ca7feff88a9492efeab8053fb284d24bdd73344c9245a48")
-    assert not fixed("postgres", "postgres:18.6@sha256:" + "a" * 64)
+    assert fixed("postgres", postgres)
+    assert fixed("redis", redis)
+    assert not fixed("redis", postgres)
+    assert not fixed("postgres", postgres[:-1] + "4")
+    assert not fixed("postgres", postgres.replace("wp400-gosu-v2-20261002-a94e0b4d2029", "wp400-gosu-v2-20261002-wrong"))
+    assert not fixed("postgres", postgres.replace("gitea.example.com/jens/itworx-mcp-hub", "gitea.example.com/other/itworx-mcp-hub"))
+    assert not fixed("redis", redis[:-1] + "3")
+    assert not fixed("redis", redis.replace("wp400-remediation-20261002-4e18f61c", "wp400-remediation-20261002-wrong"))
+    assert not fixed("redis", redis.replace("gitea.example.com/jens/itworx-mcp-hub", "gitea.example.com/other/itworx-mcp-hub"))
+    assert not fixed("postgres", "postgres:19.0@sha256:" + "a" * 64)
     assert not fixed("redis", "redis:8.10.3@sha256:" + "b" * 64)
     for service in ("web", "control-api", "dataplane-router", "connector-ingestion"):
         assert fixed(service, "sha256:" + "a" * 64)
@@ -413,8 +434,58 @@ def test_external_candidate_pins_are_exact_and_declared_by_protected_main():
         assert not fixed(service, "sha256:" + "a" * 64)
 
     namespace["main_declares_external_image"] = lambda _image_ref: False
-    assert not fixed("postgres", "postgres:18.6@sha256:0377e72c5289ed2f98cf61b1a9c2db9eb9d300317fe14244492fbc94343b3d04")
-    assert not fixed("redis", "redis:8.10.2@sha256:7ef5b5cec96495a04ca7feff88a9492efeab8053fb284d24bdd73344c9245a48")
+    assert fixed("postgres", "postgres:18.4@sha256:3a82e1f56c8f0f5616a11103ac3d47e632c3938698946a7ad26da0df1334744a")
+    assert not fixed("postgres", previous_postgres)
+    assert fixed("redis", "redis:8.10.0@sha256:c29e49ab2f85760a3827b53882e6dd9f5c6c3f0bb7d724e07bb31cbf275a5236")
+    assert not fixed("redis", previous_redis)
+    assert not fixed("postgres", postgres)
+    assert not fixed("redis", redis)
+
+
+@pytest.mark.parametrize("service, image_ref", [
+    (
+        "postgres",
+        "gitea.example.com/jens/itworx-mcp-hub/postgres:"
+        "wp400-gosu-v2-20261002-a94e0b4d2029@sha256:"
+        "a60d81e06987671ae903757f1b71cdfbbff4d481b42610e4de2b7dcfa32aad73",
+    ),
+    (
+        "redis",
+        "gitea.example.com/jens/itworx-mcp-hub/redis:"
+        "wp400-remediation-20261002-4e18f61c@sha256:"
+        "7d826b44f245ad32e8fe4bf40d42eae95855c3942c5f2e42784ee8fd3f9547a2",
+    ),
+])
+def test_new_db_pin_requires_exact_protected_main_compose_declaration(service, image_ref):
+    fake = FakePortainer()
+    McpHubDeploymentReconciliation(fake).run()
+    script = fake.calls[0][2]["json"]["Cmd"][2]
+    parsed = ast.parse(script)
+    function = next(
+        node for node in parsed.body
+        if isinstance(node, ast.FunctionDef) and node.name == "main_declares_external_image"
+    )
+    main_revision = "a" * 40
+    content = {"value": f"services:\n  {service}:\n    image: {image_ref}\n"}
+    calls = []
+
+    def git_run(*args):
+        calls.append(args)
+        return subprocess.CompletedProcess(args, 0, stdout=content["value"])
+
+    namespace = {"re": re, "main_revision": main_revision, "git_run": git_run}
+    exec(compile(ast.Module(body=[function], type_ignores=[]), "main-image-declaration-test", "exec"), namespace)
+    declares = namespace["main_declares_external_image"]
+    assert declares(image_ref)
+    assert calls == [("show", f"{main_revision}:infrastructure/compose/docker-compose.yml")]
+
+    calls.clear()
+    content["value"] = f"services:\n  {service}:\n    image: {image_ref[:-1]}0\n"
+    assert not declares(image_ref)
+    assert calls == [
+        ("show", f"{main_revision}:infrastructure/compose/docker-compose.yml"),
+        ("show", f"{main_revision}:infrastructure/compose/docker-compose.prod.yml"),
+    ]
 
 
 @pytest.fixture