Publish curated Unraid-AppOps-Gateway source from bc001a6df859f7c9836fa145afb739d1ceebc524

backend/tests/test_hub_candidate_import.py

@@ -1098,6 +1098,96 @@ def test_tar_preflight_rejects_extension_headers_before_tarfile(modules, tmp_pat
         importer._preflight_uncompressed_tar(path)
 
 
+_CUSTOM_DB_REPO_DIGESTS = {
+    "postgres": "gitea.example.com/jens/itworx-mcp-hub/postgres@sha256:a60d81e06987671ae903757f1b71cdfbbff4d481b42610e4de2b7dcfa32aad73",
+    "redis": "gitea.example.com/jens/itworx-mcp-hub/redis@sha256:7d826b44f245ad32e8fe4bf40d42eae95855c3942c5f2e42784ee8fd3f9547a2",
+}
+
+
+@pytest.mark.parametrize("service", ("postgres", "redis"))
+def test_custom_external_database_accepts_exact_custom_repo_digest(
+    modules, monkeypatch, service
+):
+    importer = modules.importer
+    image_ref, archive_ref = importer.EXTERNAL_IMAGES[service][:2]
+    custom_repo_digest = _CUSTOM_DB_REPO_DIGESTS[service]
+    image_id = "sha256:" + "a" * 64
+    calls = []
+
+    def inspect(reference):
+        calls.append(reference)
+        if reference == archive_ref:
+            return {"Id": image_id}
+        if reference == image_ref:
+            return {"Id": image_id, "RepoDigests": [custom_repo_digest]}
+        return None
+
+    monkeypatch.setattr(importer, "_inspect_image", inspect)
+    result = importer._require_loaded_image(
+        service,
+        {"imageRef": image_ref, "archiveRef": archive_ref, "imageId": image_id},
+        external=True,
+    )
+
+    assert result["Id"] == image_id
+    assert calls == [archive_ref, image_ref]
+
+
+@pytest.mark.parametrize("service", ("postgres", "redis"))
+@pytest.mark.parametrize(
+    "failure", ("upstream", "wrong_custom", "missing_repo_digests", "foreign_image_id")
+)
+def test_custom_external_database_rejects_nonmatching_repo_digest_or_image_id(
+    modules, monkeypatch, service, failure
+):
+    importer = modules.importer
+    image_ref, archive_ref = importer.EXTERNAL_IMAGES[service][:2]
+    custom_repo_digest = _CUSTOM_DB_REPO_DIGESTS[service]
+    image_id = "sha256:" + "a" * 64
+    foreign_id = "sha256:" + "f" * 64
+    if failure == "upstream":
+        repo_digests = {
+            "postgres": (
+                "postgres@sha256:0377e72c5289ed2f98cf61b1a9c2db9eb9d300317fe14244492fbc94343b3d04",
+                "docker.io/library/postgres@sha256:0377e72c5289ed2f98cf61b1a9c2db9eb9d300317fe14244492fbc94343b3d04",
+            ),
+            "redis": (
+                "redis@sha256:7ef5b5cec96495a04ca7feff88a9492efeab8053fb284d24bdd73344c9245a48",
+                "docker.io/library/redis@sha256:7ef5b5cec96495a04ca7feff88a9492efeab8053fb284d24bdd73344c9245a48",
+            ),
+        }[service]
+    elif failure == "wrong_custom":
+        repository = custom_repo_digest.rsplit("@", 1)[0]
+        repo_digests = [repository + "@sha256:" + "b" * 64]
+    elif failure == "missing_repo_digests":
+        repo_digests = None
+    else:
+        repo_digests = [custom_repo_digest]
+
+    def inspect(reference):
+        if reference == archive_ref:
+            return {"Id": image_id}
+        if reference == image_ref:
+            return {
+                "Id": foreign_id if failure == "foreign_image_id" else image_id,
+                "RepoDigests": repo_digests,
+            }
+        return None
+
+    monkeypatch.setattr(importer, "_inspect_image", inspect)
+    error = (
+        "Pinned external image ID differs"
+        if failure == "foreign_image_id"
+        else "Pinned external digest is not present"
+    )
+    with pytest.raises(importer.CandidateRejected, match=error):
+        importer._require_loaded_image(
+            service,
+            {"imageRef": image_ref, "archiveRef": archive_ref, "imageId": image_id},
+            external=True,
+        )
+
+
 def test_remote_head_without_completed_candidate_stays_awaiting(modules, tmp_path, monkeypatch):
     controller = modules.controller
     prepare = modules.prepare