Paul Payne
317232ca6a
Replace the conflated `runner` axis with two orthogonal ones: `manager`
(systemd|caddy|path|none) — who supervises/realizes a deployment — and, for
systemd only, a nested `launcher` (python|command|container|compose|node) — how
the process starts. ServiceSpec and JobSpec collapse into one manager-
discriminated DeploymentSpec union (Systemd/Caddy/Path/Remote); the services/
and jobs/ config dirs collapse into one deployments/ dir. The human "kind"
(service|job|tool|static|reference) is fully derived (kind_for), never stored —
the frontend kind is renamed static. behavior is gone.
- core: DeploymentSpec union + LaunchSpec + kind_for; legacy-aware loader
normalizes old runner shapes; CastleConfig.deployments with derived
services/jobs/tools views; registry.Deployment carries manager/launcher/kind.
- cli: service/job/tool as filtered views + a deployment group; --behavior→--kind,
create --runner→--launcher; lifecycle dispatches over config.deployments.
- castle-api: /deployments primary with /services,/jobs as views; summaries
derive kind; PUT/DELETE /config/deployments/{name} (services/jobs aliased).
- app: KindBadge, frontend→static everywhere, pick-a-kind creation wizard,
per-kind config editors.
- docs: single deployments/ layout, manager/launcher, static kind throughout.
Live migration verified byte-identical: regenerated Caddyfile and every unit
ExecStart line unchanged, so nothing restarted. Suites: core 124, cli 25,
castle-api 55; dashboard build + type-check clean.
88 lines
3.0 KiB
Python
88 lines
3.0 KiB
Python
"""Tests for the generated secret env file and its registry visibility."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import stat
|
|
from pathlib import Path
|
|
|
|
import pytest
|
|
|
|
import castle_core.deploy as deploy
|
|
from castle_core.registry import (
|
|
Deployment,
|
|
NodeConfig,
|
|
NodeRegistry,
|
|
load_registry,
|
|
save_registry,
|
|
)
|
|
|
|
|
|
@pytest.fixture
|
|
def secret_env_dir(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> Path:
|
|
"""Redirect the secret-env file location into a temp dir."""
|
|
d = tmp_path / "secrets" / "env"
|
|
monkeypatch.setattr(deploy, "SECRET_ENV_DIR", d)
|
|
monkeypatch.setattr(
|
|
deploy, "secret_env_path", lambda name: d / f"castle-{name}.service.env"
|
|
)
|
|
return d
|
|
|
|
|
|
class TestWriteSecretEnvFile:
|
|
def test_writes_mode_0600_in_0700_dir(self, secret_env_dir: Path) -> None:
|
|
path = deploy._write_secret_env_file("svc", {"API_KEY": "sk-123"})
|
|
assert path is not None and path.exists()
|
|
assert stat.S_IMODE(path.stat().st_mode) == 0o600
|
|
assert stat.S_IMODE(secret_env_dir.stat().st_mode) == 0o700
|
|
|
|
def test_content_format(self, secret_env_dir: Path) -> None:
|
|
path = deploy._write_secret_env_file(
|
|
"svc", {"A": "1", "NEO4J_AUTH": "neo4j/pw"}
|
|
)
|
|
assert path is not None
|
|
assert path.read_text() == "A=1\nNEO4J_AUTH=neo4j/pw\n"
|
|
|
|
def test_empty_unlinks_and_returns_none(self, secret_env_dir: Path) -> None:
|
|
path = deploy.secret_env_path("svc")
|
|
secret_env_dir.mkdir(parents=True)
|
|
path.write_text("STALE=1\n")
|
|
result = deploy._write_secret_env_file("svc", {})
|
|
assert result is None
|
|
assert not path.exists()
|
|
|
|
def test_rewrite_truncates_and_fixes_mode(self, secret_env_dir: Path) -> None:
|
|
deploy._write_secret_env_file("svc", {"A": "old", "B": "x"})
|
|
path = deploy._write_secret_env_file("svc", {"A": "new"})
|
|
assert path is not None
|
|
assert path.read_text() == "A=new\n"
|
|
assert stat.S_IMODE(path.stat().st_mode) == 0o600
|
|
|
|
|
|
class TestRegistrySecretKeys:
|
|
def test_round_trip_persists_keys_only(self, tmp_path: Path) -> None:
|
|
reg_path = tmp_path / "registry.yaml"
|
|
registry = NodeRegistry(
|
|
node=NodeConfig(hostname="h"),
|
|
deployed={
|
|
"svc": Deployment(
|
|
manager="systemd", launcher="container",
|
|
run_cmd=["docker", "run"],
|
|
env={"PORT": "9001"},
|
|
secret_env_keys=["ANTHROPIC_API_KEY", "OPENAI_API_KEY"],
|
|
managed=True,
|
|
)
|
|
},
|
|
)
|
|
save_registry(registry, reg_path)
|
|
|
|
text = reg_path.read_text()
|
|
assert "ANTHROPIC_API_KEY" in text # names are fine
|
|
assert "sk-ant" not in text # but no values ever
|
|
|
|
loaded = load_registry(reg_path)
|
|
assert loaded.deployed["svc"].secret_env_keys == [
|
|
"ANTHROPIC_API_KEY",
|
|
"OPENAI_API_KEY",
|
|
]
|
|
assert loaded.deployed["svc"].env == {"PORT": "9001"}
|