Publish curated Unraid-AppOps-Gateway source from ad0a390e431166c3198a2ac3bec010c2b44f2dea

backend/tests/test_enrollment_plane.py

@@ -74,12 +74,14 @@ def _trust():
 
 
 class _Broker:
+    appdata_root = "/srv/example/appdata"
+
     def is_configured(self):
         return True
 
     def enrollment_capabilities(self, *, secret):
         assert secret == "b" * 64
-        return {"status": "ready"}
+        return {"status": "ready", "trustedAppdataRoot": self.appdata_root}
 
     def enrollment_preflight(self, enrollment, *, secret):
         assert secret == "b" * 64
@@ -251,6 +253,25 @@ def test_enrollment_schema_rejects_plaintext_secrets_and_untrusted_topology():
         raise AssertionError("wildcard hostname must be rejected")
 
 
+def test_appdata_root_defaults_to_legacy_and_allows_only_the_fixed_managed_root():
+    plan = _plan()
+    assert plan.trusted_appdata_root == "/srv/example/appdata"
+    assert plan.appdata_path == "/srv/example/appdata/wsbc-portal"
+
+    managed_root = "/var/lib/docker/volumes/itworx-managed-appdata/_data"
+    managed = _plan(trusted_appdata_root=managed_root)
+    assert managed.appdata_path == managed_root + "/wsbc-portal"
+
+    plan_payload = _plan().model_dump()
+    plan_payload["trusted_appdata_root"] = "/srv/example/other"
+    trust_payload = _trust().model_dump()
+    trust_payload["trusted_appdata_root"] = "/srv/example/other"
+    with pytest.raises(ValueError):
+        EnrollmentPlanV1.model_validate(plan_payload)
+    with pytest.raises(ValueError):
+        EnrollmentTrustConfigV1.model_validate(trust_payload)
+
+
 def test_repopulse_profile_accepts_only_its_fixed_authenticated_target():
     plan = _repopulse_plan()
     assert plan.application_id == "repopulse"
@@ -291,6 +312,34 @@ def test_repopulse_preflight_requires_existing_secret_and_trusted_npm_access_lis
         assert session.exec(select(EnrollmentJob)).all() == []
 
 
+def test_repopulse_legacy_profile_remains_usable_when_new_target_root_is_managed(tmp_path):
+    class RecordingBroker(_RepoPulseBroker):
+        def __init__(self):
+            super().__init__()
+            self.preflight_payloads = []
+
+        def enrollment_preflight(self, enrollment, *, secret):
+            self.preflight_payloads.append(dict(enrollment))
+            return super().enrollment_preflight(enrollment, secret=secret)
+
+    broker = RecordingBroker()
+    with _session(tmp_path) as session:
+        _configure(session)
+        set_secret(session, "REPOPULSE_GITEA_TOKEN", "opaque-gitea-token")
+        EnrollmentPlane.set_trust_config(
+            session,
+            _trust().model_copy(update={
+                "trusted_appdata_root": "/var/lib/docker/volumes/itworx-managed-appdata/_data",
+                "managed_appdata_backup_acknowledged": True,
+            }),
+        )
+        result = _plane(broker=broker, npm=_RepoPulseNpm()).preflight(session, _repopulse_plan())
+
+    assert result["status"] == "ready"
+    assert "trusted_appdata_root_mismatch" not in result["blockers"]
+    assert broker.preflight_payloads[0]["trusted_appdata_root"] == "/srv/example/appdata"
+
+
 def test_repopulse_enrollment_seals_exact_runtime_values_without_exposing_secrets(tmp_path):
     with _session(tmp_path) as session:
         _configure(session)
@@ -347,6 +396,126 @@ def test_capabilities_require_a_live_bootstrap_controller_contract(tmp_path):
         assert result["controller"]["status"] == "ready"
 
 
+def test_capabilities_block_when_controller_root_differs_from_operator_trust(tmp_path):
+    class AlternateRootBroker(_Broker):
+        appdata_root = "/var/lib/docker/volumes/itworx-managed-appdata/_data"
+
+    with _session(tmp_path) as session:
+        _configure(session)
+        result = _plane(broker=AlternateRootBroker()).capabilities(session)
+
+    assert result["targetEnrollment"]["status"] == "unavailable"
+    assert result["controller"]["status"] == "unavailable"
+    assert result["controller"]["reason"] == "trusted_appdata_root_mismatch"
+
+
+def test_capabilities_treat_roots_as_independent_availability_not_global_selection(tmp_path):
+    legacy_root = "/srv/example/appdata"
+    managed_root = "/var/lib/docker/volumes/itworx-managed-appdata/_data"
+
+    class MultiRootBroker(_Broker):
+        def enrollment_capabilities(self, *, secret):
+            assert secret == "b" * 64
+            return {
+                "status": "ready",
+                "trustedAppdataRoot": managed_root,
+                "availableTrustedAppdataRoots": [
+                    {"root": legacy_root, "status": "ready", "reason": ""},
+                    {"root": managed_root, "status": "ready", "reason": ""},
+                ],
+                "managedStorage": {"status": "ready", "initializationAvailable": False},
+            }
+
+    with _session(tmp_path) as session:
+        _configure(session)
+        plane = _plane(broker=MultiRootBroker())
+        legacy = plane.capabilities(session)
+        assert legacy["targetEnrollment"]["status"] == "ready"
+        assert legacy["managedStorage"]["status"] == "not_selected"
+        assert legacy["availableTrustedAppdataRoots"] == [
+            {"root": legacy_root, "status": "ready"},
+            {"root": managed_root, "status": "ready"},
+        ]
+
+        EnrollmentPlane.set_trust_config(
+            session,
+            _trust().model_copy(update={
+                "trusted_appdata_root": managed_root,
+                "managed_appdata_backup_acknowledged": True,
+            }),
+        )
+        managed = plane.capabilities(session)
+
+    assert managed["targetEnrollment"]["status"] == "ready"
+    assert managed["managedStorage"]["status"] == "ready"
+    assert managed["availableTrustedAppdataRoots"] == [
+        {"root": legacy_root, "status": "ready"},
+        {"root": managed_root, "status": "ready"},
+    ]
+
+
+def test_capabilities_fail_closed_and_hide_unrecognized_controller_roots(tmp_path):
+    class MalformedRootsBroker(_Broker):
+        def enrollment_capabilities(self, *, secret):
+            return {
+                "status": "ready",
+                "trustedAppdataRoot": "/srv/example/appdata",
+                "availableTrustedAppdataRoots": [
+                    {"root": "/srv/example/appdata", "status": "ready"},
+                    {"root": "/etc/private", "status": "ready", "reason": "sensitive controller path"},
+                ],
+            }
+
+    with _session(tmp_path) as session:
+        _configure(session)
+        result = _plane(broker=MalformedRootsBroker()).capabilities(session)
+
+    assert result["targetEnrollment"]["status"] == "unavailable"
+    assert result["availableTrustedAppdataRoots"] == [
+        {"root": "/srv/example/appdata", "status": "unavailable"},
+        {"root": "/var/lib/docker/volumes/itworx-managed-appdata/_data", "status": "unavailable"},
+    ]
+    assert "/etc/private" not in repr(result)
+    assert "sensitive controller path" not in repr(result)
+
+
+def test_enrollment_preflight_binds_root_to_trust_and_controller_payload(tmp_path):
+    class RecordingBroker(_Broker):
+        def __init__(self):
+            self.preflight_payloads = []
+
+        def enrollment_preflight(self, enrollment, *, secret):
+            self.preflight_payloads.append(dict(enrollment))
+            return super().enrollment_preflight(enrollment, secret=secret)
+
+    broker = RecordingBroker()
+    with _session(tmp_path) as session:
+        _configure(session)
+        plane = _plane(broker=broker)
+        managed_root = "/var/lib/docker/volumes/itworx-managed-appdata/_data"
+        alternate = _plan(trusted_appdata_root=managed_root)
+        blocked = plane.preflight(session, alternate)
+        assert blocked["status"] == "blocked"
+        assert "trusted_appdata_root_mismatch" in blocked["blockers"]
+        assert broker.preflight_payloads == []
+
+        EnrollmentPlane.set_trust_config(
+            session,
+            _trust().model_copy(update={
+                "trusted_appdata_root": managed_root,
+                "managed_appdata_backup_acknowledged": True,
+            }),
+        )
+        payload = plane._controller_payload(
+            alternate,
+            enrollment_id="enr-00000000000000000000",
+        )
+
+    assert payload["trusted_appdata_root"] == "/var/lib/docker/volumes/itworx-managed-appdata/_data"
+    assert payload["appdata_path"] == "/var/lib/docker/volumes/itworx-managed-appdata/_data/wsbc-portal"
+    assert payload["data_path"] == "/var/lib/docker/volumes/itworx-managed-appdata/_data/wsbc-portal/data"
+
+
 def test_enrollment_creates_write_only_credentials_exact_policies_and_is_idempotent(tmp_path):
     with _session(tmp_path) as session:
         _configure(session)