Publish curated Unraid-AppOps-Gateway source from a194da2defbd709ea58bd4c9503966dbd37b11f2

backend/tests/test_hub_candidate_import.py

@@ -1184,6 +1184,81 @@ def test_custom_external_database_accepts_exact_custom_repo_digest(
     assert calls == [archive_ref, image_ref]
 
 
+@pytest.mark.parametrize("service", ("postgres", "ingestion-clamd"))
+def test_reviewed_external_variant_requires_its_exact_archive_and_digest(
+    modules, monkeypatch, service
+):
+    importer, controller = modules.importer, modules.controller
+    image_ref = f"gitea.example.com/jens/itworx-mcp-hub/{service}:security-fixture@sha256:{'b' * 64}"
+    archive_ref = f"itworx-mcp-hub/{service}:security-fixture"
+    repo_digest = image_ref.split(":security-fixture", 1)[0] + "@sha256:" + "b" * 64
+    approved = {
+        name: (binding,) for name, binding in importer.EXTERNAL_IMAGES.items()
+    }
+    approved[service] += ((image_ref, archive_ref, repo_digest),)
+    monkeypatch.setattr(controller, "MCP_HUB_APPROVED_EXTERNAL_IMAGE_BINDINGS", approved, raising=False)
+    image_id = "sha256:" + "c" * 64
+    inspected = {
+        archive_ref: {"Id": image_id},
+        image_ref: {"Id": image_id, "RepoDigests": [repo_digest]},
+    }
+    monkeypatch.setattr(importer, "_inspect_image", inspected.get)
+    row = {"imageRef": image_ref, "archiveRef": archive_ref, "imageId": image_id}
+    assert importer._require_loaded_image(service, row, external=True)["Id"] == image_id
+    inspected[image_ref]["RepoDigests"] = [repo_digest[:-1] + "0"]
+    with pytest.raises(importer.CandidateRejected, match="Pinned external digest"):
+        importer._require_loaded_image(service, row, external=True)
+
+
+@pytest.mark.parametrize("service", ("postgres", "ingestion-clamd"))
+def test_external_variant_never_accepts_an_unreviewed_ref(modules, monkeypatch, service):
+    importer = modules.importer
+    image_id = "sha256:" + "c" * 64
+    unknown_ref = f"gitea.example.com/jens/itworx-mcp-hub/{service}:unknown@sha256:{'b' * 64}"
+    monkeypatch.setattr(importer, "_inspect_image", lambda _ref: {"Id": image_id, "RepoDigests": []})
+    with pytest.raises(importer.CandidateRejected, match="reviewed external image binding"):
+        importer._require_loaded_image(
+            service, {"imageRef": unknown_ref, "archiveRef": "unknown", "imageId": image_id}, external=True
+        )
+
+
+@pytest.mark.parametrize("service", ("postgres", "ingestion-clamd"))
+def test_protected_model_external_variant_has_a_distinct_exact_archive_ref(
+    modules, monkeypatch, service
+):
+    importer, controller = modules.importer, modules.controller
+    image_ref = f"gitea.example.com/jens/itworx-mcp-hub/{service}:security-fixture@sha256:{'b' * 64}"
+    archive_ref = f"itworx-mcp-hub/{service}:security-fixture"
+    approved = {name: (binding,) for name, binding in importer.EXTERNAL_IMAGES.items()}
+    approved[service] += ((image_ref, archive_ref, image_ref.split(":security-fixture", 1)[0] + "@sha256:" + "b" * 64),)
+    monkeypatch.setattr(controller, "MCP_HUB_APPROVED_EXTERNAL_IMAGE_BINDINGS", approved)
+    services = {
+        name: {"image": importer.EXTERNAL_IMAGES[name][0] if name in importer.EXTERNAL_IMAGES else "fixture:" + name}
+        for name in controller.MCP_HUB_SERVICES
+    }
+    ingestion = {"imageRef": services["connector-ingestion"]["image"], "archiveRef": "fixture:ingestion"}
+    services[service]["image"] = image_ref
+    references = importer._expected_image_refs({"services": services}, ingestion_binding=ingestion)
+    assert references[service] == (image_ref, archive_ref)
+    assert all(references[name][1] == binding[1] for name, binding in importer.EXTERNAL_IMAGES.items() if name != service)
+    services[service]["image"] = image_ref[:-1] + "0"
+    with pytest.raises(importer.CandidateRejected, match="fixed digest"):
+        importer._expected_image_refs({"services": services}, ingestion_binding=ingestion)
+
+
+@pytest.mark.parametrize("service", ("postgres", "ingestion-clamd"))
+def test_loaded_external_image_cannot_substitute_an_archive_alias(modules, monkeypatch, service):
+    importer = modules.importer
+    image_ref = importer.EXTERNAL_IMAGES[service][0]
+    monkeypatch.setattr(importer, "_inspect_image", lambda _ref: pytest.fail("must reject before inspecting a foreign alias"))
+    with pytest.raises(importer.CandidateRejected, match="reviewed external image binding"):
+        importer._require_loaded_image(
+            service,
+            {"imageRef": image_ref, "archiveRef": "foreign:alias", "imageId": "sha256:" + "c" * 64},
+            external=True,
+        )
+
+
 @pytest.mark.parametrize("service", ("postgres", "redis"))
 @pytest.mark.parametrize(
     "failure", ("upstream", "wrong_custom", "missing_repo_digests", "foreign_image_id")