118 lines
4.0 KiB
Python
118 lines
4.0 KiB
Python
from sqlmodel import Session, SQLModel, create_engine
|
|
|
|
from backend.app.services import action_execution
|
|
from backend.app.services.action_execution import approval_execution_supported
|
|
from backend.app.services.action_registry import (
|
|
ACTION_RISK,
|
|
ACTIONS,
|
|
action_default_target,
|
|
)
|
|
|
|
|
|
def test_media_codec_dashboard_reconciliation_is_fixed_high_risk_typed_action():
|
|
action = "deployment.target.reconcile_media_codec_dashboard"
|
|
assert action in ACTIONS
|
|
assert ACTION_RISK[action] == "high"
|
|
assert action_default_target(action) == "jens/media-codec-dashboard"
|
|
assert approval_execution_supported(action) is True
|
|
|
|
|
|
def test_media_codec_dashboard_reconciliation_rejects_any_other_target():
|
|
result = action_execution.execute_governed_action(
|
|
None, # type: ignore[arg-type]
|
|
action="deployment.target.reconcile_media_codec_dashboard",
|
|
target="jens/not-media-codec-dashboard",
|
|
source="chatgpt-mcp",
|
|
risk="high",
|
|
reason="Regression test for exact-target enforcement.",
|
|
original_policy_decision="allowed",
|
|
)
|
|
|
|
assert result["success"] is False
|
|
assert result["result"] == "blocked"
|
|
assert result["message"] == (
|
|
"Media Codec Dashboard reconciliation accepts only "
|
|
"jens/media-codec-dashboard."
|
|
)
|
|
|
|
|
|
def test_media_codec_dashboard_reconciliation_dispatches_fixed_executor(
|
|
monkeypatch, tmp_path
|
|
):
|
|
engine = create_engine(f"sqlite:///{tmp_path / 'dashboard-reconciliation.db'}")
|
|
SQLModel.metadata.create_all(engine)
|
|
|
|
class FakeReconciliation:
|
|
def run(self):
|
|
return {
|
|
"status": "reconciled",
|
|
"repository": "jens/media-codec-dashboard",
|
|
"container": "Media-Codec-Dashboard",
|
|
}
|
|
|
|
import backend.app.services.media_codec_dashboard_deployment_reconciliation as module
|
|
|
|
monkeypatch.setattr(
|
|
module,
|
|
"MediaCodecDashboardDeploymentReconciliation",
|
|
FakeReconciliation,
|
|
)
|
|
|
|
with Session(engine) as session:
|
|
result = action_execution.execute_governed_action(
|
|
session,
|
|
action="deployment.target.reconcile_media_codec_dashboard",
|
|
target="jens/media-codec-dashboard",
|
|
source="chatgpt-mcp",
|
|
risk="high",
|
|
reason="Re-attest only the bounded dashboard controller state.",
|
|
original_policy_decision="allowed",
|
|
)
|
|
|
|
assert result["success"] is True
|
|
assert result["status"] == "success"
|
|
assert result["result"] == "success"
|
|
assert result["policyDecision"] == "allowed"
|
|
assert result["originalPolicyDecision"] == "allowed"
|
|
assert result["jobId"].startswith("job-")
|
|
assert result["auditId"].startswith("audit-")
|
|
|
|
|
|
def test_media_codec_dashboard_reconciliation_propagates_fail_closed_result(
|
|
monkeypatch, tmp_path
|
|
):
|
|
engine = create_engine(f"sqlite:///{tmp_path / 'dashboard-failure.db'}")
|
|
SQLModel.metadata.create_all(engine)
|
|
|
|
class FakeReconciliation:
|
|
def run(self):
|
|
return {
|
|
"status": "validation_failed",
|
|
"reason": "controller state for the current live revision is internally inconsistent",
|
|
}
|
|
|
|
import backend.app.services.media_codec_dashboard_deployment_reconciliation as module
|
|
|
|
monkeypatch.setattr(
|
|
module,
|
|
"MediaCodecDashboardDeploymentReconciliation",
|
|
FakeReconciliation,
|
|
)
|
|
|
|
with Session(engine) as session:
|
|
result = action_execution.execute_governed_action(
|
|
session,
|
|
action="deployment.target.reconcile_media_codec_dashboard",
|
|
target="jens/media-codec-dashboard",
|
|
source="chatgpt-mcp",
|
|
risk="high",
|
|
reason="Verify fail-closed propagation.",
|
|
original_policy_decision="allowed",
|
|
)
|
|
|
|
assert result["success"] is False
|
|
assert result["status"] == "failed"
|
|
assert result["message"] == (
|
|
"controller state for the current live revision is internally inconsistent"
|
|
)
|