Paul Payne
05b28cb584
Repo-side rename only (Phases 1-3 of the migration plan); the live box (~/.castle, systemd units, /data/castle, domains) is a separate cutover. - Slug `castle` -> `wildpc`: CLI command, module names (wildpc_core/cli/api), dist names, entry point `wildpc = wildpc_cli.main:main`. - Identifiers: CastleConfig/NATSClient/DirError/MDNS -> Wildpc*. - Env/constants: CASTLE_* -> WILDPC_*; ~/.castle -> ~/.wildpc, castle.yaml -> wildpc.yaml, /data/castle -> /data/wildpc. - Systemd UNIT_PREFIX castle- -> wildpc-; own programs castle-api/gateway/etc. - Display prose "Castle" -> "Wild PC" in docs, agent-guide files, README, frontend. - Package dirs and bootstrap yaml renamed via git mv; lockfiles regenerated; redundant nested uv.lock files dropped (workspace root lock is authoritative). Tests: core 273, cli 47, wildpc-api 120 all pass. Frontend type-checks + builds. Fixed a stale test fixture (secret_env_path kind arg) broken pre-rename.
66 lines
2.4 KiB
Python
66 lines
2.4 KiB
Python
"""Tests for the apply-time unresolved-secret gate.
|
|
|
|
`wildpc apply` must refuse to converge a deployment whose ``${secret:NAME}`` env
|
|
references the active backend can't resolve — otherwise the value silently
|
|
degrades to a ``<MISSING_SECRET:NAME>`` placeholder and the service starts with a
|
|
bogus credential (the immich-DB-password-to-the-wrong-backend failure).
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
from pathlib import Path
|
|
from types import SimpleNamespace
|
|
|
|
import pytest
|
|
|
|
from wildpc_core.deploy import _unresolved_secrets
|
|
|
|
|
|
def _spec(env: dict[str, str], enabled: bool = True) -> SimpleNamespace:
|
|
return SimpleNamespace(enabled=enabled, defaults=SimpleNamespace(env=env))
|
|
|
|
|
|
@pytest.fixture
|
|
def file_backend(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> Path:
|
|
"""Force the active backend to a temp file store with a known secret."""
|
|
secrets = tmp_path / "secrets"
|
|
secrets.mkdir()
|
|
(secrets / "PRESENT").write_text("value\n")
|
|
monkeypatch.setenv("WILDPC_SECRET_BACKEND", "file")
|
|
monkeypatch.setattr("wildpc_core.config.SECRETS_DIR", secrets)
|
|
return secrets
|
|
|
|
|
|
def test_all_resolved_returns_empty(file_backend: Path) -> None:
|
|
items = [("service", "svc", _spec({"TOKEN": "${secret:PRESENT}"}))]
|
|
assert _unresolved_secrets(items) == []
|
|
|
|
|
|
def test_missing_secret_is_reported(file_backend: Path) -> None:
|
|
items = [("service", "svc", _spec({"TOKEN": "${secret:ABSENT}"}))]
|
|
assert _unresolved_secrets(items) == [("svc", ["ABSENT"])]
|
|
|
|
|
|
def test_disabled_deployment_skipped(file_backend: Path) -> None:
|
|
items = [("service", "svc", _spec({"TOKEN": "${secret:ABSENT}"}, enabled=False))]
|
|
assert _unresolved_secrets(items) == []
|
|
|
|
|
|
def test_non_secret_placeholders_ignored(file_backend: Path) -> None:
|
|
items = [("service", "svc", _spec({"PORT": "${port}", "DIR": "${data_dir}"}))]
|
|
assert _unresolved_secrets(items) == []
|
|
|
|
|
|
def test_composite_value_partial_missing(file_backend: Path) -> None:
|
|
# A URL mixing a present and an absent secret still flags the absent one.
|
|
env = {"URL": "postgres://u:${secret:PRESENT}@h/db?k=${secret:ABSENT}"}
|
|
assert _unresolved_secrets([("service", "svc", _spec(env))]) == [("svc", ["ABSENT"])]
|
|
|
|
|
|
def test_multiple_deployments_only_broken_flagged(file_backend: Path) -> None:
|
|
items = [
|
|
("service", "ok", _spec({"T": "${secret:PRESENT}"})),
|
|
("service", "bad", _spec({"T": "${secret:ABSENT}"})),
|
|
]
|
|
assert _unresolved_secrets(items) == [("bad", ["ABSENT"])]
|