Publish curated Unraid-AppOps-Gateway source from 945a919d1a3bbd2bb5bd21eb221fc9b58d795d80

backend/tests/test_forge_secret_delivery_controller.py

@@ -129,8 +129,8 @@ def _signed_headers(status_module, body: bytes, *, nonce: str | None = None):
     }
 
 
-def _post(address, path: str, body: bytes, headers: dict[str, str]):
-    connection = http.client.HTTPConnection(*address, timeout=3)
+def _post(address, path: str, body: bytes, headers: dict[str, str], *, timeout: int = 3):
+    connection = http.client.HTTPConnection(*address, timeout=timeout)
     try:
         connection.request("POST", path, body=body, headers=headers)
         response = connection.getresponse()
@@ -497,12 +497,13 @@ def test_new_nonce_retries_same_bundle_and_changed_input_is_rejected(
     assert READ_TOKEN.decode() not in response.decode()
 
 
+@pytest.mark.parametrize("fsync_delay_seconds", [0.0, 0.04])
 @pytest.mark.skipif(
     os.name != "posix" or getattr(os, "geteuid", lambda: 1)() != 0,
     reason="the real bundle helper requires POSIX root ownership",
 )
 def test_signed_http_delivery_uses_real_bundle_helper_and_never_rotates(
-    status_module, endpoint, monkeypatch, tmp_path
+    status_module, endpoint, monkeypatch, tmp_path, fsync_delay_seconds
 ):
     _install_hmac_test(monkeypatch, status_module)
     import importlib
@@ -511,6 +512,19 @@ def test_signed_http_delivery_uses_real_bundle_helper_and_never_rotates(
     assert Path(bundle_module.__file__).resolve() == (
         BROKER / "forge_secret_bundle.py"
     ).resolve()
+    if fsync_delay_seconds:
+        real_os = bundle_module.os
+
+        class SlowFsyncOs:
+            def __getattr__(self, name):
+                return getattr(real_os, name)
+
+            def fsync(self, descriptor):
+                time.sleep(fsync_delay_seconds)
+                return real_os.fsync(descriptor)
+
+        # Keep actual durable writes and all ownership checks; model valid slow I/O.
+        monkeypatch.setattr(bundle_module, "os", SlowFsyncOs())
     root = tmp_path / "real-bundle-root"
     root.mkdir(mode=0o700)
     root.chmod(0o700)
@@ -541,6 +555,8 @@ def test_signed_http_delivery_uses_real_bundle_helper_and_never_rotates(
             status_module.FORGE_SECRET_DELIVERY_PATH,
             body,
             _signed_headers(status_module, body),
+            # Match the existing bounded production HTTP budget for real fsync I/O.
+            timeout=10,
         )
 
     status, response = send(_payload(status_module))