346 lines
11 KiB
Python
346 lines
11 KiB
Python
from __future__ import annotations
|
|
|
|
from sqlmodel import Session, SQLModel, create_engine
|
|
|
|
from backend.app.db.models import Policy
|
|
from backend.app.schemas.deployment import (
|
|
DeploymentPlanV1,
|
|
validate_compose_runtime_contract,
|
|
)
|
|
from backend.app.services.deployment_control_plane import DeploymentControlPlane
|
|
from backend.app.services.secret_store import set_secret
|
|
|
|
|
|
def _plan(**overrides):
|
|
payload = {
|
|
"application_id": "wsbc-portal",
|
|
"repository": "Jens/Windows-Support-Bundle-Collector",
|
|
"revision": "a" * 40,
|
|
"release_version": "0.23.0",
|
|
"image_repository": "wsbc-portal",
|
|
"image_tag": "0.23.0",
|
|
"topology": {
|
|
"compose_project": "wsbc-portal",
|
|
"containers": ["wsbc-portal"],
|
|
"proxy_network": "itworx-npm",
|
|
"internal_port": 8080,
|
|
},
|
|
"proxy": {"hostname": "support.example.com"},
|
|
"oidc": {
|
|
"application_slug": "wsbc-portal",
|
|
"client_secret_ref": "WSBC_PORTAL_OIDC_CLIENT_SECRET",
|
|
"roles": {
|
|
"administrator_group": "Administrator",
|
|
"support_agent_group": "SupportAgent",
|
|
"read_only_group": "ReadOnly",
|
|
},
|
|
},
|
|
"broker_secret_ref": "WSBC_PORTAL_DEPLOYMENT_BROKER",
|
|
}
|
|
payload.update(overrides)
|
|
return DeploymentPlanV1.model_validate(payload)
|
|
|
|
|
|
class _Broker:
|
|
def preflight(self, plan, *, secret):
|
|
assert secret == "a" * 32
|
|
return {"status": "preflight_ok"}
|
|
|
|
def apply(self, plan, *, secret, idempotency_key):
|
|
assert secret == "a" * 32
|
|
return {"status": "accepted", "request": "b" * 64}
|
|
|
|
def rollback(self, plan, *, secret, idempotency_key):
|
|
return {"status": "accepted", "request": "c" * 64}
|
|
|
|
def status(self, request_id, *, secret):
|
|
return {"status": "deployed", "request": request_id}
|
|
|
|
|
|
class _Portainer:
|
|
def list_containers(self):
|
|
return {"status": "ok", "containers": []}
|
|
|
|
|
|
class _Npm:
|
|
def proxy_hosts(self):
|
|
return {"success": True, "items": []}
|
|
|
|
def ensure_managed_proxy_host(self, **kwargs):
|
|
assert kwargs["forward_host"] == "wsbc-portal"
|
|
return {"success": True, "status": "created", "hostId": 42}
|
|
|
|
|
|
class _Authentik:
|
|
def test_connection(self):
|
|
return {"status": "connected"}
|
|
|
|
def applications(self):
|
|
return {"success": True, "items": []}
|
|
|
|
def ensure_deployment_oidc_application(self, **kwargs):
|
|
assert kwargs["application_slug"] == "wsbc-portal"
|
|
assert kwargs["client_secret"] == "b" * 32
|
|
return {"success": True, "status": "created", "applicationId": "app-1"}
|
|
|
|
|
|
class _Unraid:
|
|
def get_share_summary(self):
|
|
return {"status": "ok"}
|
|
|
|
|
|
def _session(tmp_path):
|
|
engine = create_engine(f"sqlite:///{tmp_path / 'deployment.db'}")
|
|
SQLModel.metadata.create_all(engine)
|
|
return Session(engine)
|
|
|
|
|
|
def _plane():
|
|
return DeploymentControlPlane(
|
|
broker=_Broker(),
|
|
portainer=_Portainer(),
|
|
npm=_Npm(),
|
|
authentik=_Authentik(),
|
|
unraid=_Unraid(),
|
|
)
|
|
|
|
|
|
def test_plan_rejects_latest_tag_and_raw_secret_like_fields():
|
|
raw = _plan().model_dump()
|
|
raw["image_tag"] = "latest"
|
|
try:
|
|
DeploymentPlanV1.model_validate(raw)
|
|
except ValueError as exc:
|
|
assert "non-latest" in str(exc)
|
|
else: # pragma: no cover - assertion clarity
|
|
raise AssertionError("latest tag must be rejected")
|
|
|
|
raw = _plan().model_dump()
|
|
raw["deployment_secret"] = "not-allowed"
|
|
try:
|
|
DeploymentPlanV1.model_validate(raw)
|
|
except ValueError as exc:
|
|
assert "Extra inputs" in str(exc)
|
|
else: # pragma: no cover - assertion clarity
|
|
raise AssertionError("raw secret fields must be rejected")
|
|
|
|
raw = _plan().model_dump()
|
|
raw["proxy"]["force_ssl"] = False
|
|
try:
|
|
DeploymentPlanV1.model_validate(raw)
|
|
except ValueError as exc:
|
|
assert "force HTTPS" in str(exc)
|
|
else: # pragma: no cover - assertion clarity
|
|
raise AssertionError("managed proxy must force HTTPS")
|
|
|
|
|
|
def test_preflight_fails_closed_without_exact_target_policy(tmp_path):
|
|
plan = _plan(oidc=None)
|
|
with _session(tmp_path) as session:
|
|
set_secret(session, "WSBC_PORTAL_DEPLOYMENT_BROKER", "a" * 32)
|
|
result = _plane().execute(
|
|
session,
|
|
plan=plan,
|
|
idempotency_key="preflight-without-policy-0001",
|
|
operation="preflight",
|
|
)
|
|
|
|
assert result["status"] == "preflight_failed"
|
|
assert "deployment_policy" in result["preflight"]["blockers"]
|
|
|
|
|
|
def test_preflight_rejects_wildcard_deployment_policy(tmp_path):
|
|
plan = _plan(oidc=None)
|
|
with _session(tmp_path) as session:
|
|
set_secret(session, "WSBC_PORTAL_DEPLOYMENT_BROKER", "a" * 32)
|
|
session.add(Policy(
|
|
id="wildcard-deploy",
|
|
action="deployment.apply",
|
|
target="*",
|
|
voice="blocked",
|
|
manual="allowed",
|
|
risk="high",
|
|
reason="Wildcard must not authorize a production deployment.",
|
|
))
|
|
session.commit()
|
|
result = _plane().execute(
|
|
session,
|
|
plan=plan,
|
|
idempotency_key="preflight-wildcard-policy-0001",
|
|
operation="preflight",
|
|
)
|
|
|
|
assert result["status"] == "preflight_failed"
|
|
assert "deployment_policy" in result["preflight"]["blockers"]
|
|
|
|
|
|
def test_compose_contract_rejects_docker_socket_and_unowned_mounts():
|
|
plan = _plan(oidc=None)
|
|
unsafe = """
|
|
services:
|
|
wsbc-portal:
|
|
image: wsbc-portal:0.23.0
|
|
restart: unless-stopped
|
|
read_only: true
|
|
cap_drop: [ALL]
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock
|
|
networks: [itworx-npm]
|
|
networks:
|
|
itworx-npm:
|
|
external: true
|
|
"""
|
|
try:
|
|
validate_compose_runtime_contract(plan, unsafe)
|
|
except ValueError as exc:
|
|
assert "docker socket" in str(exc)
|
|
else: # pragma: no cover - assertion clarity
|
|
raise AssertionError("docker socket mount must be rejected")
|
|
|
|
|
|
def test_compose_contract_rejects_path_traversal_outside_owned_appdata():
|
|
plan = _plan(oidc=None)
|
|
unsafe = """
|
|
services:
|
|
wsbc-portal:
|
|
image: wsbc-portal:0.23.0
|
|
restart: unless-stopped
|
|
read_only: true
|
|
cap_drop: [ALL]
|
|
volumes:
|
|
- /srv/example/appdata/wsbc-portal/../../other-app:/data
|
|
networks: [itworx-npm]
|
|
networks:
|
|
itworx-npm:
|
|
external: true
|
|
"""
|
|
try:
|
|
validate_compose_runtime_contract(plan, unsafe)
|
|
except ValueError as exc:
|
|
assert "normalized" in str(exc)
|
|
else: # pragma: no cover - assertion clarity
|
|
raise AssertionError("path traversal mount must be rejected")
|
|
|
|
|
|
def test_compose_contract_requires_an_owned_persistent_bind_mount():
|
|
plan = _plan(oidc=None)
|
|
unsafe = """
|
|
services:
|
|
wsbc-portal:
|
|
image: wsbc-portal:0.23.0
|
|
restart: unless-stopped
|
|
read_only: true
|
|
cap_drop: [ALL]
|
|
networks: [itworx-npm]
|
|
networks:
|
|
itworx-npm:
|
|
external: true
|
|
"""
|
|
try:
|
|
validate_compose_runtime_contract(plan, unsafe)
|
|
except ValueError as exc:
|
|
assert "persistent" in str(exc)
|
|
else: # pragma: no cover - assertion clarity
|
|
raise AssertionError("persistent bind mount must be required")
|
|
|
|
|
|
def test_preflight_and_apply_are_durable_and_idempotent(tmp_path):
|
|
plan = _plan()
|
|
with _session(tmp_path) as session:
|
|
set_secret(session, "WSBC_PORTAL_DEPLOYMENT_BROKER", "a" * 32)
|
|
set_secret(session, "WSBC_PORTAL_OIDC_CLIENT_SECRET", "b" * 32)
|
|
session.add(Policy(
|
|
id="allow-wsbc-deploy",
|
|
action="deployment.apply",
|
|
target="wsbc-portal",
|
|
voice="blocked",
|
|
manual="allowed",
|
|
risk="high",
|
|
reason="Test exact-target deployment policy.",
|
|
))
|
|
session.commit()
|
|
plane = _plane()
|
|
result = plane.execute(session, plan=plan, idempotency_key="apply-wsbc-0001", operation="apply")
|
|
|
|
assert not result["preflight"]["blockers"], result["preflight"]
|
|
assert result["status"] == "applying", result
|
|
assert result["brokerRequestId"] == "b" * 64
|
|
replay = plane.execute(session, plan=plan, idempotency_key="apply-wsbc-0001", operation="apply")
|
|
assert replay["idempotentReplay"] is True
|
|
assert replay["id"] == result["id"]
|
|
|
|
|
|
def test_verified_controller_apply_completes_only_after_typed_oidc_and_proxy(tmp_path):
|
|
class DirectBroker(_Broker):
|
|
def apply(self, plan, *, secret, idempotency_key):
|
|
return {"status": "deployed", "request": "b" * 64}
|
|
|
|
plan = _plan()
|
|
with _session(tmp_path) as session:
|
|
set_secret(session, "WSBC_PORTAL_DEPLOYMENT_BROKER", "a" * 32)
|
|
set_secret(session, "WSBC_PORTAL_OIDC_CLIENT_SECRET", "b" * 32)
|
|
session.add(Policy(
|
|
id="allow-wsbc-deploy-direct",
|
|
action="deployment.apply",
|
|
target="wsbc-portal",
|
|
voice="blocked",
|
|
manual="allowed",
|
|
risk="high",
|
|
reason="Test exact-target deployment policy.",
|
|
))
|
|
session.commit()
|
|
plane = DeploymentControlPlane(
|
|
broker=DirectBroker(),
|
|
portainer=_Portainer(),
|
|
npm=_Npm(),
|
|
authentik=_Authentik(),
|
|
unraid=_Unraid(),
|
|
)
|
|
result = plane.execute(session, plan=plan, idempotency_key="apply-wsbc-direct-0001", operation="apply")
|
|
|
|
assert result["status"] == "succeeded"
|
|
assert result["stage"] == "controller_and_edge_verified"
|
|
assert result["evidence"]["externalIntegration"]["oidc"]["status"] == "created"
|
|
assert result["evidence"]["externalIntegration"]["proxy"]["status"] == "created"
|
|
|
|
|
|
def test_deployment_evidence_uses_allowlists_and_never_persists_connector_secrets(tmp_path):
|
|
class DirectBroker(_Broker):
|
|
def apply(self, plan, *, secret, idempotency_key):
|
|
return {"status": "deployed", "request": "b" * 64, "token": "broker-secret"}
|
|
|
|
class SecretEchoNpm(_Npm):
|
|
def ensure_managed_proxy_host(self, **kwargs):
|
|
return {"success": True, "status": "created", "hostId": 42, "meta": {"token": "npm-secret"}}
|
|
|
|
class SecretEchoAuthentik(_Authentik):
|
|
def ensure_deployment_oidc_application(self, **kwargs):
|
|
return {"success": True, "status": "created", "applicationId": "app-1", "client_secret_value": "oidc-secret"}
|
|
|
|
plan = _plan()
|
|
with _session(tmp_path) as session:
|
|
set_secret(session, "WSBC_PORTAL_DEPLOYMENT_BROKER", "a" * 32)
|
|
set_secret(session, "WSBC_PORTAL_OIDC_CLIENT_SECRET", "b" * 32)
|
|
session.add(Policy(
|
|
id="allow-wsbc-deploy-evidence",
|
|
action="deployment.apply",
|
|
target="wsbc-portal",
|
|
voice="blocked",
|
|
manual="allowed",
|
|
risk="high",
|
|
reason="Test exact-target deployment policy.",
|
|
))
|
|
session.commit()
|
|
result = DeploymentControlPlane(
|
|
broker=DirectBroker(),
|
|
portainer=_Portainer(),
|
|
npm=SecretEchoNpm(),
|
|
authentik=SecretEchoAuthentik(),
|
|
unraid=_Unraid(),
|
|
).execute(session, plan=plan, idempotency_key="apply-wsbc-evidence-0001", operation="apply")
|
|
|
|
assert result["status"] == "succeeded"
|
|
assert "broker-secret" not in str(result)
|
|
assert "npm-secret" not in str(result)
|
|
assert "oidc-secret" not in str(result)
|