Jens/Unraid-AppOps-Gateway-Public
1
0 Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Files
9b94d8d0f52d1cbfb4168d8322e9c12723a938b8
Unraid-AppOps-Gateway-Public/backend/tests/test_container_restart.py
T

2929 lines
106 KiB
Python
Raw Blame History

import json
import subprocess
import sys
from pathlib import Path
from types import SimpleNamespace
import pytest
from fastapi.testclient import TestClient
from sqlmodel import Session, SQLModel, create_engine
@pytest.fixture
def api_client(tmp_path, monkeypatch):
db_path = tmp_path / "appops_test.db"
monkeypatch.setenv("APPOPS_DB_PATH", str(db_path))
monkeypatch.setenv("APP_OPS_VOICE_TOKEN", "test-voice-token")
from backend.app.main import app
from backend.app.db import session
from backend.app.db.init_db import init_db
engine = create_engine(f"sqlite:///{Path(db_path)}", connect_args={"check_same_thread": False})
session.engine = engine
SQLModel.metadata.drop_all(engine)
SQLModel.metadata.create_all(engine)
init_db()
with TestClient(app) as client:
yield client
def _with_updated_connectors(portainer_url: str | None = None, portainer_key: str | None = None, portainer_endpoint: str | None = None, unraid_url: str | None = None, unraid_key: str | None = None):
from backend.app.core.config import settings
return_settings = dict(settings.apis)
if portainer_url is not None:
settings.apis['PORTAINER_URL'] = portainer_url
if portainer_key is not None:
settings.apis['PORTAINER_API_KEY'] = portainer_key
if portainer_endpoint is not None:
settings.apis['PORTAINER_ENDPOINT_ID'] = portainer_endpoint
if unraid_url is not None:
settings.apis['UNRAID_URL'] = unraid_url
if unraid_key is not None:
settings.apis['UNRAID_API_KEY'] = unraid_key
return return_settings
def _restore_connectors(previous):
from backend.app.core.config import settings
settings.apis.clear()
settings.apis.update(previous)
def test_approval_decision_writes_audit_event(api_client):
created = api_client.post('/api/approvals', json={
'action': 'container.restart',
'target': 'sonarr',
'source': 'manual',
'risk': 'medium',
'reason': 'Operator requested restart approval.',
'requester': 'operator',
}).json()
assert created['success'] is True
approval_id = created['id']
decided = api_client.patch(f'/api/approvals/{approval_id}', json={'status': 'approved'}).json()
assert decided['success'] is True
assert decided['status'] == 'approved'
assert decided['auditId'].startswith('audit-')
audit = api_client.get('/api/audit').json()
decision_events = [event for event in audit if event['id'] == decided['auditId']]
assert decision_events
assert decision_events[0]['action_id'] == 'approval.approved'
assert decision_events[0]['target'] == 'sonarr'
def test_approval_decision_uses_strict_state_machine(api_client):
created = api_client.post('/api/approvals', json={
'action': 'stack.redeploy',
'target': 'media',
'source': 'manual',
'risk': 'high',
}).json()
approval_id = created['id']
invalid = api_client.patch(f'/api/approvals/{approval_id}', json={'status': 'executed'})
assert invalid.status_code == 409
approved = api_client.patch(f'/api/approvals/{approval_id}', json={'status': 'approved'})
assert approved.status_code == 200
repeated = api_client.patch(f'/api/approvals/{approval_id}', json={'status': 'rejected'})
assert repeated.status_code == 409
execution = api_client.post(f'/api/approvals/{approval_id}/execute')
assert execution.status_code == 200
assert execution.json()['result'] == 'unsupported'
def test_expired_approval_is_closed_by_backend_not_only_ui(api_client):
from datetime import timedelta
from sqlmodel import Session
from backend.app.core.time import utc_now
from backend.app.db import session as db_session
from backend.app.db.models import Approval
created = api_client.post('/api/approvals', json={
'action': 'deluge.pause_all',
'target': 'deluge',
'source': 'manual',
'risk': 'high',
}).json()
with Session(db_session.engine) as session:
approval = session.get(Approval, created['id'])
approval.expires_at = utc_now() - timedelta(minutes=1)
session.add(approval)
session.commit()
listed = api_client.get('/api/approvals').json()
expired = next(item for item in listed if item['id'] == created['id'])
assert expired['status'] == 'expired'
decision = api_client.patch(f"/api/approvals/{created['id']}", json={'status': 'approved'})
assert decision.status_code == 409
def test_approval_cleanup_archives_only_expired_records(api_client):
from datetime import timedelta
from sqlmodel import Session
from backend.app.core.time import utc_now
from backend.app.db import session as db_session
from backend.app.db.models import Approval
expired = api_client.post('/api/approvals', json={
'action': 'deluge.pause_all',
'target': 'deluge',
'source': 'manual',
'risk': 'high',
}).json()
pending = api_client.post('/api/approvals', json={
'action': 'plex.scan_all_libraries',
'target': 'plex',
'source': 'manual',
'risk': 'medium',
}).json()
with Session(db_session.engine) as session:
approval = session.get(Approval, expired['id'])
approval.expires_at = utc_now() - timedelta(minutes=1)
session.add(approval)
session.commit()
cleaned = api_client.post('/api/approvals/cleanup')
assert cleaned.status_code == 200
assert cleaned.json()['success'] is True
assert cleaned.json()['dismissedCount'] == 1
active_ids = {item['id'] for item in api_client.get('/api/approvals').json()}
assert expired['id'] not in active_ids
assert pending['id'] in active_ids
history = api_client.get('/api/approvals?include_dismissed=true').json()
archived = next(item for item in history if item['id'] == expired['id'])
assert archived['status'] == 'expired'
assert archived['dismissed_at'] is not None
cleanup_audit = next(
event for event in api_client.get('/api/audit').json()
if event['id'] == cleaned.json()['auditId']
)
assert cleanup_audit['action_id'] == 'approval.cleanup'
def test_action_registry_reports_real_execution_modes(api_client):
payload = api_client.get('/api/actions/registry').json()
items = {item['id']: item for item in payload['items']}
assert items['container.restart']['executionMode'] == 'command_center'
assert items['container.restart']['commandExecutionSupported'] is True
assert items['deluge.pause_all']['executionMode'] == 'approval_then_execute'
assert items['unraid.vm.start']['executionMode'] == 'dedicated_surface'
assert items['unraid.vm.pause']['executionMode'] == 'approval_then_execute'
assert items['unraid.vm.stop']['executionMode'] == 'blocked'
assert items['stack.redeploy']['executionMode'] == 'governance_only'
assert items['jellyfin.scan_library']['executionMode'] == 'blocked'
assert items['deployment.target.promote_workmesh']['executionMode'] == 'approval_then_execute'
for action in ('runner.acceptance.preflight', 'runner.acceptance.quiesce'):
assert items[action]['target'] == 'tower/ci-acceptance-residue'
assert items[action]['executionMode'] == 'governance_only'
assert items[action]['executionSupported'] is False
assert items[action]['commandExecutionSupported'] is False
assert items[action]['executionSurface'] is None
assert payload['summary']['commandExecutable'] >= 1
assert payload['summary']['approvalExecutable'] == 5
def test_deployment_target_sync_registry_is_bounded_command_action(api_client):
payload = api_client.get('/api/actions/registry').json()
items = {item['id']: item for item in payload['items']}
sync = items['deployment.targets.sync']
assert sync['target'] == 'jens/*'
assert sync['risk'] == 'high'
assert sync['executionMode'] == 'command_center'
assert sync['commandExecutionSupported'] is True
def test_deployment_target_sync_executes_existing_bounded_reconciler(api_client, monkeypatch):
from backend.app.services import gitea_project_auto_registration
calls = []
def fake_sync(self, session, *, force=False):
calls.append(force)
return {
'status': 'ok',
'summary': {
'total': 64,
'registered': 12,
'knownUnconfigured': 50,
'conflicts': 0,
'errors': 0,
'changedThisSync': 1,
},
}
monkeypatch.setattr(
gitea_project_auto_registration.GiteaProjectAutoRegistration,
'sync',
fake_sync,
raising=True,
)
response = api_client.post(
'/api/actions/execute',
json={
'intent': 'deployment.targets.sync',
'target': 'jens/*',
'source': 'manual',
'risk': 'high',
},
)
assert response.status_code == 200
payload = response.json()
assert payload['success'] is True
assert payload['status'] == 'success'
assert payload['summary']['registered'] == 12
assert payload['summary']['changed'] == 1
assert calls == [True]
audit = api_client.get('/api/audit').json()
event = next(item for item in audit if item['id'] == payload['auditId'])
assert event['action_id'] == 'deployment.targets.sync'
assert event['target'] == 'jens/*'
def test_deployment_target_sync_rejects_target_drift(api_client):
response = api_client.post(
'/api/actions/execute',
json={
'intent': 'deployment.targets.sync',
'target': 'jens/workmesh',
'source': 'manual',
'risk': 'high',
},
)
assert response.status_code == 200
payload = response.json()
assert payload['success'] is False
assert payload['result'] == 'blocked'
def test_workmesh_first_deploy_registry_is_fixed_high_risk_command(api_client):
payload = api_client.get('/api/actions/registry').json()
items = {item['id']: item for item in payload['items']}
deploy = items['deployment.target.deploy_workmesh']
assert deploy['target'] == 'jens/workmesh'
assert deploy['risk'] == 'high'
assert deploy['policyDecision'] == 'approval_required'
assert deploy['executionMode'] == 'command_center'
assert deploy['commandExecutionSupported'] is True
def test_workmesh_first_deploy_contract_is_secret_safe_and_release_pinned():
from backend.app.services.workmesh_first_deployment import (
_CONTAINERS,
_FIRST_DEPLOY_SCRIPT,
_PORTS,
_RELEASE_REVISION,
)
assert _RELEASE_REVISION == '7dfbdb7d25e0efd70c53106de1d36d3fff6e3a05'
assert _PORTS == (1255, 1256, 1257, 1258)
assert _CONTAINERS == (
'workmesh-postgres-1',
'workmesh-mock-ats-1',
'workmesh-api-1',
'workmesh-n8n-1',
'workmesh-workmesh-1',
)
assert 'env_path = env_dir / ".env"' in _FIRST_DEPLOY_SCRIPT
assert 'secrets.token_urlsafe(48)' in _FIRST_DEPLOY_SCRIPT
assert 'os.open(temporary_env, flags, 0o600)' in _FIRST_DEPLOY_SCRIPT
assert 'info.st_uid != 0' in _FIRST_DEPLOY_SCRIPT
assert '"WORKMESH_BIND_HOST": "127.0.0.1"' in _FIRST_DEPLOY_SCRIPT
assert '"WORKMESH_WEB_PORT": "1255"' in _FIRST_DEPLOY_SCRIPT
assert '"WORKMESH_API_PORT": "1256"' in _FIRST_DEPLOY_SCRIPT
assert '"N8N_PORT": "1257"' in _FIRST_DEPLOY_SCRIPT
assert '"MOCK_ATS_PORT": "1258"' in _FIRST_DEPLOY_SCRIPT
assert '["python3", str(deploy_py), "preflight", repository, revision]' in _FIRST_DEPLOY_SCRIPT
assert '["python3", str(deploy_py), "deploy", repository, revision]' in _FIRST_DEPLOY_SCRIPT
assert 'timeout=1800' in _FIRST_DEPLOY_SCRIPT
assert 'stdout=subprocess.DEVNULL' in _FIRST_DEPLOY_SCRIPT
assert 'stderr=subprocess.DEVNULL' in _FIRST_DEPLOY_SCRIPT
def test_workmesh_first_deploy_script_accepts_the_pinned_release_descriptor(tmp_path, monkeypatch):
from backend.app.services.workmesh_first_deployment import _FIRST_DEPLOY_SCRIPT
release_revision = '7dfbdb7d25e0efd70c53106de1d36d3fff6e3a05'
descriptor = {
'apiVersion': 'itworx.deployment-target/v1',
'applicationId': 'workmesh',
'composeFile': 'compose.yaml',
'composeProject': 'workmesh',
'healthTimeout': 300,
'verifyOciRevision': False,
}
descriptor_json = json.dumps(descriptor)
controller_root = tmp_path / 'controller'
registry_path = controller_root / 'projects.json'
bare_repo = tmp_path / 'WorkMesh.git'
deploy_py = controller_root / 'deploy.py'
controller_root.mkdir()
registry_path.write_text('{}', encoding='utf-8')
deploy_py.write_text('# test stub\n', encoding='utf-8')
bare_repo.mkdir()
script = _FIRST_DEPLOY_SCRIPT
for original, replacement in (
('Path("/opt/gitea-deploy")', f'Path({json.dumps(str(controller_root))})'),
(
'Path("/controller-config/projects.json")',
f'Path({json.dumps(str(registry_path))})',
),
(
'Path("/controller-hub-releases/controller-config/projects.json")',
f'Path({json.dumps(str(registry_path))})',
),
(
'Path("/mnt/cache/appdata/gitea-deploy-runners/deploy.lock")',
f'Path({json.dumps(str(tmp_path / "deploy.lock"))})',
),
(
'Path("/gitea-repositories/jens/workmesh.git")',
f'Path({json.dumps(str(bare_repo))})',
),
):
script = script.replace(original, replacement)
artifact_checks = []
descriptor_reads = []
class DockerInventoryReached(Exception):
pass
def fake_run(command, **_kwargs):
if command[0] == 'git':
operation = command[2]
if operation == 'rev-parse':
return SimpleNamespace(returncode=0, stdout=f'{release_revision}\n')
if operation == 'cat-file':
artifact = command[4].split(':', 1)[1]
artifact_checks.append(artifact)
expected = {'compose.yaml', 'VERSION', '.itworx/deployment-target.json'}
return SimpleNamespace(returncode=0 if artifact in expected else 1, stdout='')
if operation == 'show':
artifact = command[3].split(':', 1)[1]
if artifact == 'VERSION':
return SimpleNamespace(returncode=0, stdout='0.1.0\n')
descriptor_reads.append(artifact)
if artifact == '.itworx/deployment-target.json':
return SimpleNamespace(returncode=0, stdout=descriptor_json)
return SimpleNamespace(returncode=1, stdout='')
raise AssertionError(command)
if command[:3] == ['docker', 'ps', '-aq']:
raise DockerInventoryReached
raise AssertionError(command)
monkeypatch.setattr(subprocess, 'run', fake_run)
monkeypatch.setitem(
sys.modules,
'fcntl',
SimpleNamespace(LOCK_EX=1, flock=lambda *_args: None),
)
with pytest.raises(DockerInventoryReached):
exec(compile(script, '<workmesh-first-deploy>', 'exec'), {}) # noqa: S102
assert artifact_checks == [
'compose.yaml',
'VERSION',
'.itworx/deployment-target.json',
]
assert descriptor_reads == ['.itworx/deployment-target.json']
def test_workmesh_first_deploy_uses_one_durable_job(api_client, monkeypatch):
from backend.app.db import session as db_session
from backend.app.services import action_execution
from backend.app.services.workmesh_first_deployment import WorkMeshFirstDeployment
monkeypatch.setattr(
WorkMeshFirstDeployment,
'tracked_job_id',
staticmethod(lambda session: None),
raising=True,
)
monkeypatch.setattr(
WorkMeshFirstDeployment,
'run',
lambda self, session, *, job: {
'status': 'in_progress',
'execution_id': 'exec-workmesh-1',
},
raising=True,
)
with Session(db_session.engine) as session:
result = action_execution.execute_governed_action(
session,
action='deployment.target.deploy_workmesh',
target='jens/workmesh',
source='chatgpt-mcp',
risk='high',
reason='Test the fixed first-deploy boundary.',
original_policy_decision='approval_required',
)
assert result['success'] is False
assert result['status'] == 'in_progress'
assert result['executionId'] == 'exec-workmesh-1'
assert result['jobId'].startswith('job-')
assert result['auditId'].startswith('audit-')
def test_workmesh_first_deploy_blocks_orphan_running_job(api_client, monkeypatch):
from sqlmodel import select
from backend.app.db import session as db_session
from backend.app.db.models import JobRun
from backend.app.services import action_execution
from backend.app.services.workmesh_first_deployment import WorkMeshFirstDeployment
monkeypatch.setattr(
WorkMeshFirstDeployment,
'run',
lambda self, session, *, job: pytest.fail('must not start a second controller execution'),
raising=True,
)
with Session(db_session.engine) as session:
session.add(JobRun(
id='job-orphan-workmesh',
type='deployment.target.deploy_workmesh',
status='running',
action_id='deployment.target.deploy_workmesh',
target='jens/workmesh',
risk='high',
policy_decision='allowed',
))
session.commit()
result = action_execution.execute_governed_action(
session,
action='deployment.target.deploy_workmesh',
target='jens/workmesh',
source='chatgpt-mcp',
risk='high',
reason='Reconcile the existing first-deploy job.',
original_policy_decision='approval_required',
)
jobs = session.exec(
select(JobRun).where(JobRun.action_id == 'deployment.target.deploy_workmesh')
).all()
assert result['status'] == 'outcome_unknown'
assert result['jobId'] == 'job-orphan-workmesh'
assert len(jobs) == 1
def test_workmesh_first_deploy_reconciles_one_controller_exec(api_client):
from backend.app.db import session as db_session
from backend.app.services.job_runner import create_job, start_job
from backend.app.services.workmesh_first_deployment import WorkMeshFirstDeployment
class FakeResponse:
def __init__(self, payload):
self.payload = payload
def json(self):
return self.payload
class FakePortainer:
def __init__(self):
self.started = False
self.running = True
self.calls = []
def get_container_status(self, name):
assert name == 'gitea-deploy-control'
return {
'status': 'ok',
'container': {
'id': 'controller-1',
'name': 'gitea-deploy-control',
'state': 'running',
},
}
def _config(self):
return SimpleNamespace(endpoint_id='3')
def _request(self, method, path, **kwargs):
self.calls.append((method, path))
if method == 'POST' and path.endswith('/exec'):
return FakeResponse({'Id': 'exec-workmesh-1'})
if method == 'POST' and path.endswith('/start'):
self.started = True
return FakeResponse({})
if method == 'GET' and path.endswith('/json'):
return FakeResponse({
'ID': 'exec-workmesh-1',
'ContainerID': 'controller-1',
'Running': self.running,
'ExitCode': 0 if not self.running else None,
})
raise AssertionError((method, path))
fake = FakePortainer()
with Session(db_session.engine) as session:
job = create_job(
session,
action_id='deployment.target.deploy_workmesh',
target='jens/workmesh',
source='chatgpt-mcp',
risk='high',
policy_decision='allowed',
steps=['fixed first deploy'],
)
start_job(session, job)
service = WorkMeshFirstDeployment(portainer=fake)
first = service.run(session, job=job)
assert first == {
'status': 'in_progress',
'execution_id': 'exec-workmesh-1',
}
assert fake.started is True
assert service.tracked_job_id(session) == job.id
cancelled = api_client.post(f'/api/jobs/{job.id}/cancel').json()
assert cancelled['success'] is False
assert 'cannot be cancelled' in cancelled['message']
assert cancelled['status'] == 'running'
second = service.run(session, job=job)
assert second['status'] == 'in_progress'
assert second['execution_id'] == 'exec-workmesh-1'
fake.running = False
third = service.run(session, job=job)
assert third['status'] == 'deployed'
assert third['revision'] == '7dfbdb7d25e0efd70c53106de1d36d3fff6e3a05'
assert third['ports'] == [1255, 1256, 1257, 1258]
fourth = service.run(session, job=job)
assert fourth == third
create_calls = [call for call in fake.calls if call[0] == 'POST' and call[1].endswith('/exec')]
assert len(create_calls) == 1
@pytest.mark.parametrize('ambiguous_at', ['create', 'start'])
def test_workmesh_first_deploy_does_not_repeat_ambiguous_exec(api_client, ambiguous_at):
from backend.app.db import session as db_session
from backend.app.services.job_runner import create_job, start_job
from backend.app.services.workmesh_first_deployment import WorkMeshFirstDeployment
class FakeResponse:
def __init__(self, payload):
self.payload = payload
def json(self):
return self.payload
class FakePortainer:
def __init__(self):
self.create_calls = 0
def get_container_status(self, _name):
return {
'status': 'ok',
'container': {
'id': 'controller-1',
'name': 'gitea-deploy-control',
'state': 'running',
},
}
def _config(self):
return SimpleNamespace(endpoint_id='3')
def _request(self, method, path, **_kwargs):
if method == 'POST' and path.endswith('/exec'):
self.create_calls += 1
if ambiguous_at == 'create':
raise RuntimeError('provider response lost after exec creation')
return FakeResponse({'Id': 'exec-workmesh-1'})
if method == 'POST' and path.endswith('/start'):
raise RuntimeError('provider response lost after exec start')
raise AssertionError((method, path))
fake = FakePortainer()
with Session(db_session.engine) as session:
job = create_job(
session,
action_id='deployment.target.deploy_workmesh',
target='jens/workmesh',
source='chatgpt-mcp',
risk='high',
policy_decision='allowed',
steps=['fixed first deploy'],
)
start_job(session, job)
service = WorkMeshFirstDeployment(portainer=fake)
first = service.run(session, job=job)
second = service.run(session, job=job)
assert first['status'] == 'outcome_unknown'
assert second['status'] == 'outcome_unknown'
assert service.tracked_job_id(session) == job.id
assert fake.create_calls == 1
def test_workmesh_first_deploy_rejects_target_drift(api_client):
from backend.app.db import session as db_session
from backend.app.services import action_execution
with Session(db_session.engine) as session:
result = action_execution.execute_governed_action(
session,
action='deployment.target.deploy_workmesh',
target='jens/not-workmesh',
source='chatgpt-mcp',
risk='high',
reason='Reject target drift.',
original_policy_decision='approval_required',
)
assert result['success'] is False
assert result['status'] == 'failed'
assert result['result'] == 'blocked'
@pytest.mark.parametrize('state_mode', ['missing', 'other_job'])
def test_running_workmesh_first_deploy_cannot_be_cancelled_via_http_or_mcp(
tmp_path, state_mode
):
from backend.app.api import routes_jobs
from backend.app.db.models import AppSetting, JobRun
from backend.app.services import mcp_operations
from backend.app.services.workmesh_first_deployment import _STATE_KEY
engine = create_engine(f"sqlite:///{tmp_path / 'workmesh-cancel.db'}")
SQLModel.metadata.create_all(engine)
with Session(engine) as session:
job = JobRun(
id='job-workmesh-active',
type='deployment.target.deploy_workmesh',
status='running',
source='chatgpt-mcp',
action_id='deployment.target.deploy_workmesh',
target='jens/workmesh',
risk='high',
policy_decision='allowed',
)
session.add(job)
if state_mode == 'other_job':
session.add(AppSetting(
key=_STATE_KEY,
value_json={'state': 'started', 'jobId': 'job-different'},
is_secret=False,
))
session.commit()
http_result = routes_jobs.cancel(job.id, session=session)
mcp_result = mcp_operations.cancel_operation_job(session, job.id)
session.refresh(job)
assert http_result['success'] is False
assert http_result['status'] == 'running'
assert 'cannot be cancelled' in http_result['message']
assert mcp_result['cancelled'] is False
assert mcp_result['changed'] is False
assert mcp_result['status'] == 'running'
assert 'cannot be cancelled' in mcp_result['reason']
assert job.status == 'running'
@pytest.fixture
def restart_service(monkeypatch):
from backend.app.services import container_restart_service
monkeypatch.setattr(
container_restart_service.PortainerConnector,
'get_container_status',
lambda self, container_name: {'status': 'ok', 'container': {'name': container_name, 'state': 'running'}},
raising=True,
)
monkeypatch.setattr(
container_restart_service.PortainerConnector,
'restart_container',
lambda self, target: {'status': 'ok', 'container': target, 'action': 'container.restart', 'target': target},
raising=True,
)
monkeypatch.setattr(
container_restart_service,
'_widefrog_health_check',
lambda: {'status': 'ok'},
raising=True,
)
return container_restart_service
def test_restart_manual_execute_succeeds(api_client, restart_service):
response = api_client.post(
'/api/actions/execute',
json={'intent': 'container.restart', 'target': 'widefrog', 'source': 'manual', 'risk': 'medium'},
)
assert response.status_code == 200
payload = response.json()
assert payload['success'] is True
assert payload['decision'] == 'allowed'
assert payload['status'] == 'success'
assert payload['policy_decision'] == 'allowed'
assert payload['result'] == 'success'
assert payload['jobId'].startswith('job-')
assert payload['auditId'].startswith('audit-')
assert isinstance(payload.get('steps', []), list)
assert isinstance(payload.get('post_checks', []), list)
assert isinstance(payload.get('before_state', {}), dict)
assert isinstance(payload.get('after_state', {}), dict)
assert payload['before_state']
assert payload['after_state']
jobs = api_client.get('/api/jobs').json()
assert any(job['id'] == payload['jobId'] and job['status'] == 'succeeded' for job in jobs)
def test_restart_manual_endpoint_succeeds(api_client, restart_service):
response = api_client.post('/api/actions/container/widefrog/restart')
assert response.status_code == 200
payload = response.json()
assert payload['success'] is True
assert payload['decision'] == 'allowed'
assert payload['status'] == 'success'
def test_action_plan_recognizes_check_unraid_phrase(api_client):
response = api_client.post(
'/api/actions/plan',
json={'input': 'check unraid', 'source': 'manual'},
)
assert response.status_code == 200
payload = response.json()
assert payload['intent'] == 'unraid.health_summary'
assert payload['target'] == 'unraid'
assert payload['policy'] == 'allowed'
assert payload['risk'] == 'low'
assert payload['plan']
def test_restart_voice_endpoint_succeeds_with_valid_token(api_client, restart_service):
response = api_client.post(
'/api/voice/actions/container/widefrog/restart',
headers={'Authorization': 'Bearer test-voice-token'},
)
assert response.status_code == 200
payload = response.json()
assert payload['success'] is True
assert payload['decision'] == 'allowed'
assert payload['status'] == 'success'
def test_restart_voice_endpoint_rejects_missing_or_invalid_token(api_client, restart_service, monkeypatch):
from fastapi import HTTPException
from backend.app.services import user_access
def anonymous(_request):
raise HTTPException(401, "Sign in required")
monkeypatch.setattr(user_access, "current_user", anonymous)
missing = api_client.post('/api/voice/actions/container/widefrog/restart')
assert missing.status_code == 401
wrong = api_client.post(
'/api/voice/actions/container/widefrog/restart',
headers={'Authorization': 'Bearer wrong-token'},
)
assert wrong.status_code == 403
def test_voice_unraid_health_endpoint_rejects_missing_or_invalid_token(api_client, restart_service, monkeypatch):
from fastapi import HTTPException
from backend.app.services import user_access
def anonymous(_request):
raise HTTPException(401, "Sign in required")
monkeypatch.setattr(user_access, "current_user", anonymous)
missing = api_client.post('/api/voice/actions/unraid/health')
assert missing.status_code == 401
wrong = api_client.post(
'/api/voice/actions/unraid/health',
headers={'Authorization': 'Bearer wrong-token'},
)
assert wrong.status_code == 403
def test_voice_playbook_endpoint_rejects_missing_or_invalid_token(api_client, restart_service, monkeypatch):
from fastapi import HTTPException
from backend.app.services import user_access
def anonymous(_request):
raise HTTPException(401, "Sign in required")
monkeypatch.setattr(user_access, "current_user", anonymous)
missing = api_client.post('/api/voice/actions/playbooks/fix-widefrog/run')
assert missing.status_code == 401
wrong = api_client.post(
'/api/voice/actions/playbooks/fix-widefrog/run',
headers={'Authorization': 'Bearer wrong-token'},
)
assert wrong.status_code == 403
def test_voice_unraid_health_uses_explicit_readonly_policy(api_client, restart_service):
response = api_client.post(
'/api/voice/actions/unraid/health',
headers={'Authorization': 'Bearer test-voice-token'},
)
assert response.status_code == 200
payload = response.json()
assert payload['success'] is True
assert payload['decision'] == 'allowed'
assert payload['policy_decision'] == 'allowed'
assert payload['status'] == 'success'
assert isinstance(payload.get('data'), dict)
def test_voice_playbook_run_evaluates_policy(api_client, restart_service):
response = api_client.post(
'/api/voice/actions/playbooks/fix-widefrog/run',
headers={'Authorization': 'Bearer test-voice-token'},
)
assert response.status_code == 200
payload = response.json()
assert payload['success'] is False
assert payload['decision'] in {'approval_required', 'blocked'}
assert payload['policy_decision'] in {'approval_required', 'blocked'}
assert payload['status'] in {'failed'}
def test_restart_requires_approval_for_authentik(api_client, restart_service):
response = api_client.post(
'/api/actions/execute',
json={'intent': 'container.restart', 'target': 'authentik', 'source': 'manual', 'risk': 'high'},
)
assert response.status_code == 200
payload = response.json()
assert payload['success'] is False
assert payload['decision'] == 'approval_required'
assert payload['approvalId'].startswith('appr-')
assert payload['auditId'].startswith('audit-')
assert payload['status'] == 'failed'
assert payload['result'] == 'approval_required'
def test_restart_fails_when_portainer_missing_config(api_client, monkeypatch):
from backend.app.services import container_restart_service
monkeypatch.setattr(
container_restart_service.PortainerConnector,
'get_container_status',
lambda self, container_name: {'status': 'missing_config', 'reason': 'missing_config'},
raising=True,
)
monkeypatch.setattr(
container_restart_service.PortainerConnector,
'restart_container',
lambda self, target: {'status': 'missing_config', 'reason': 'missing_config'},
raising=True,
)
response = api_client.post('/api/actions/container/widefrog/restart')
assert response.status_code == 200
payload = response.json()
assert payload['success'] is False
assert payload['decision'] == 'failed'
assert payload['message'] == 'missing_config'
assert payload['jobId'].startswith('job-')
assert payload['status'] == 'failed'
def test_restart_execute_fails_when_portainer_missing_config(api_client, monkeypatch):
from backend.app.services import container_restart_service
monkeypatch.setattr(
container_restart_service.PortainerConnector,
'get_container_status',
lambda self, container_name: {'status': 'missing_config', 'reason': 'missing_config'},
raising=True,
)
monkeypatch.setattr(
container_restart_service.PortainerConnector,
'restart_container',
lambda self, target: {'status': 'missing_config', 'reason': 'missing_config'},
raising=True,
)
response = api_client.post(
'/api/actions/execute',
json={'intent': 'container.restart', 'target': 'widefrog', 'source': 'manual', 'risk': 'medium'},
)
assert response.status_code == 200
payload = response.json()
assert payload['success'] is False
assert payload['decision'] == 'failed'
assert payload['message'] == 'missing_config'
assert payload['jobId'].startswith('job-')
assert payload['auditId'].startswith('audit-')
assert payload['status'] == 'failed'
assert payload['result'] == 'failed'
def test_restart_manual_endpoint_fails_when_portainer_missing_config(api_client):
response = api_client.post('/api/actions/container/widefrog/restart')
assert response.status_code == 200
payload = response.json()
assert payload['success'] is False
assert payload['decision'] == 'failed'
assert payload['message'] == 'missing_config'
assert payload['jobId'].startswith('job-')
assert payload['auditId'].startswith('audit-')
assert payload['status'] == 'failed'
def test_restart_voice_endpoint_fails_when_portainer_missing_config(api_client):
response = api_client.post(
'/api/voice/actions/container/widefrog/restart',
headers={'Authorization': 'Bearer test-voice-token'},
)
assert response.status_code == 200
payload = response.json()
assert payload['success'] is False
assert payload['decision'] == 'failed'
assert payload['message'] == 'missing_config'
assert payload['jobId'].startswith('job-')
assert payload['auditId'].startswith('audit-')
assert payload['status'] == 'failed'
def test_security_policy_blocks_volume_delete(api_client, restart_service):
response = api_client.post(
'/api/actions/execute',
json={'intent': 'volume.delete', 'target': 'postgres-data', 'source': 'manual', 'risk': 'critical', 'plan': []},
)
assert response.status_code == 200
payload = response.json()
assert payload['success'] is False
assert payload['decision'] == 'blocked'
assert payload['message'] == 'Action uses default governance policy.'
def test_action_registry_returns_policy_preview_without_secrets(api_client):
response = api_client.get('/api/actions/registry')
assert response.status_code == 200
payload = response.json()
assert payload['summary']['total'] >= 2
assert isinstance(payload['items'], list)
actions = {item['id']: item for item in payload['items']}
assert actions['safety.summary']['risk'] == 'low'
assert actions['safety.summary']['policyDecision'] == 'allowed'
assert actions['safety.summary']['capability'] == 'read_only'
assert actions['volume.delete']['risk'] == 'critical'
assert actions['volume.delete']['policyDecision'] == 'blocked'
assert actions['volume.delete']['capability'] == 'destructive'
serialized = str(payload).lower()
assert 'password' not in serialized
assert 'bearer ' not in serialized
assert 'test-voice-token' not in serialized
def test_action_registry_detail_is_read_only_and_policy_aware(api_client):
response = api_client.get('/api/actions/registry/volume.delete')
assert response.status_code == 200
payload = response.json()
assert payload['id'] == 'volume.delete'
assert payload['risk'] == 'critical'
assert payload['policyDecision'] == 'blocked'
assert payload['capability'] == 'destructive'
assert payload['executionSupported'] is False
assert any('blocked' in item.lower() for item in payload['safeguards'])
assert any('volume' in item.lower() for item in payload['blastRadius'])
assert 'password' not in str(payload).lower()
assert 'test-voice-token' not in str(payload).lower()
def test_action_lifecycle_v1_excluded_actions_are_blocked_and_visible(api_client):
response = api_client.get('/api/actions/registry')
assert response.status_code == 200
actions = {item['id']: item for item in response.json()['items']}
for action_id in ['container.stop', 'container.clear_logs', 'gateway.clear_cache']:
assert action_id in actions
assert actions[action_id]['policyDecision'] == 'blocked'
assert actions[action_id]['capability'] == 'destructive'
detail = api_client.get(f'/api/actions/registry/{action_id}').json()
assert detail['executionSupported'] is False
assert detail['policyDecision'] == 'blocked'
assert any('v1' in item.lower() or 'blocked' in item.lower() for item in detail['safeguards'])
assert 'v1' in detail['operatorGuidance'].lower()
preflight = api_client.post('/api/actions/preflight', json={'action': action_id, 'target': actions[action_id]['target']}).json()
assert preflight['policyDecision'] == 'blocked'
assert preflight['rollbackAvailable'] is False
def test_action_registry_detail_rejects_unknown_action(api_client):
response = api_client.get('/api/actions/registry/not-a-real-action')
assert response.status_code == 404
def test_security_voice_blocks_postgres_restart(api_client):
response = api_client.post(
'/api/actions/execute',
json={'intent': 'container.restart', 'target': 'postgres', 'source': 'voice', 'risk': 'critical', 'plan': []},
)
assert response.status_code == 200
payload = response.json()
assert payload['success'] is False
assert payload['decision'] == 'blocked'
assert payload['status'] == 'failed'
def test_security_voice_blocks_redis_restart(api_client):
response = api_client.post(
'/api/actions/execute',
json={'intent': 'container.restart', 'target': 'redis', 'source': 'voice', 'risk': 'critical', 'plan': []},
)
assert response.status_code == 200
payload = response.json()
assert payload['success'] is False
assert payload['decision'] == 'blocked'
assert payload['status'] == 'failed'
def test_security_voice_blocks_unraid_mover_start(api_client):
response = api_client.post(
'/api/actions/execute',
json={'intent': 'unraid.mover.start', 'target': 'unraid', 'source': 'voice', 'risk': 'high', 'plan': []},
)
assert response.status_code == 200
payload = response.json()
assert payload['success'] is False
assert payload['decision'] == 'blocked'
assert payload['status'] == 'failed'
def test_security_unraid_mover_start_requires_approval_manually(api_client):
response = api_client.post(
'/api/actions/execute',
json={'intent': 'unraid.mover.start', 'target': 'unraid', 'source': 'manual', 'risk': 'high', 'plan': []},
)
assert response.status_code == 200
payload = response.json()
assert payload['success'] is False
assert payload['decision'] == 'approval_required'
assert payload['approvalId'].startswith('appr-')
assert payload['auditId'].startswith('audit-')
def test_security_stack_redeploy_requires_approval(api_client, restart_service):
response = api_client.post(
'/api/actions/execute',
json={'intent': 'stack.redeploy', 'target': 'prod', 'source': 'manual', 'risk': 'high', 'plan': []},
)
assert response.status_code == 200
payload = response.json()
assert payload['success'] is False
assert payload['decision'] == 'approval_required'
assert payload['approvalId'].startswith('appr-')
def test_security_authentik_restart_requires_approval_for_voice(api_client):
response = api_client.post(
'/api/actions/execute',
json={'intent': 'container.restart', 'target': 'authentik', 'source': 'voice', 'risk': 'high', 'plan': []},
)
assert response.status_code == 200
payload = response.json()
assert payload['success'] is False
assert payload['decision'] in {'approval_required', 'blocked'}
assert payload['status'] in {'failed'}
def test_security_portainer_restart_requires_approval_or_blocked_for_voice(api_client):
response = api_client.post(
'/api/actions/execute',
json={'intent': 'container.restart', 'target': 'portainer', 'source': 'voice', 'risk': 'high', 'plan': []},
)
assert response.status_code == 200
payload = response.json()
assert payload['success'] is False
assert payload['decision'] in {'approval_required', 'blocked'}
assert payload['status'] == 'failed'
def test_connector_test_reports_missing_config_for_portainer(api_client, monkeypatch):
prev = _with_updated_connectors(
portainer_url='',
portainer_key=None,
portainer_endpoint=None,
unraid_url=None,
unraid_key=None,
)
response = api_client.post('/api/connectors/portainer/test')
payload = response.json()
assert response.status_code == 200
assert payload['success'] is False
assert payload['status'] == 'missing_config'
assert payload['reason'] == 'missing_config'
assert payload['missing_config'] is True
assert payload['required_env_vars'] == ['PORTAINER_URL', 'PORTAINER_API_KEY', 'PORTAINER_ENDPOINT_ID']
assert payload['secretRef'] == 'PORTAINER_API_KEY'
_restore_connectors(prev)
def test_connector_test_reports_missing_config_for_unraid(api_client):
prev = _with_updated_connectors(
portainer_url=None,
portainer_key=None,
portainer_endpoint=None,
unraid_url='',
unraid_key=None,
)
response = api_client.post('/api/connectors/unraid/test')
payload = response.json()
assert response.status_code == 200
assert payload['success'] is False
assert payload['status'] == 'missing_config'
assert payload['reason'] == 'missing_config'
assert payload['missing_config'] is True
assert payload['required_env_vars'] == ['UNRAID_URL', 'UNRAID_API_KEY']
assert payload['secretRef'] == 'UNRAID_API_KEY'
_restore_connectors(prev)
def test_connector_error_redacts_portainer_secret_from_api_error(api_client, monkeypatch):
prev = _with_updated_connectors(
portainer_url='https://localhost:9443',
portainer_key='PORTA_SECRET_TOKEN',
portainer_endpoint='1',
)
def fail_request(*_args, **_kwargs):
raise RuntimeError('x-api-key=PORTA_SECRET_TOKEN')
monkeypatch.setattr('backend.app.connectors.portainer.PortainerConnector._request', fail_request, raising=True)
response = api_client.post('/api/connectors/portainer/test')
payload = response.json()
assert response.status_code == 200
assert payload['status'] in {'error', 'unreachable'}
reason = str(payload.get('reason'))
assert 'PORTA_SECRET_TOKEN' not in reason
assert '[REDACTED]' in reason
_restore_connectors(prev)
def test_containers_endpoint_can_request_readonly_portainer_stats(api_client, monkeypatch):
from backend.app.api import routes_containers
class FakePortainerConnector:
def list_containers(self, include_stats=False, stats_limit=200):
assert include_stats is True
assert stats_limit == 50
return {
'status': 'ok',
'containers': [{
'id': 'abc123',
'name': 'widefrog',
'appId': 'widefrog',
'state': 'running',
'health': 'healthy',
'image': 'widefrog:latest',
'ports': [],
'cpu': '12.3%',
'ram': '256 MiB / 1 GiB',
'metricsStatus': 'measured',
'restartCount': 0,
'criticality': 'medium',
'voiceEnabled': False,
'protected': False,
}],
}
monkeypatch.setattr(routes_containers, 'PortainerConnector', FakePortainerConnector, raising=True)
response = api_client.get('/api/containers?include_stats=true&stats_limit=50')
assert response.status_code == 200
payload = response.json()
assert payload[0]['cpu'] == '12.3%'
assert payload[0]['ram'] == '256 MiB / 1 GiB'
assert payload[0]['metricsStatus'] == 'measured'
def test_portainer_connector_maps_docker_stats_without_mutation(monkeypatch):
from backend.app.connectors.portainer import PortainerConnector
prev = _with_updated_connectors(
portainer_url='https://portainer.local',
portainer_key='PORTA_SECRET_TOKEN',
portainer_endpoint='9',
)
class FakeResponse:
def __init__(self, payload):
self._payload = payload
self.text = ''
self.status_code = 200
def json(self):
return self._payload
def fake_request(self, method, path, **_kwargs):
assert method == 'GET'
if path.endswith('/docker/containers/json?all=1'):
return FakeResponse([{
'Id': 'abc123',
'Names': ['/widefrog'],
'Image': 'widefrog:latest',
'State': 'running',
'Ports': [],
}])
if path.endswith('/docker/containers/abc123/stats'):
return FakeResponse({
'cpu_stats': {
'online_cpus': 4,
'system_cpu_usage': 200_000_000,
'cpu_usage': {'total_usage': 120_000_000},
},
'precpu_stats': {
'system_cpu_usage': 100_000_000,
'cpu_usage': {'total_usage': 100_000_000},
},
'memory_stats': {
'usage': 268_435_456,
'limit': 1_073_741_824,
},
})
raise AssertionError(f'unexpected path {path}')
monkeypatch.setattr(PortainerConnector, '_request', fake_request, raising=True)
result = PortainerConnector().list_containers(include_stats=True, stats_limit=10)
assert result['status'] == 'ok'
assert result['containers'][0]['cpu'] == '80.0%'
assert result['containers'][0]['ram'] == '256 MiB / 1 GiB'
assert result['containers'][0]['metricsStatus'] == 'measured'
assert result['containers'][0]['metricsSource'] == 'portainer.docker.stats'
_restore_connectors(prev)
def test_connector_error_redacts_unraid_secret_from_api_error(api_client, monkeypatch):
prev = _with_updated_connectors(
unraid_url='https://localhost:9444',
unraid_key='UNRAID_SECRET_TOKEN',
)
def fail_request(*_args, **_kwargs):
raise RuntimeError('api_key=UNRAID_SECRET_TOKEN')
monkeypatch.setattr('backend.app.connectors.unraid.UnraidConnector._request', fail_request, raising=True)
response = api_client.post('/api/connectors/unraid/test')
payload = response.json()
assert response.status_code == 200
assert payload['status'] in {'error', 'unreachable'}
reason = str(payload.get('reason'))
assert 'UNRAID_SECRET_TOKEN' not in reason
assert '[REDACTED]' in reason
_restore_connectors(prev)
def test_action_execute_idempotency_replays_without_duplicate_execution(api_client):
payload = {
'intent': 'container.restart',
'target': 'missing-app',
'source': 'manual',
'plan': ['Resolve container', 'Restart container'],
}
headers = {'Idempotency-Key': 'restart-missing-app-1'}
first = api_client.post('/api/actions/execute', json=payload, headers=headers)
replay = api_client.post('/api/actions/execute', json=payload, headers=headers)
assert first.status_code == 200
assert replay.status_code == 200
assert replay.json()['idempotentReplay'] is True
assert replay.json()['auditId'] == first.json()['auditId']
conflict = api_client.post(
'/api/actions/execute',
json={**payload, 'target': 'different-app'},
headers=headers,
)
assert conflict.status_code == 409
@pytest.fixture
def advisory_ai_provider(monkeypatch):
from backend.app.services import managed_ai
calls = []
def analyze(_session, question, context):
calls.append((question, context))
return {
'content': 'Een herstart vereist uitvoering via het Command Center.',
'model': 'test-advisor', 'revision': 'test-r1',
'deploymentId': 'test-deployment', 'requestId': 'test-request',
'artifactDigest': 'sha256:' + 'a' * 64,
}
monkeypatch.setattr(managed_ai, 'analyze', analyze)
return calls
def test_ai_route_does_not_execute_actions(api_client, advisory_ai_provider):
response = api_client.post(
'/api/ai/chat',
json={'content': 'Herstart authentik nu meteen'},
)
assert response.status_code == 200
payload = response.json()
assert payload['id'].startswith('chat-')
assert payload['role'] == 'assistant'
assert 'success' not in payload
assert 'decision' not in payload
assert 'status' not in payload
assert 'policy_decision' not in payload
assert 'result' not in payload
assert len(advisory_ai_provider) == 1
def test_ai_route_does_not_create_jobs_or_approvals(api_client, advisory_ai_provider):
initial_jobs = api_client.get('/api/jobs').json()
initial_approvals = api_client.get('/api/approvals').json()
response = api_client.post(
'/api/ai/chat',
json={'content': 'Herstart authentik nu meteen, maak een job aan en stuur approval aan'},
)
assert response.status_code == 200
payload = response.json()
assert payload['id'].startswith('chat-')
assert payload['role'] == 'assistant'
assert 'jobId' not in payload
assert 'approvalId' not in payload
assert 'auditId' not in payload
jobs = api_client.get('/api/jobs').json()
approvals = api_client.get('/api/approvals').json()
assert jobs == initial_jobs
assert approvals == initial_approvals
assert len(advisory_ai_provider) == 1
def test_ai_history_does_not_return_fake_run_events(api_client):
response = api_client.get('/api/ai/history')
assert response.status_code == 200
payload = response.json()
assert payload == []
def test_ai_chat_response_is_advisory_without_action_buttons(api_client, advisory_ai_provider):
response = api_client.post(
'/api/ai/chat',
json={'content': 'Herstart widefrog en voer de fix uit'},
)
assert response.status_code == 200
payload = response.json()
metadata = payload.get('metadata') or {}
assert 'suggestedActions' not in metadata
assert 'actionPlan' not in metadata
assert 'approvalId' not in payload
assert 'jobId' not in payload
assert len(advisory_ai_provider) == 1
def test_ai_provider_unavailable_creates_no_jobs_approvals_or_history(api_client, monkeypatch):
from backend.app.services import managed_ai
def unavailable(*_args):
raise managed_ai.ManagedAiError('NOT_CONFIGURED')
monkeypatch.setattr(managed_ai, 'analyze', unavailable)
before = {path: api_client.get(path).json() for path in
('/api/jobs', '/api/approvals', '/api/ai/history')}
response = api_client.post('/api/ai/chat', json={'content': 'Herstart authentik meteen'})
assert response.status_code == 503
assert response.json()['detail']['code'] == 'NOT_CONFIGURED'
assert {path: api_client.get(path).json() for path in before} == before
def test_ai_status_returns_frontend_summary_contract(api_client):
response = api_client.get('/api/ai/status')
assert response.status_code == 200
payload = response.json()
assert set(payload) >= {
'dailySummary',
'currentRisks',
'recommendedActions',
'storageForecast',
'securityScore',
'autopilotStatus',
}
assert isinstance(payload['dailySummary'], str)
assert isinstance(payload['currentRisks'], int)
assert isinstance(payload['recommendedActions'], int)
assert isinstance(payload['storageForecast'], str)
assert isinstance(payload['securityScore'], int)
assert payload['autopilotStatus'] in {'active', 'paused', 'off'}
assert 'tools' not in payload
assert 'enabled' not in payload
def test_ai_recommendations_return_advisory_frontend_contract(api_client):
response = api_client.get('/api/ai/recommendations')
assert response.status_code == 200
payload = response.json()
assert isinstance(payload, list)
assert payload
for recommendation in payload:
assert set(recommendation) >= {
'id',
'title',
'severity',
'confidence',
'evidence',
'affectedApps',
'suggestedAction',
'status',
}
assert recommendation['severity'] in {'low', 'medium', 'high', 'critical'}
assert isinstance(recommendation['confidence'], float)
assert recommendation['status'] in {'open', 'applied', 'snoozed', 'dismissed'}
assert 'actionPlan' not in recommendation
assert 'jobId' not in recommendation
assert 'approvalId' not in recommendation
assert 'auditId' not in recommendation
def test_playbooks_endpoint_returns_live_contract_shape(api_client):
response = api_client.get('/api/playbooks')
assert response.status_code == 200
payload = response.json()
assert isinstance(payload, list)
assert payload
first = payload[0]
assert set(first) >= {
'id',
'name',
'description',
'risk',
'allowedSources',
'requiredConnectors',
'steps',
'successRate',
}
assert first['risk'] in {'low', 'medium', 'high', 'critical'}
assert all(source in {'manual', 'voice', 'automation', 'system'} for source in first['allowedSources'])
assert isinstance(first['requiredConnectors'], list)
assert isinstance(first['steps'], list)
assert isinstance(first['successRate'], int | float)
def test_playbooks_catalog_is_live_readonly_and_reflects_connector_readiness(api_client):
payload = api_client.get('/api/playbooks').json()
by_id = {item['id']: item for item in payload}
expected_operational_playbooks = {
'storage-pressure-review',
'exposure-auth-coverage-review',
'media-stalled-download-review',
'unhealthy-container-triage',
'app-inventory-normalization',
'backup-readiness-check',
}
assert expected_operational_playbooks <= set(by_id)
assert len(payload) >= 8
assert 'connector-readiness-review' in by_id
connector_review = by_id['connector-readiness-review']
assert connector_review['risk'] == 'medium'
assert connector_review['successRate'] < 100
assert 'Deluge' in connector_review['requiredConnectors']
assert any('degraded connector' in step.lower() for step in connector_review['steps'])
assert all('lastRuns' not in item for item in payload)
assert all('delete' not in ' '.join(item['steps']).lower() for item in payload)
def test_observability_endpoints_keep_frontend_contract_shape(api_client):
routes = {
'/api/incidents': ('id', 'severity', 'status', 'title', 'detectedTime', 'evidence', 'suggestedActions'),
'/api/healthchecks': ('service', 'status', 'checkedAt'),
'/api/network/exposure': ('source', 'host', 'port', 'protocol', 'protected', 'risk'),
}
for path, required_keys in routes.items():
response = api_client.get(path)
assert response.status_code == 200
payload = response.json()
assert isinstance(payload, list)
if path != '/api/network/exposure':
assert payload
if payload:
assert set(payload[0]) >= set(required_keys)
statistics = api_client.get('/api/statistics/summary').json()
assert set(statistics) >= {'cpuHistory', 'ramHistory', 'restartsByApp', 'blockedActions', 'voiceActionCount'}
storage = api_client.get('/api/storage/summary').json()
assert set(storage) >= {'cacheUsage', 'arrayUsage', 'shares', 'appDataUsage'}
operations_map = api_client.get('/api/operations-map').json()
assert set(operations_map) >= {'nodes', 'edges'}
assert isinstance(operations_map['nodes'], list)
assert isinstance(operations_map['edges'], list)
def test_healthchecks_reflect_connector_readiness(api_client):
from sqlmodel import Session
from backend.app.core.config import settings
from backend.app.db import session as db_session
from backend.app.db.models import Connector
settings.voice_token = "test-voice-token"
with Session(db_session.engine) as session:
portainer = session.get(Connector, "portainer")
unraid = session.get(Connector, "unraid")
home_assistant = session.get(Connector, "home_assistant")
assert portainer is not None
assert unraid is not None
assert home_assistant is not None
portainer.status = "connected"
unraid.status = "connected"
home_assistant.status = "missing_config"
session.add(portainer)
session.add(unraid)
session.add(home_assistant)
session.commit()
response = api_client.get('/api/healthchecks')
assert response.status_code == 200
checks = {item['service']: item for item in response.json()}
assert checks['Portainer']['status'] == 'pass'
assert checks['Unraid']['status'] == 'pass'
assert checks['Voice Bridge']['status'] == 'warn'
assert all(not item['checkedAt'].startswith('2026-06-25') for item in checks.values())
assert 'token' not in str(checks).lower()
def test_storage_summary_uses_readonly_connector_sources(api_client, monkeypatch):
monkeypatch.setattr(
'backend.app.connectors.unraid.UnraidConnector.get_cache_status',
lambda self: {'status': 'ok', 'cacheUsage': 64},
raising=True,
)
monkeypatch.setattr(
'backend.app.connectors.unraid.UnraidConnector.get_share_summary',
lambda self: {
'status': 'ok',
'shares': [
{'name': 'appdata', 'usedGiB': 100, 'sizeGiB': 200, 'critical': False},
{'name': 'media', 'usedGiB': 900, 'sizeGiB': 1000, 'critical': True},
],
},
raising=True,
)
monkeypatch.setattr(
'backend.app.connectors.unraid.UnraidConnector.get_disk_warnings',
lambda self: {
'status': 'ok',
'diskWarnings': 0,
'disks': [
{'name': 'disk1', 'status': 'DISK_OK', 'healthy': True, 'usedGiB': 50, 'sizeGiB': 100, 'freeGiB': 50},
],
},
raising=True,
)
monkeypatch.setattr(
'backend.app.connectors.portainer.PortainerConnector.list_containers',
lambda self: {
'status': 'ok',
'containers': [
{'name': 'widefrog', 'appId': 'widefrog', 'mounts': [{'source': '/srv/example/appdata/widefrog', 'destination': '/data', 'type': 'bind'}]},
{'name': 'authentik-server', 'appId': 'authentik', 'mounts': [{'source': '/srv/example/appdata/authentik', 'destination': '/media', 'type': 'bind'}]},
{'name': 'authentik-worker', 'appId': 'authentik', 'mounts': [{'source': '/srv/example/appdata/authentik-worker', 'destination': '/worker', 'type': 'bind'}]},
],
},
raising=True,
)
payload = api_client.get('/api/storage/summary').json()
assert payload['cacheUsage'] == 64
assert payload['arrayUsage'] == 83
assert payload['disks'][0]['name'] == 'disk1'
assert payload['shares'][1]['name'] == 'media'
assert len(payload['appDataUsage']) == 3
assert payload['appDataUsage'][0]['usedGiB'] is None
assert payload['appDataUsage'][0]['share'] == 'appdata'
assert payload['orphanedVolumes'] == []
assert payload['sources'] == {'unraid': 'ok', 'unraidDisks': 'ok', 'portainer': 'ok'}
def test_storage_summary_keeps_portainer_volume_hints_when_unraid_schema_partial(api_client, monkeypatch):
monkeypatch.setattr(
'backend.app.connectors.unraid.UnraidConnector.get_cache_status',
lambda self: {'status': 'error', 'reason': 'GraphQL validation failed', 'cacheUsage': 0},
raising=True,
)
monkeypatch.setattr(
'backend.app.connectors.unraid.UnraidConnector.get_share_summary',
lambda self: {'status': 'error', 'reason': 'Cannot query field shareSummary', 'shares': []},
raising=True,
)
monkeypatch.setattr(
'backend.app.connectors.unraid.UnraidConnector.get_disk_warnings',
lambda self: {'status': 'error', 'reason': 'Cannot query field disks', 'disks': [], 'diskWarnings': 0},
raising=True,
)
monkeypatch.setattr(
'backend.app.connectors.portainer.PortainerConnector.list_containers',
lambda self: {
'status': 'ok',
'containers': [
{'name': 'plex', 'appId': 'plex', 'mounts': [{'source': '/srv/example/appdata/plex', 'destination': '/config'}]},
{'name': 'plex-worker', 'appId': 'plex', 'mounts': [{'source': '/srv/example/media', 'destination': '/media'}]},
{'name': 'radarr', 'appId': 'radarr', 'mounts': [{'source': '/srv/example/appdata/radarr', 'destination': '/config'}]},
],
},
raising=True,
)
payload = api_client.get('/api/storage/summary').json()
assert payload['sources']['unraid'] == 'error'
assert payload['sources']['unraidDisks'] == 'error'
assert payload['sources']['portainer'] == 'ok'
assert payload['sourceWarnings'][0]['source'] == 'unraid'
assert payload['shares'] == []
assert len(payload['appDataUsage']) == 3
assert payload['appDataUsage'][0]['volume'] == '/srv/example/appdata/plex -> /config'
assert payload['appDataUsage'][0]['usedGiB'] is None
def test_safety_summary_partial_when_key_sources_missing_without_critical_evidence(api_client):
payload = api_client.get('/api/safety/summary').json()
assert payload['status'] in {'partial', 'warning'}
assert payload['criticalCount'] == 0
assert payload['score'] >= 0
assert payload['dataCompleteness']['percentage'] < 100
assert {'npm', 'authentik', 'unraid'} & set(payload['missingSources'])
assert len(payload['sections']) == 9
assert all(section['status'] != 'critical' for section in payload['sections'] if section['id'] in {'external-exposure', 'authentication-coverage', 'unraid-host-safety'})
def test_safety_routes_return_center_payloads_and_no_secret_values(api_client):
summary = api_client.get('/api/safety/summary').json()
sections = api_client.get('/api/safety/sections').json()
findings = api_client.get('/api/safety/findings').json()
recommendations = api_client.get('/api/safety/recommendations').json()
breakdown = api_client.get('/api/safety/score-breakdown').json()
assert summary['recommendationCount'] == len(recommendations)
assert len(sections) == 9
assert isinstance(findings, list)
assert breakdown['baseScore'] == 100
assert breakdown['finalScore'] == summary['score']
assert all(recommendation['executable'] is False for recommendation in recommendations)
serialized = str({'summary': summary, 'sections': sections, 'findings': findings, 'recommendations': recommendations, 'breakdown': breakdown})
assert 'Bearer ' not in serialized
assert 'test-voice-token' not in serialized
assert 'TOKEN_VALUE' not in serialized
def test_safety_section_completeness_counts_partial_sources():
from backend.app.services import safety_center_service
findings = [{
'id': 'ai-sec-media-pipeline-issue',
'title': 'Media pipeline needs review',
'description': 'Media pipeline has items requiring attention.',
'severity': 'medium',
'category': 'media',
'affectedResources': ['media_pipeline'],
'evidence': [],
'suggestedActions': [],
'source': 'AI Security Reviewer',
'status': 'open',
}]
coverage = {'media_pipeline': {'status': 'partial', 'label': 'Media Pipeline', 'effectOnConfidence': 'medium'}}
sections = safety_center_service._sections(findings, [], coverage)
media = next(section for section in sections if section['id'] == 'media-pipeline')
assert media['status'] == 'partial'
assert media['dataCompleteness'] == 50
def test_safety_dashboard_returns_combined_cached_payload(api_client, monkeypatch):
from backend.app.services import safety_center_service
safety_center_service.invalidate_cache()
calls = {'count': 0}
original_generate_review = safety_center_service.ai_security_reviewer.generate_review
def counted_generate_review(session):
calls['count'] += 1
return original_generate_review(session)
monkeypatch.setattr(safety_center_service.ai_security_reviewer, 'generate_review', counted_generate_review)
first = api_client.get('/api/safety/dashboard').json()
second = api_client.get('/api/safety/dashboard').json()
assert first['summary']['score'] == first['scoreBreakdown']['finalScore']
assert first['summary']['recommendationCount'] == len(first['recommendations'])
assert len(first['sections']) == 9
assert isinstance(first['coverageSources'], list)
assert first['cache']['hit'] is False
assert first['cache']['source'] == 'fresh'
assert first['cache']['ttlSeconds'] >= 1
assert first['cache']['generationDurationMs'] >= 0
assert second['cache']['hit'] is True
assert second['cache']['source'] == 'cache'
assert second['summary']['score'] == first['summary']['score']
assert calls['count'] == 1
def test_safety_dashboard_reuses_persistent_cache_after_process_cache_loss(api_client, monkeypatch):
from backend.app.services import safety_center_service
safety_center_service.invalidate_cache()
first = api_client.get('/api/safety/dashboard').json()
safety_center_service._dashboard_cache = None
safety_center_service._skip_persistent_cache_once = False
def fail_if_regenerated(session):
raise AssertionError('persistent safety cache should avoid cold regeneration')
monkeypatch.setattr(safety_center_service.ai_security_reviewer, 'generate_review', fail_if_regenerated)
second = api_client.get('/api/safety/dashboard').json()
assert second['cache']['hit'] is True
assert second['cache']['source'] in {'cache', 'stale'}
assert second['summary']['score'] == first['summary']['score']
def test_safety_dashboard_refreshes_expired_persistent_cache(api_client, monkeypatch):
from datetime import datetime, timedelta, timezone
from backend.app.services import safety_center_service
safety_center_service.invalidate_cache()
first = api_client.get('/api/safety/dashboard').json()
persisted_payload = {
key: first[key]
for key in ('summary', 'sections', 'findings', 'recommendations', 'scoreBreakdown')
}
expired = (datetime.now(timezone.utc) - timedelta(minutes=5)).isoformat().replace('+00:00', 'Z')
safety_center_service._dashboard_cache = None
safety_center_service._skip_persistent_cache_once = False
monkeypatch.setattr(
safety_center_service,
'_persistent_cache',
lambda session, signature: {
'key': safety_center_service.CACHE_KEY,
'signature': signature,
'payload': persisted_payload,
'generatedAt': first['summary']['generatedAt'],
'expiresAt': expired,
'generationDurationMs': 12,
},
)
calls = {'scheduled': 0}
monkeypatch.setattr(
safety_center_service,
'_schedule_background_refresh',
lambda: calls.__setitem__('scheduled', calls['scheduled'] + 1) or True,
)
second = api_client.get('/api/safety/dashboard').json()
assert calls['scheduled'] == 1
assert second['cache']['source'] == 'stale-while-revalidate'
assert second['cache']['hit'] is True
def test_safety_refresh_invalidates_dashboard_cache(api_client):
from backend.app.services import safety_center_service
safety_center_service.invalidate_cache()
first = api_client.get('/api/safety/dashboard').json()
second = api_client.get('/api/safety/dashboard').json()
refreshed = api_client.post('/api/safety/refresh').json()
after_refresh = api_client.get('/api/safety/dashboard').json()
assert first['cache']['source'] == 'fresh'
assert second['cache']['hit'] is True
assert refreshed['cache']['hit'] is False
assert refreshed['cache']['source'] == 'fresh'
assert after_refresh['cache']['hit'] is True
assert refreshed['summary']['score'] == after_refresh['summary']['score']
def test_setup_connector_save_invalidates_safety_cache(api_client, monkeypatch):
from backend.app.services import safety_center_service
original_invalidate = safety_center_service.invalidate_cache
calls = {'count': 0}
def counted_invalidate():
calls['count'] += 1
original_invalidate()
monkeypatch.setattr(safety_center_service, 'invalidate_cache', counted_invalidate)
payload = api_client.patch(
'/api/settings/connectors/unraid',
json={'url': 'http://198.18.10.150', 'apiKey': 'test-unraid-key'},
).json()
assert payload['connectorId'] == 'unraid'
assert calls['count'] >= 1
def test_app_mapping_invalidates_safety_cache(api_client, monkeypatch):
from backend.app.db.models import App
from backend.app.db.session import engine
from backend.app.services import safety_center_service
from sqlmodel import Session
with Session(engine) as session:
session.add(App(id='mapping-test', name='Mapping Test', category='Test'))
session.commit()
original_invalidate = safety_center_service.invalidate_cache
calls = {'count': 0}
def counted_invalidate():
calls['count'] += 1
original_invalidate()
monkeypatch.setattr(safety_center_service, 'invalidate_cache', counted_invalidate)
payload = api_client.patch(
'/api/apps/mapping-test/container-mapping',
json={'containerId': 'container-123', 'containerName': 'mapping-test'},
).json()
assert payload['success'] is True
assert payload['message'] == 'mapping_updated'
assert calls['count'] >= 1
def test_safety_legacy_endpoints_share_dashboard_snapshot(api_client):
from backend.app.services import safety_center_service
safety_center_service.invalidate_cache()
dashboard = api_client.get('/api/safety/dashboard').json()
summary = api_client.get('/api/safety/summary').json()
sections = api_client.get('/api/safety/sections').json()
findings = api_client.get('/api/safety/findings').json()
recommendations = api_client.get('/api/safety/recommendations').json()
breakdown = api_client.get('/api/safety/score-breakdown').json()
assert summary == dashboard['summary']
assert sections == dashboard['sections']
assert findings == dashboard['findings']
assert recommendations == dashboard['recommendations']
assert breakdown == dashboard['scoreBreakdown']
def test_safety_summary_critical_when_destructive_policy_is_not_blocked(api_client):
from backend.app.db.models import Policy
from backend.app.db.session import engine
from sqlmodel import Session
with Session(engine) as session:
policy = session.get(Policy, 'policy-volume-delete')
policy.manual = 'allowed'
session.add(policy)
session.commit()
payload = api_client.get('/api/safety/summary').json()
findings = api_client.get('/api/safety/findings').json()
assert payload['status'] == 'critical'
assert payload['criticalCount'] >= 1
assert any(finding['id'] == 'ai-sec-policy-volume-delete-not-blocked' and finding['severity'] == 'critical' for finding in findings)
def test_safety_summary_high_inventory_review_is_warning_not_global_critical(api_client):
from backend.app.db.models import App
from backend.app.db.session import engine
from backend.app.services import safety_center_service
from sqlmodel import Session
safety_center_service.invalidate_cache()
with Session(engine) as session:
session.add(App(
id='critical-review-app',
name='Critical Review App',
category='Infrastructure',
criticality='critical',
protected=False,
needs_review=True,
discovery_status='managed',
connector_status='connected',
container_status='running',
))
session.commit()
payload = api_client.get('/api/safety/summary').json()
findings = api_client.get('/api/safety/findings').json()
assert payload['criticalCount'] == 0
assert payload['highCount'] >= 1
assert payload['status'] != 'critical'
assert any(finding['category'] == 'inventory' and finding['severity'] == 'high' for finding in findings)
def test_safety_status_high_auth_exposure_without_critical_finding_is_warning():
from backend.app.services import safety_center_service
from collections import Counter
findings = [
{
'id': 'ai-sec-auth-public-host-without-authentik',
'severity': 'high',
'category': 'auth',
'status': 'open',
},
{
'id': 'ai-sec-npm-host-without-ssl-force',
'severity': 'medium',
'category': 'exposure',
'status': 'open',
},
]
assert safety_center_service._status(46, Counter({'high': 1, 'medium': 1}), [], findings) == 'warning'
def test_safety_single_app_review_recommendation_links_to_app_detail(api_client):
from backend.app.db.models import App
from backend.app.db.session import engine
from backend.app.services import safety_center_service
from sqlmodel import Session, select
safety_center_service.invalidate_cache()
with Session(engine) as session:
for app in session.exec(select(App)).all():
app.needs_review = False
session.add(app)
app = session.get(App, 'radarr')
if not app:
app = App(id='radarr', name='Radarr', category='Media')
app.needs_review = True
app.criticality = 'medium'
session.add(app)
session.commit()
recommendations = api_client.get('/api/safety/recommendations').json()
review = next(item for item in recommendations if item['id'] == 'safety-rec-safety-apps-need-review')
assert review['href'] == '/apps/radarr'
def test_safety_recommendations_are_non_executing_and_remediation_link_creates_no_jobs(api_client):
recommendations = api_client.get('/api/safety/recommendations').json()
assert recommendations
assert all(recommendation['executable'] is False for recommendation in recommendations)
before_jobs = api_client.get('/api/jobs').json()
response = api_client.post(f"/api/safety/recommendations/{recommendations[0]['id']}/create-remediation-plan")
after_jobs = api_client.get('/api/jobs').json()
assert response.status_code == 200
payload = response.json()
assert payload['success'] is True
assert payload['executable'] is False
assert payload['href'].startswith('/ai/remediation-planner')
assert before_jobs == after_jobs
def test_safety_finding_acknowledge_and_dismiss_are_safety_state_only(api_client):
finding = api_client.get('/api/safety/findings').json()[0]
acknowledged = api_client.post(f"/api/safety/findings/{finding['id']}/acknowledge").json()
dismissed = api_client.post(f"/api/safety/findings/{finding['id']}/dismiss").json()
assert acknowledged['success'] is True
assert acknowledged['status'] == 'acknowledged'
assert dismissed['success'] is True
assert dismissed['status'] == 'dismissed'
def test_incidents_are_derived_from_live_safety_sources(api_client):
payload = api_client.get('/api/incidents').json()
by_id = {item['id']: item for item in payload}
assert 'incident-connectors-config' in by_id
assert by_id['incident-connectors-config']['status'] == 'open'
assert by_id['incident-connectors-config']['severity'] in {'medium', 'high'}
assert by_id['incident-connectors-config']['evidence']['source'] == 'Connector Registry'
assert 'connector' in by_id['incident-connectors-config']['title'].lower()
assert 'i1' not in by_id
assert all('503 Service Unavailable' not in str(item) for item in payload)
def test_incident_status_lifecycle_is_persistent_and_affects_summary(api_client):
incident = api_client.get('/api/incidents').json()[0]
acknowledged = api_client.post(f"/api/incidents/{incident['id']}/status", json={'status': 'acknowledged'}).json()
after_ack = {item['id']: item for item in api_client.get('/api/incidents').json()}
summary_after_ack = api_client.get('/api/system/summary').json()
assert acknowledged['success'] is True
assert after_ack[incident['id']]['status'] == 'acknowledged'
assert summary_after_ack['openIncidents'] == len([item for item in after_ack.values() if item['status'] == 'open'])
resolved = api_client.post(f"/api/incidents/{incident['id']}/status", json={'status': 'resolved'}).json()
after_resolve = {item['id']: item for item in api_client.get('/api/incidents').json()}
assert resolved['success'] is True
assert incident['id'] not in after_resolve
def test_unknown_incident_status_update_fails_closed(api_client):
payload = api_client.post('/api/incidents/not-a-real-incident/status', json={'status': 'resolved'}).json()
assert payload['success'] is False
assert payload['status'] == 'failed'
assert payload['message'] == 'incident_not_found'
def test_operations_map_uses_live_app_connector_and_policy_sources(api_client):
payload = api_client.get('/api/operations-map').json()
assert 'Connector Registry' in payload['nodes']
assert 'Policy Engine' in payload['nodes']
assert 'Secret Store' in payload['nodes']
assert 'Widefrog' in payload['nodes']
assert 'Plex' in payload['nodes']
assert 'Jellyfin' not in payload['nodes']
edges = {(edge['from'], edge['to']) for edge in payload['edges']}
assert ('Connector Registry', 'Widefrog') in edges
assert ('Connector Registry', 'Plex') in edges
assert ('Policy Engine', 'Widefrog') in edges
assert ('Secret Store', 'Connector Registry') in edges
assert ('Widefrog', 'Home Assistant') not in edges
assert payload['generatedAt'].endswith('Z')
assert payload['sources'] == {
'apps': {'status': 'ok', 'count': len(api_client.get('/api/apps').json())},
'connectors': {'status': 'ok', 'count': len(api_client.get('/api/connectors').json())},
'policies': {'status': 'ok', 'count': len(api_client.get('/api/policies').json())},
'secrets': {'status': 'metadata_only', 'count': 0},
}
def test_system_summary_counts_live_open_incidents(api_client):
incidents = api_client.get('/api/incidents').json()
summary = api_client.get('/api/system/summary').json()
open_incidents = [incident for incident in incidents if incident['status'] == 'open']
assert open_incidents
assert summary['openIncidents'] == len(open_incidents)
def test_container_logs_are_redacted_before_returning_to_ui(api_client, monkeypatch):
secret = 'PORTAINER_LOG_SECRET'
def fake_logs(self, container_name):
return {
'status': 'ok',
'container': container_name,
'logs': [
f'Authorization: Bearer {secret}',
f'api_key={secret}',
'normal startup line',
],
}
monkeypatch.setattr(
'backend.app.connectors.portainer.PortainerConnector.get_container_logs',
fake_logs,
raising=True,
)
response = api_client.get('/api/containers/widefrog/logs')
assert response.status_code == 200
payload = response.json()
assert payload['container'] == 'widefrog'
assert secret not in str(payload)
assert '[REDACTED]' in str(payload)
assert 'normal startup line' in payload['logs']
def test_portainer_read_routes_report_missing_config_instead_of_empty_data(api_client, monkeypatch):
from backend.app.core.config import settings
previous = dict(settings.apis)
settings.apis['PORTAINER_URL'] = ''
settings.apis.pop('PORTAINER_API_KEY', None)
settings.apis.pop('PORTAINER_ENDPOINT_ID', None)
containers = api_client.get('/api/containers')
stacks = api_client.get('/api/stacks')
assert containers.status_code == 503
assert containers.json()['detail']['status'] == 'missing_config'
assert containers.json()['detail']['reason'] == 'missing_config'
assert stacks.status_code == 503
assert stacks.json()['detail']['status'] == 'missing_config'
assert stacks.json()['detail']['reason'] == 'missing_config'
settings.apis.clear()
settings.apis.update(previous)
def test_portainer_container_mapping_adds_safe_ui_deep_link_without_secret():
from backend.app.connectors.portainer import PortainerConnector, _ConnectorConfig
config = _ConnectorConfig('https://portainer.example.local/', 'SHOULD_NOT_LEAK', '7', True)
payload = PortainerConnector._map_container(
{
'Id': 'abc123',
'Names': ['/widefrog'],
'Image': 'widefrog/app:latest',
'State': 'running',
'Ports': [],
},
config,
)
assert payload['portainerUrl'] == 'https://portainer.example.local/#!/7/docker/containers/abc123'
assert config.api_key not in str(payload)
def test_portainer_container_mapping_omits_deep_link_for_invalid_base_url():
from backend.app.connectors.portainer import PortainerConnector, _ConnectorConfig
config = _ConnectorConfig('javascript:alert(1)', 'SHOULD_NOT_LEAK', '7', True)
payload = PortainerConnector._map_container(
{
'Id': 'abc123',
'Names': ['/widefrog'],
'Image': 'widefrog/app:latest',
'State': 'running',
'Ports': [],
},
config,
)
assert payload['portainerUrl'] is None
assert config.api_key not in str(payload)
def test_ai_memory_create_redacts_secret_values(api_client):
secret = 'AI_MEMORY_SECRET'
response = api_client.post(
'/api/ai/memory',
json={
'key': 'connector-token-note',
'value': f'api_key={secret}',
'category': 'known_issue',
'pinned': True,
},
)
assert response.status_code == 200
payload = response.json()
assert secret not in str(payload)
assert '[REDACTED]' in str(payload)
def test_ai_tools_return_governed_tool_catalog(api_client):
response = api_client.get('/api/ai/tools')
assert response.status_code == 200
payload = response.json()
assert isinstance(payload, list)
assert payload
forbidden_tools = {'run_shell', 'delete_volume', 'show_secret', 'docker_prune'}
returned_ids = {tool['id'] for tool in payload}
returned_names = {tool['name'] for tool in payload}
assert forbidden_tools.isdisjoint(returned_ids)
assert forbidden_tools.isdisjoint(returned_names)
for tool in payload:
assert set(tool) >= {
'id',
'name',
'description',
'type',
'permissionLevel',
'requiresApproval',
'rateLimit',
'tool',
'enabled',
'allowedByDefault',
'scope',
}
assert tool['type'] in {'read', 'mutate'}
assert tool['scope'] in {'read', 'mutate'}
if tool['type'] == 'mutate':
assert tool['requiresApproval'] is True
assert tool['allowedByDefault'] is False
def test_sonarr_connector_missing_config_reports_required_env(api_client):
response = api_client.post('/api/connectors/sonarr/test')
assert response.status_code == 200
payload = response.json()
assert payload['success'] is False
assert payload['status'] == 'missing_config'
assert payload['missing_config'] is True
assert payload['required_env_vars'] == ['SONARR_URL', 'SONARR_API_KEY']
assert payload['secretRef'] == 'SONARR_API_KEY'
def test_sonarr_connector_error_redacts_api_key(api_client, monkeypatch):
from backend.app.core.config import settings
previous = dict(settings.apis)
settings.apis['SONARR_URL'] = 'https://sonarr.local'
settings.apis['SONARR_API_KEY'] = 'SONARR_SECRET_TOKEN'
def fail_request(*_args, **_kwargs):
raise RuntimeError('X-Api-Key=SONARR_SECRET_TOKEN')
monkeypatch.setattr('backend.app.connectors.sonarr.SonarrConnector._request', fail_request, raising=True)
response = api_client.post('/api/connectors/sonarr/test')
payload = response.json()
assert response.status_code == 200
assert payload['status'] == 'error'
assert 'SONARR_SECRET_TOKEN' not in str(payload)
assert '[REDACTED]' in str(payload)
settings.apis.clear()
settings.apis.update(previous)
def test_sonarr_search_series_normalizes_lookup_response(monkeypatch):
from backend.app.core.config import settings
from backend.app.connectors.sonarr import SonarrConnector
previous = dict(settings.apis)
settings.apis['SONARR_URL'] = 'https://sonarr.local'
settings.apis['SONARR_API_KEY'] = 'SONARR_SECRET_TOKEN'
def fake_request(self, method, path, **kwargs):
assert method == 'GET'
assert path == '/api/v3/series/lookup'
assert kwargs['params']['term'] == 'Foundation'
return [
{
'id': 12,
'tvdbId': 366972,
'title': 'Foundation',
'year': 2021,
'overview': 'A sci-fi series.',
'status': 'continuing',
'remotePoster': 'https://image.example/poster.jpg',
'monitored': True,
'seasons': [{'seasonNumber': 1}],
}
]
monkeypatch.setattr(SonarrConnector, '_request', fake_request, raising=True)
result = SonarrConnector().search_series('Foundation')
assert result['success'] is True
assert result['status'] == 'connected'
assert result['items'][0] == {
'id': 12,
'tvdbId': 366972,
'title': 'Foundation',
'year': 2021,
'overview': 'A sci-fi series.',
'status': 'continuing',
'remotePoster': 'https://image.example/poster.jpg',
'existing': False,
'monitored': True,
'seasons': [{'seasonNumber': 1}],
}
settings.apis.clear()
settings.apis.update(previous)
def test_sonarr_queue_status_normalizes_counts(monkeypatch):
from backend.app.core.config import settings
from backend.app.connectors.sonarr import SonarrConnector
previous = dict(settings.apis)
settings.apis['SONARR_URL'] = 'https://sonarr.local'
settings.apis['SONARR_API_KEY'] = 'SONARR_SECRET_TOKEN'
def fake_request(self, method, path, **_kwargs):
assert method == 'GET'
assert path == '/api/v3/queue'
return {
'records': [
{'id': 1, 'status': 'downloading', 'trackedDownloadStatus': 'ok', 'title': 'Episode 1'},
{'id': 2, 'status': 'queued', 'trackedDownloadStatus': 'warning', 'title': 'Episode 2'},
{'id': 3, 'status': 'completed', 'trackedDownloadStatus': 'error', 'title': 'Episode 3'},
{'id': 4, 'status': 'stalled', 'trackedDownloadStatus': 'warning', 'title': 'Episode 4'},
],
'totalRecords': 4,
}
monkeypatch.setattr(SonarrConnector, '_request', fake_request, raising=True)
result = SonarrConnector().queue_status()
assert result['success'] is True
assert result['total'] == 4
assert result['downloading'] == 1
assert result['queued'] == 1
assert result['failed'] == 1
assert result['stalled'] == 1
assert len(result['items']) == 4
settings.apis.clear()
settings.apis.update(previous)
def test_sonarr_add_series_policy_allowed_creates_job_and_audit(api_client, monkeypatch):
def fake_add_series(self, payload):
return {
'success': True,
'status': 'connected',
'message': 'series_added',
'data': {'id': 42, 'title': payload['title'], 'tvdbId': payload['tvdbId']},
}
monkeypatch.setattr('backend.app.connectors.sonarr.SonarrConnector.add_series', fake_add_series, raising=True)
response = api_client.post(
'/api/apps/sonarr/series',
json={'title': 'Foundation', 'tvdbId': 366972, 'rootFolderPath': '/tv', 'qualityProfileId': 1},
)
assert response.status_code == 200
payload = response.json()
assert payload['success'] is True
assert payload['decision'] == 'allowed'
assert payload['status'] == 'success'
assert payload['jobId'].startswith('job-')
assert payload['auditId'].startswith('audit-')
assert payload['data']['tvdbId'] == 366972
def test_sonarr_add_series_missing_config_fails_without_fake_success(api_client):
response = api_client.post(
'/api/apps/sonarr/series',
json={'title': 'Foundation', 'tvdbId': 366972},
)
assert response.status_code == 200
payload = response.json()
assert payload['success'] is False
assert payload['decision'] == 'failed'
assert payload['status'] == 'failed'
assert payload['message'] == 'missing_config'
assert payload['jobId'].startswith('job-')
assert payload['auditId'].startswith('audit-')
def test_sonarr_destructive_actions_are_not_executable(api_client):
delete_response = api_client.post('/api/apps/sonarr/series/delete', json={'id': 42})
mass_response = api_client.post('/api/apps/sonarr/mass-edit', json={'ids': [42]})
assert delete_response.status_code in {404, 405}
assert mass_response.status_code in {404, 405}
policy_delete = api_client.post(
'/api/policies/evaluate',
json={'action': 'sonarr.delete_series', 'target': 'sonarr', 'source': 'manual'},
).json()
policy_mass = api_client.post(
'/api/policies/evaluate',
json={'action': 'sonarr.mass_edit', 'target': 'sonarr', 'source': 'manual'},
).json()
assert policy_delete['decision'] == 'blocked'
assert policy_mass['decision'] == 'blocked'
def test_radarr_connector_missing_config_reports_required_env(api_client):
response = api_client.post('/api/connectors/radarr/test')
assert response.status_code == 200
payload = response.json()
assert payload['success'] is False
assert payload['status'] == 'missing_config'
assert payload['missing_config'] is True
assert payload['required_env_vars'] == ['RADARR_URL', 'RADARR_API_KEY']
assert payload['secretRef'] == 'RADARR_API_KEY'
def test_radarr_connector_error_redacts_api_key(api_client, monkeypatch):
from backend.app.core.config import settings
previous = dict(settings.apis)
settings.apis['RADARR_URL'] = 'https://radarr.local'
settings.apis['RADARR_API_KEY'] = 'RADARR_SECRET_TOKEN'
def fail_request(*_args, **_kwargs):
raise RuntimeError('X-Api-Key=RADARR_SECRET_TOKEN')
monkeypatch.setattr('backend.app.connectors.radarr.RadarrConnector._request', fail_request, raising=True)
response = api_client.post('/api/connectors/radarr/test')
payload = response.json()
assert response.status_code == 200
assert payload['status'] in {'error', 'unreachable'}
assert 'RADARR_SECRET_TOKEN' not in str(payload)
assert '[REDACTED]' in str(payload)
settings.apis.clear()
settings.apis.update(previous)
def test_radarr_connector_uses_radarr_tls_and_timeout_settings(monkeypatch):
from backend.app.core.config import settings
from backend.app.connectors.radarr import RadarrConnector
previous = dict(settings.apis)
settings.apis['RADARR_URL'] = 'https://radarr.local'
settings.apis['RADARR_API_KEY'] = 'RADARR_SECRET_TOKEN'
settings.apis['RADARR_VERIFY_TLS'] = True
settings.apis['RADARR_TIMEOUT_SECONDS'] = '12.5'
captured = {}
class FakeResponse:
status_code = 200
text = '{"version":"5.0.0"}'
def json(self):
return {'version': '5.0.0'}
class FakeClient:
def __init__(self, *, timeout, verify):
captured['timeout'] = timeout
captured['verify'] = verify
def __enter__(self):
return self
def __exit__(self, *_args):
return False
def request(self, **kwargs):
captured['headers'] = kwargs['headers']
return FakeResponse()
monkeypatch.setattr('backend.app.connectors.radarr.httpx.Client', FakeClient, raising=True)
result = RadarrConnector().test_connection()
assert result['status'] == 'connected'
assert captured['timeout'] == 12.5
assert captured['verify'] is True
assert captured['headers']['X-Api-Key'] == 'RADARR_SECRET_TOKEN'
settings.apis.clear()
settings.apis.update(previous)
def test_radarr_seed_status_requires_url_and_api_key(monkeypatch):
from backend.app.core.config import settings
from backend.app.db.init_db import _seed_connectors
previous = dict(settings.apis)
settings.apis['RADARR_URL'] = 'https://radarr.local'
settings.apis['RADARR_API_KEY'] = None
radarr = next(connector for connector in _seed_connectors() if connector.id == 'radarr')
assert radarr.status == 'disconnected'
settings.apis.clear()
settings.apis.update(previous)
def test_radarr_search_movie_normalizes_lookup_response(monkeypatch):
from backend.app.core.config import settings
from backend.app.connectors.radarr import RadarrConnector
previous = dict(settings.apis)
settings.apis['RADARR_URL'] = 'https://radarr.local'
settings.apis['RADARR_API_KEY'] = 'RADARR_SECRET_TOKEN'
def fake_request(self, method, path, **kwargs):
assert method == 'GET'
assert path == '/api/v3/movie/lookup'
assert kwargs['params']['term'] == 'Arrival'
return [
{
'id': 18,
'tmdbId': 329865,
'imdbId': 'tt2543164',
'title': 'Arrival',
'year': 2016,
'overview': 'A linguist works with an alien language.',
'status': 'released',
'remotePoster': 'https://image.example/arrival.jpg',
'monitored': True,
'minimumAvailability': 'released',
}
]
monkeypatch.setattr(RadarrConnector, '_request', fake_request, raising=True)
result = RadarrConnector().search_movie('Arrival')
assert result['success'] is True
assert result['status'] == 'connected'
assert result['items'][0] == {
'id': 18,
'tmdbId': 329865,
'imdbId': 'tt2543164',
'title': 'Arrival',
'year': 2016,
'overview': 'A linguist works with an alien language.',
'status': 'released',
'remotePoster': 'https://image.example/arrival.jpg',
'existing': False,
'monitored': True,
'minimumAvailability': 'released',
}
settings.apis.clear()
settings.apis.update(previous)
def test_radarr_queue_status_normalizes_counts(monkeypatch):
from backend.app.core.config import settings
from backend.app.connectors.radarr import RadarrConnector
previous = dict(settings.apis)
settings.apis['RADARR_URL'] = 'https://radarr.local'
settings.apis['RADARR_API_KEY'] = 'RADARR_SECRET_TOKEN'
def fake_request(self, method, path, **_kwargs):
assert method == 'GET'
assert path == '/api/v3/queue'
return {
'records': [
{'id': 1, 'status': 'downloading', 'trackedDownloadStatus': 'ok', 'title': 'Movie 1'},
{'id': 2, 'status': 'queued', 'trackedDownloadStatus': 'warning', 'title': 'Movie 2'},
{'id': 3, 'status': 'completed', 'trackedDownloadStatus': 'error', 'title': 'Movie 3'},
{'id': 4, 'status': 'stalled', 'trackedDownloadStatus': 'warning', 'title': 'Movie 4'},
],
'totalRecords': 4,
}
monkeypatch.setattr(RadarrConnector, '_request', fake_request, raising=True)
result = RadarrConnector().queue_status()
assert result['success'] is True
assert result['status'] == 'ok'
assert result['total'] == 4
assert result['downloading'] == 1
assert result['queued'] == 1
assert result['failed'] == 1
assert result['stalled'] == 1
assert len(result['items']) == 4
settings.apis.clear()
settings.apis.update(previous)
def test_radarr_queue_unavailable_on_connector_error(monkeypatch):
from backend.app.core.config import settings
from backend.app.connectors.radarr import RadarrConnector
previous = dict(settings.apis)
settings.apis['RADARR_URL'] = 'https://radarr.local'
settings.apis['RADARR_API_KEY'] = 'RADARR_SECRET_TOKEN'
def fake_request(self, method, path, **_kwargs):
raise RuntimeError('connection refused')
monkeypatch.setattr(RadarrConnector, '_request', fake_request, raising=True)
result = RadarrConnector().queue_status()
assert result['success'] is False
assert result['status'] == 'unavailable'
assert result['total'] == 0
settings.apis.clear()
settings.apis.update(previous)
def test_radarr_wanted_missing_normalizes_records(monkeypatch):
from backend.app.core.config import settings
from backend.app.connectors.radarr import RadarrConnector
previous = dict(settings.apis)
settings.apis['RADARR_URL'] = 'https://radarr.local'
settings.apis['RADARR_API_KEY'] = 'RADARR_SECRET_TOKEN'
def fake_request(self, method, path, **kwargs):
assert method == 'GET'
assert path == '/api/v3/wanted/missing'
assert kwargs['params'] == {'page': 1, 'pageSize': 20}
return {'records': [{'title': 'Missing Movie', 'tmdbId': 123}], 'totalRecords': 1}
monkeypatch.setattr(RadarrConnector, '_request', fake_request, raising=True)
result = RadarrConnector().wanted_missing()
assert result['success'] is True
assert result['status'] == 'connected'
assert result['total'] == 1
assert result['items'] == [{'title': 'Missing Movie', 'tmdbId': 123}]
settings.apis.clear()
settings.apis.update(previous)
def test_radarr_add_movie_policy_allowed_creates_job_and_audit(api_client, monkeypatch):
def fake_add_movie(self, payload):
return {
'success': True,
'status': 'connected',
'message': 'movie_added',
'data': {'id': 99, 'title': payload['title'], 'tmdbId': payload['tmdbId']},
}
monkeypatch.setattr('backend.app.connectors.radarr.RadarrConnector.add_movie', fake_add_movie, raising=True)
response = api_client.post(
'/api/apps/radarr/movie',
json={'title': 'Arrival', 'tmdbId': 329865, 'rootFolderPath': '/movies', 'qualityProfileId': 1},
)
assert response.status_code == 200
payload = response.json()
assert payload['success'] is True
assert payload['decision'] == 'allowed'
assert payload['status'] == 'success'
assert payload['jobId'].startswith('job-')
assert payload['auditId'].startswith('audit-')
assert payload['data']['tmdbId'] == 329865
def test_radarr_add_movie_missing_config_fails_without_fake_success(api_client):
from backend.app.core.config import settings
previous = dict(settings.apis)
settings.apis['RADARR_URL'] = None
settings.apis['RADARR_API_KEY'] = None
response = api_client.post('/api/apps/radarr/movie', json={'title': 'Arrival', 'tmdbId': 329865})
assert response.status_code == 200
payload = response.json()
assert payload['success'] is False
assert payload['decision'] == 'failed'
assert payload['status'] == 'failed'
assert payload['message'] == 'missing_config'
assert payload['jobId'].startswith('job-')
assert payload['auditId'].startswith('audit-')
settings.apis.clear()
settings.apis.update(previous)
def test_radarr_voice_add_movie_requires_policy_without_connector_call(api_client, monkeypatch):
def fail_add_movie(*_args, **_kwargs):
raise AssertionError('connector should not be called before approval')
monkeypatch.setattr('backend.app.connectors.radarr.RadarrConnector.add_movie', fail_add_movie, raising=True)
response = api_client.post(
'/api/apps/radarr/movie',
json={'title': 'Arrival', 'tmdbId': 329865, 'source': 'voice'},
)
assert response.status_code == 200
payload = response.json()
assert payload['success'] is False
assert payload['decision'] == 'approval_required'
assert payload['status'] == 'failed'
assert payload['approvalId'].startswith('appr-')
assert payload['auditId'].startswith('audit-')
def test_radarr_destructive_actions_are_not_executable(api_client):
delete_response = api_client.post('/api/apps/radarr/movie/delete', json={'id': 42})
delete_files_response = api_client.post('/api/apps/radarr/movie/delete-files', json={'id': 42})
mass_response = api_client.post('/api/apps/radarr/mass-edit', json={'ids': [42]})
assert delete_response.status_code in {404, 405}
assert delete_files_response.status_code in {404, 405}
assert mass_response.status_code in {404, 405}
policy_delete = api_client.post(
'/api/policies/evaluate',
json={'action': 'radarr.delete_movie', 'target': 'radarr', 'source': 'manual'},
).json()
policy_delete_files = api_client.post(
'/api/policies/evaluate',
json={'action': 'radarr.delete_files', 'target': 'radarr', 'source': 'manual'},
).json()
policy_mass = api_client.post(
'/api/policies/evaluate',
json={'action': 'radarr.mass_edit', 'target': 'radarr', 'source': 'manual'},
).json()
assert policy_delete['decision'] == 'blocked'
assert policy_delete_files['decision'] == 'blocked'
assert policy_mass['decision'] == 'blocked'
def test_execute_blocked_action_is_never_success(api_client):
response = api_client.post(
'/api/actions/execute',
json={'intent': 'volume.delete', 'target': 'postgres-data', 'source': 'manual', 'risk': 'critical', 'plan': []},
)
payload = response.json()
assert response.status_code == 200
assert payload['success'] is False
assert payload['decision'] == 'blocked'
assert payload['status'] == 'failed'
assert payload.get('result') == 'blocked'
assert 'jobId' not in payload
def test_approval_required_does_not_execute_job(api_client):
jobs_before = api_client.get('/api/jobs').json()
response = api_client.post(
'/api/actions/execute',
json={'intent': 'container.restart', 'target': 'authentik', 'source': 'manual', 'risk': 'high'},
)
payload = response.json()
assert response.status_code == 200
assert payload['success'] is False
assert payload['decision'] == 'approval_required'
assert payload['status'] == 'failed'
assert payload['result'] == 'approval_required'
assert payload['approvalId'].startswith('appr-')
jobs_after = api_client.get('/api/jobs').json()
assert jobs_after == jobs_before
def test_allowed_action_without_live_executor_is_not_fake_success(api_client):
jobs_before = api_client.get('/api/jobs').json()
response = api_client.post(
'/api/actions/execute',
json={
'intent': 'unraid.health_summary',
'target': 'unraid',
'source': 'manual',
'risk': 'low',
'plan': ['Read array status'],
},
)
payload = response.json()
assert response.status_code == 200
assert payload['success'] is False
assert payload['decision'] == 'allowed'
assert payload['status'] == 'failed'
assert payload['result'] == 'unsupported'
assert 'No live executor' in payload['message']
assert 'jobId' not in payload
jobs_after = api_client.get('/api/jobs').json()
assert jobs_after == jobs_before
def test_policy_update_is_persisted_and_audited(api_client):
response = api_client.patch(
'/api/policies/policy-widefrog-health',
json={
'voice': 'approval_required',
'manual': 'allowed',
'risk': 'medium',
'reason': 'Operator requires voice approval during maintenance.',
},
)
assert response.status_code == 200
response_payload = response.json()
assert response_payload.get('voice') == 'approval_required', response_payload
evaluation = api_client.post(
'/api/policies/evaluate',
json={'action': 'widefrog.health', 'target': 'widefrog', 'source': 'voice'},
).json()
assert evaluation['decision'] == 'approval_required'
audit = api_client.get('/api/audit').json()
assert any(event['action_id'] == 'policy.update' and event['target'] == 'policy-widefrog-health' for event in audit)
def test_policy_update_cannot_loosen_destructive_guardrail(api_client):
response = api_client.patch(
'/api/policies/policy-volume-delete',
json={
'voice': 'blocked',
'manual': 'allowed',
'risk': 'critical',
'reason': 'Attempted override.',
},
)
assert response.status_code == 409
evaluation = api_client.post(
'/api/policies/evaluate',
json={'action': 'volume.delete', 'target': 'volume', 'source': 'manual'},
).json()
assert evaluation['decision'] == 'blocked'
Reference in new issue View Git Blame Copy Permalink