117 lines
5.1 KiB
Python
117 lines
5.1 KiB
Python
import shutil
|
|
import subprocess
|
|
from pathlib import Path
|
|
|
|
import pytest
|
|
|
|
ROOT = Path(__file__).resolve().parents[2]
|
|
|
|
|
|
def test_canonical_compose_keeps_runtime_data_outside_the_source_checkout():
|
|
compose = (ROOT / "docker-compose.yml").read_text(encoding="utf-8")
|
|
dockerignore = (ROOT / ".dockerignore").read_text(encoding="utf-8").splitlines()
|
|
gitignore = (ROOT / ".gitignore").read_text(encoding="utf-8").splitlines()
|
|
|
|
assert "${APPOPS_DATA_PATH:-./data}:/data" in compose
|
|
assert "APPOPS_SECRET_KEY_FILE: /data/secret-key" in compose
|
|
assert "- .:/data" not in compose
|
|
assert "data" in dockerignore
|
|
assert "/data/" in gitignore
|
|
|
|
|
|
def test_canonical_compose_uses_explicit_publish_host_and_persistent_voice_token():
|
|
compose = (ROOT / "docker-compose.yml").read_text(encoding="utf-8")
|
|
dockerfile = (ROOT / "Dockerfile").read_text(encoding="utf-8")
|
|
entrypoint = (ROOT / "docker" / "entrypoint.sh").read_text(encoding="utf-8")
|
|
|
|
assert "${APPOPS_PUBLISH_HOST:-127.0.0.1}:1216:1216" in compose
|
|
assert "APP_OPS_VOICE_TOKEN_FILE=/data/voice-token" in dockerfile
|
|
assert 'generate_service_token "true" "${APP_OPS_VOICE_TOKEN:-}"' in entrypoint
|
|
assert '"${APP_OPS_VOICE_TOKEN_FILE:-${DATA_DIR}/voice-token}"' in entrypoint
|
|
|
|
|
|
def test_canonical_compose_keeps_reverse_proxy_network_after_redeploy():
|
|
compose = (ROOT / "docker-compose.yml").read_text(encoding="utf-8")
|
|
|
|
assert "- appops_proxy" in compose
|
|
assert "external: true" in compose
|
|
assert "name: ${APPOPS_PROXY_NETWORK:-itworx-mcp-hub-npm}" in compose
|
|
|
|
|
|
def test_canonical_compose_forwards_trusted_operator_proxy_configuration():
|
|
compose = (ROOT / "docker-compose.yml").read_text(encoding="utf-8")
|
|
|
|
assert 'APPOPS_OPERATOR_PROXY_AUTH: "${APPOPS_OPERATOR_PROXY_AUTH:-false}"' in compose
|
|
assert 'APPOPS_OPERATOR_PROXY_TRUSTED_NETWORKS: "${APPOPS_OPERATOR_PROXY_TRUSTED_NETWORKS:-}"' in compose
|
|
assert 'APPOPS_AUTH_ADMIN_SUBJECTS: "${APPOPS_AUTH_ADMIN_SUBJECTS:-}"' in compose
|
|
assert 'APPOPS_AUTHENTIK_CLIENT_SECRET_FILE: /data/authentik-oidc-secret' in compose
|
|
assert 'APPOPS_OPERATOR_PROXY_USERS:' not in compose
|
|
assert 'APPOPS_OPERATOR_PROXY_GROUPS:' not in compose
|
|
|
|
|
|
def test_canonical_compose_mounts_only_the_file_based_gitea_observer_secret():
|
|
compose = (ROOT / "docker-compose.yml").read_text(encoding="utf-8")
|
|
|
|
assert "GITEA_URL: https://gitea.example.com" in compose
|
|
assert "GITEA_ADMIN_TOKEN_FILE: /data/gitea-admin-token" in compose
|
|
assert "GITEA_ADMIN_TOKEN:" not in compose
|
|
assert (
|
|
"GITEA_RUNNER_TARGETS_JSON: '{}'"
|
|
in compose
|
|
)
|
|
|
|
|
|
def test_runtime_image_label_matches_the_app_version():
|
|
dockerfile = (ROOT / "Dockerfile").read_text(encoding="utf-8")
|
|
compose = (ROOT / "docker-compose.yml").read_text(encoding="utf-8")
|
|
version = (ROOT / "backend/app/core/version.py").read_text(encoding="utf-8")
|
|
|
|
expected_provenance = {
|
|
"APPOPS_BUILD_ID": "org.opencontainers.image.version",
|
|
"APPOPS_SOURCE_REVISION": "org.opencontainers.image.revision",
|
|
"APPOPS_SOURCE_REPOSITORY": "org.opencontainers.image.source",
|
|
"APPOPS_SOURCE_TREE": "org.opencontainers.image.source-tree",
|
|
"APPOPS_BUILD_DATE": "org.opencontainers.image.created",
|
|
}
|
|
for build_argument, image_label in expected_provenance.items():
|
|
assert f"ARG {build_argument}=" in dockerfile
|
|
assert f'{image_label}="${{{build_argument}}}"' in dockerfile
|
|
assert f'{build_argument}: "${{{build_argument}:-' in compose
|
|
|
|
assert 'io.itworx.app.version="1.8.0"' in dockerfile
|
|
assert 'io.itworx.app.user-auth="oidc-rbac"' in dockerfile
|
|
assert 'APP_VERSION = "1.8.0"' in version
|
|
|
|
|
|
def test_unraid_upgrade_can_restore_voice_token_without_logging_it():
|
|
script = (ROOT / "scripts" / "upgrade_single_1216.sh").read_text(encoding="utf-8")
|
|
|
|
assert "for env_key in \\\n APP_OPS_VOICE_TOKEN \\" in script
|
|
assert 'printf \'%s=%s\\n\' "$env_key" "$env_value" >> "$ENV_FILE"' in script
|
|
assert 'log "${env_value}"' not in script
|
|
|
|
|
|
def test_upgrade_preserves_file_based_voice_credential(tmp_path):
|
|
bash = shutil.which("bash")
|
|
git_bash = Path("C:/Program Files/Git/bin/bash.exe")
|
|
if git_bash.exists():
|
|
bash = str(git_bash)
|
|
if not bash:
|
|
pytest.skip("Bash is unavailable")
|
|
script = (ROOT / "scripts" / "upgrade_single_1216.sh").read_text(encoding="utf-8")
|
|
voice = script.split('VOICE_TOKEN_VALUE="$(awk', 1)[1].split("# Optional, explicit deployment-time overrides.", 1)[0]
|
|
voice = 'VOICE_TOKEN_VALUE="$(awk' + voice
|
|
credential = "existing-service-credential-must-survive-upgrade"
|
|
(tmp_path / "voice-token").write_text(credential)
|
|
(tmp_path / "runtime.env").write_text("APP_OPS_VOICE_TOKEN_FILE=/data/voice-token\n")
|
|
result = subprocess.run([bash, "-s"], input=f'''set -eu
|
|
APPDATA='{tmp_path.as_posix()}'
|
|
ENV_FILE="$APPDATA/runtime.env"
|
|
log() {{ echo unexpected_rotation; }}
|
|
{voice}
|
|
test "$VOICE_TOKEN_VALUE" = '{credential}'
|
|
! grep -q '^APP_OPS_VOICE_TOKEN=' "$ENV_FILE"
|
|
''', text=True, capture_output=True, check=False)
|
|
assert result.returncode == 0, result.stderr
|
|
assert "unexpected_rotation" not in result.stdout
|