Paul Payne
05b28cb584
Repo-side rename only (Phases 1-3 of the migration plan); the live box (~/.castle, systemd units, /data/castle, domains) is a separate cutover. - Slug `castle` -> `wildpc`: CLI command, module names (wildpc_core/cli/api), dist names, entry point `wildpc = wildpc_cli.main:main`. - Identifiers: CastleConfig/NATSClient/DirError/MDNS -> Wildpc*. - Env/constants: CASTLE_* -> WILDPC_*; ~/.castle -> ~/.wildpc, castle.yaml -> wildpc.yaml, /data/castle -> /data/wildpc. - Systemd UNIT_PREFIX castle- -> wildpc-; own programs castle-api/gateway/etc. - Display prose "Castle" -> "Wild PC" in docs, agent-guide files, README, frontend. - Package dirs and bootstrap yaml renamed via git mv; lockfiles regenerated; redundant nested uv.lock files dropped (workspace root lock is authoritative). Tests: core 273, cli 47, wildpc-api 120 all pass. Frontend type-checks + builds. Fixed a stale test fixture (secret_env_path kind arg) broken pre-rename.
487 lines
19 KiB
Python
487 lines
19 KiB
Python
"""Tests for wildpc configuration loading."""
|
|
|
|
from __future__ import annotations
|
|
|
|
from pathlib import Path
|
|
|
|
import pytest
|
|
import yaml
|
|
from wildpc_core.config import (
|
|
WildpcConfig,
|
|
load_config,
|
|
resolve_env_split,
|
|
resolve_env_vars,
|
|
save_config,
|
|
secret_refs,
|
|
)
|
|
from wildpc_core.manifest import ProgramSpec, SystemdDeployment
|
|
|
|
|
|
class TestLoadConfig:
|
|
"""Tests for loading wildpc.yaml."""
|
|
|
|
def test_load_basic(self, wildpc_root: Path) -> None:
|
|
"""Load a wildpc.yaml with three sections."""
|
|
config = load_config(wildpc_root)
|
|
assert isinstance(config, WildpcConfig)
|
|
assert config.gateway.port == 18000
|
|
assert "test-tool" in config.programs
|
|
assert "test-svc" in config.services
|
|
assert "test-job" in config.jobs
|
|
|
|
def test_load_produces_typed_specs(self, wildpc_root: Path) -> None:
|
|
"""Each section produces the correct spec type."""
|
|
config = load_config(wildpc_root)
|
|
assert isinstance(config.programs["test-tool"], ProgramSpec)
|
|
# Both a service and a job are systemd deployments; the kind (service/job)
|
|
# is derived from whether a schedule is present.
|
|
assert isinstance(config.services["test-svc"], SystemdDeployment)
|
|
assert isinstance(config.jobs["test-job"], SystemdDeployment)
|
|
|
|
def test_service_expose(self, wildpc_root: Path) -> None:
|
|
"""Service has correct expose spec."""
|
|
config = load_config(wildpc_root)
|
|
svc = config.services["test-svc"]
|
|
assert svc.expose.http.internal.port == 19000
|
|
assert svc.expose.http.health_path == "/health"
|
|
|
|
def test_service_proxy(self, wildpc_root: Path) -> None:
|
|
"""Service has correct proxy spec."""
|
|
config = load_config(wildpc_root)
|
|
svc = config.services["test-svc"]
|
|
assert svc.proxy is True # exposed at <name>.<gateway.domain>
|
|
|
|
def test_service_run_spec(self, wildpc_root: Path) -> None:
|
|
"""Service has correct launch spec (legacy runner normalized to launcher)."""
|
|
config = load_config(wildpc_root)
|
|
svc = config.services["test-svc"]
|
|
assert svc.run.launcher == "python"
|
|
assert svc.run.program == "test-svc"
|
|
|
|
def test_service_component_ref(self, wildpc_root: Path) -> None:
|
|
"""Service references a component."""
|
|
config = load_config(wildpc_root)
|
|
svc = config.services["test-svc"]
|
|
assert svc.program == "test-svc-comp"
|
|
|
|
def test_job_schedule(self, wildpc_root: Path) -> None:
|
|
"""Job has correct schedule."""
|
|
config = load_config(wildpc_root)
|
|
job = config.jobs["test-job"]
|
|
assert job.schedule == "0 2 * * *"
|
|
|
|
def test_tools_property(self, wildpc_root: Path) -> None:
|
|
"""Tools property filters to components with install.path or tool."""
|
|
config = load_config(wildpc_root)
|
|
assert "test-tool" in config.tools
|
|
|
|
def test_missing_config_raises(self, tmp_path: Path) -> None:
|
|
"""Missing wildpc.yaml raises FileNotFoundError."""
|
|
with pytest.raises(FileNotFoundError):
|
|
load_config(tmp_path)
|
|
|
|
|
|
class TestSaveConfig:
|
|
"""Tests for saving wildpc.yaml."""
|
|
|
|
def test_round_trip(self, wildpc_root: Path) -> None:
|
|
"""Load and save should produce equivalent config."""
|
|
config = load_config(wildpc_root)
|
|
save_config(config)
|
|
config2 = load_config(wildpc_root)
|
|
|
|
assert config2.gateway.port == config.gateway.port
|
|
assert set(config2.programs.keys()) == set(config.programs.keys())
|
|
assert set(config2.services.keys()) == set(config.services.keys())
|
|
assert set(config2.jobs.keys()) == set(config.jobs.keys())
|
|
|
|
def test_save_adds_component(self, wildpc_root: Path) -> None:
|
|
"""Adding a component and saving persists it."""
|
|
config = load_config(wildpc_root)
|
|
config.programs["new-lib"] = ProgramSpec(
|
|
id="new-lib", description="A new library"
|
|
)
|
|
save_config(config)
|
|
|
|
config2 = load_config(wildpc_root)
|
|
assert "new-lib" in config2.programs
|
|
assert config2.programs["new-lib"].description == "A new library"
|
|
|
|
def test_preserves_manage_systemd(self, wildpc_root: Path) -> None:
|
|
"""Roundtrip preserves manage.systemd even with all defaults."""
|
|
config = load_config(wildpc_root)
|
|
save_config(config)
|
|
config2 = load_config(wildpc_root)
|
|
svc = config2.services["test-svc"]
|
|
assert svc.manage is not None
|
|
assert svc.manage.systemd is not None
|
|
|
|
def test_writes_directory_layout(self, wildpc_root: Path) -> None:
|
|
"""Save writes one file per resource under programs/ and one deployments/ dir."""
|
|
config = load_config(wildpc_root)
|
|
save_config(config)
|
|
assert (wildpc_root / "programs" / "test-tool.yaml").exists()
|
|
# Deployments live under per-kind subdirs (deployments/<store>/<name>.yaml).
|
|
assert (wildpc_root / "deployments" / "services" / "test-svc.yaml").exists()
|
|
assert (wildpc_root / "deployments" / "jobs" / "test-job.yaml").exists()
|
|
assert (wildpc_root / "deployments" / "tools" / "test-tool.yaml").exists()
|
|
# Global file holds gateway only, no resource sections
|
|
global_data = yaml.safe_load((wildpc_root / "wildpc.yaml").read_text())
|
|
assert global_data["gateway"]["port"] == 18000
|
|
assert "programs" not in global_data
|
|
assert "deployments" not in global_data
|
|
|
|
def test_delete_prunes_file(self, wildpc_root: Path) -> None:
|
|
"""Removing a deployment and saving deletes its on-disk file."""
|
|
config = load_config(wildpc_root)
|
|
del config.services["test-svc"]
|
|
save_config(config)
|
|
assert not (wildpc_root / "deployments" / "services" / "test-svc.yaml").exists()
|
|
config2 = load_config(wildpc_root)
|
|
assert "test-svc" not in config2.services
|
|
assert "test-tool" in config2.programs
|
|
|
|
|
|
class TestResolveEnvVars:
|
|
"""Tests for environment variable resolution."""
|
|
|
|
def test_no_vars(self) -> None:
|
|
"""Plain values pass through unchanged."""
|
|
env = {"MY_VAR": "plain_value"}
|
|
resolved = resolve_env_vars(env)
|
|
assert resolved["MY_VAR"] == "plain_value"
|
|
|
|
def test_unrecognized_vars_preserved(self) -> None:
|
|
"""Non-secret ${} references pass through unchanged."""
|
|
env = {"MY_VAR": "${unknown_var}"}
|
|
resolved = resolve_env_vars(env)
|
|
assert resolved["MY_VAR"] == "${unknown_var}"
|
|
|
|
def test_resolve_secret(
|
|
self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
|
|
) -> None:
|
|
"""${secret:NAME} resolves from secrets directory."""
|
|
secrets_dir = tmp_path / "secrets"
|
|
secrets_dir.mkdir()
|
|
(secrets_dir / "API_KEY").write_text("my-secret-key\n")
|
|
monkeypatch.setattr("wildpc_core.config.SECRETS_DIR", secrets_dir)
|
|
|
|
env = {"API_KEY": "${secret:API_KEY}"}
|
|
resolved = resolve_env_vars(env)
|
|
assert resolved["API_KEY"] == "my-secret-key"
|
|
|
|
def test_resolve_missing_secret(
|
|
self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
|
|
) -> None:
|
|
"""Missing secret returns placeholder."""
|
|
secrets_dir = tmp_path / "secrets"
|
|
secrets_dir.mkdir()
|
|
monkeypatch.setattr("wildpc_core.config.SECRETS_DIR", secrets_dir)
|
|
|
|
env = {"API_KEY": "${secret:NONEXISTENT}"}
|
|
resolved = resolve_env_vars(env)
|
|
assert resolved["API_KEY"] == "<MISSING_SECRET:NONEXISTENT>"
|
|
|
|
|
|
class TestSecretRefs:
|
|
"""Tests for extracting ${secret:NAME} references (the apply-gate input)."""
|
|
|
|
def test_none_when_no_refs(self) -> None:
|
|
assert secret_refs("plain") == []
|
|
assert secret_refs("${port}/${data_dir}") == []
|
|
|
|
def test_single_and_composite(self) -> None:
|
|
assert secret_refs("${secret:API_KEY}") == ["API_KEY"]
|
|
assert secret_refs("neo4j/${secret:NEO4J_PW}") == ["NEO4J_PW"]
|
|
|
|
def test_multiple_deduped_in_order(self) -> None:
|
|
value = "${secret:A}:${secret:B}:${secret:A}"
|
|
assert secret_refs(value) == ["A", "B"]
|
|
|
|
|
|
class TestResolveEnvSplit:
|
|
"""Tests for the secret/plain partition used to keep secrets out of units."""
|
|
|
|
def _secrets(self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch, **vals: str):
|
|
secrets_dir = tmp_path / "secrets"
|
|
secrets_dir.mkdir()
|
|
for name, val in vals.items():
|
|
(secrets_dir / name).write_text(val + "\n")
|
|
monkeypatch.setattr("wildpc_core.config.SECRETS_DIR", secrets_dir)
|
|
|
|
def test_plain_only(self) -> None:
|
|
plain, secret = resolve_env_split({"PORT": "9001", "URL": "http://x"})
|
|
assert plain == {"PORT": "9001", "URL": "http://x"}
|
|
assert secret == {}
|
|
|
|
def test_context_placeholders_are_plain(self) -> None:
|
|
plain, secret = resolve_env_split(
|
|
{"P": "${port}", "D": "${data_dir}"}, {"port": "9001", "data_dir": "/d"}
|
|
)
|
|
assert plain == {"P": "9001", "D": "/d"}
|
|
assert secret == {}
|
|
|
|
def test_pure_secret_partitioned(
|
|
self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
|
|
) -> None:
|
|
self._secrets(tmp_path, monkeypatch, API_KEY="sk-123")
|
|
plain, secret = resolve_env_split({"API_KEY": "${secret:API_KEY}"})
|
|
assert plain == {}
|
|
assert secret == {"API_KEY": "sk-123"}
|
|
|
|
def test_composite_secret_partitioned(
|
|
self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
|
|
) -> None:
|
|
"""A value embedding a secret is secret-bearing; the whole value resolves."""
|
|
self._secrets(tmp_path, monkeypatch, NEO4J_PASSWORD="pw")
|
|
plain, secret = resolve_env_split(
|
|
{"NEO4J_AUTH": "neo4j/${secret:NEO4J_PASSWORD}"}
|
|
)
|
|
assert plain == {}
|
|
assert secret == {"NEO4J_AUTH": "neo4j/pw"}
|
|
|
|
def test_mixed(self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
|
|
self._secrets(tmp_path, monkeypatch, K="v")
|
|
plain, secret = resolve_env_split(
|
|
{"PORT": "${port}", "K": "${secret:K}"}, {"port": "9001"}
|
|
)
|
|
assert plain == {"PORT": "9001"}
|
|
assert secret == {"K": "v"}
|
|
|
|
def test_missing_secret_still_partitioned(
|
|
self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
|
|
) -> None:
|
|
self._secrets(tmp_path, monkeypatch)
|
|
plain, secret = resolve_env_split({"K": "${secret:NOPE}"})
|
|
assert plain == {}
|
|
assert secret == {"K": "<MISSING_SECRET:NOPE>"}
|
|
|
|
def test_resolve_env_vars_matches_merged_split(
|
|
self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
|
|
) -> None:
|
|
"""The flat wrapper equals the merged split and preserves key order."""
|
|
self._secrets(tmp_path, monkeypatch, K="v")
|
|
env = {"PORT": "${port}", "K": "${secret:K}", "Z": "lit"}
|
|
flat = resolve_env_vars(env, {"port": "9001"})
|
|
assert flat == {"PORT": "9001", "K": "v", "Z": "lit"}
|
|
assert list(flat.keys()) == ["PORT", "K", "Z"]
|
|
|
|
|
|
class TestConfigRoundTrip:
|
|
"""save_config → load_config must preserve every field. A field missing from
|
|
the save path (the `cert_hook` regression) or the serializer silently drops on
|
|
the next write — these lock the full round-trip for the reach/TCP-TLS fields."""
|
|
|
|
def test_gateway_and_tcp_tls_survive_save_load(self, tmp_path: Path) -> None:
|
|
from wildpc_core.config import GatewayConfig
|
|
from wildpc_core.manifest import (
|
|
ExposeSpec,
|
|
Reach,
|
|
RunContainer,
|
|
SystemdDeployment,
|
|
TcpExposeSpec,
|
|
TlsMaterial,
|
|
TlsSpec,
|
|
)
|
|
|
|
pg = SystemdDeployment(
|
|
id="pg",
|
|
manager="systemd",
|
|
program="pg",
|
|
reach=Reach.INTERNAL,
|
|
run=RunContainer(
|
|
launcher="container",
|
|
image="postgres:17",
|
|
user="${uid}:${gid}",
|
|
tmpfs=["/var/run/postgresql"],
|
|
),
|
|
expose=ExposeSpec(
|
|
tcp=TcpExposeSpec(port=5432, tls=TlsSpec(material=TlsMaterial.PAIR))
|
|
),
|
|
)
|
|
config = WildpcConfig(
|
|
root=tmp_path,
|
|
gateway=GatewayConfig(
|
|
port=9000, tls="acme", domain="civil.payne.io", cert_hook=True
|
|
),
|
|
repo=None,
|
|
programs={},
|
|
deployments={"pg": pg},
|
|
)
|
|
save_config(config)
|
|
loaded = load_config(tmp_path)
|
|
|
|
# Gateway: cert_hook must survive (the field that got dropped in prod).
|
|
assert loaded.gateway.cert_hook is True
|
|
assert loaded.gateway.tls == "acme"
|
|
assert loaded.gateway.domain == "civil.payne.io"
|
|
|
|
# Deployment: reach + full TCP/TLS + container user/tmpfs must survive.
|
|
d = loaded.services["pg"]
|
|
assert d.reach == Reach.INTERNAL
|
|
assert d.expose.tcp.port == 5432
|
|
assert d.expose.tcp.tls.material == TlsMaterial.PAIR
|
|
assert d.run.user == "${uid}:${gid}"
|
|
assert d.run.tmpfs == ["/var/run/postgresql"]
|
|
|
|
def test_parse_gateway_preserves_all_fields(self) -> None:
|
|
"""The shared gateway parser must honor every field — `save_yaml` used to
|
|
read only `port`, wiping tls/domain/tunnel/cert_hook on a whole-file save."""
|
|
from wildpc_core.config import parse_gateway
|
|
|
|
g = parse_gateway(
|
|
{
|
|
"port": 9000,
|
|
"tls": "acme",
|
|
"domain": "civil.payne.io",
|
|
"acme_email": "a@b.co",
|
|
"public_domain": "pub.io",
|
|
"tunnel_id": "uuid-123",
|
|
"cert_hook": True,
|
|
}
|
|
)
|
|
assert g.tls == "acme"
|
|
assert g.domain == "civil.payne.io"
|
|
assert g.acme_email == "a@b.co"
|
|
assert g.public_domain == "pub.io"
|
|
assert g.tunnel_id == "uuid-123"
|
|
assert g.cert_hook is True
|
|
|
|
|
|
class TestConfigurableRoots:
|
|
"""data_dir / repos_dir: env > wildpc.yaml > default. The single source of truth
|
|
that keeps the CLI and the api service from resolving different data dirs."""
|
|
|
|
@pytest.fixture(autouse=True)
|
|
def _no_root_env(self, monkeypatch: pytest.MonkeyPatch) -> None:
|
|
# The test host may export WILDPC_DATA_DIR (that's the bug we're fixing);
|
|
# clear it so yaml/default precedence is exercised deterministically.
|
|
monkeypatch.delenv("WILDPC_DATA_DIR", raising=False)
|
|
monkeypatch.delenv("WILDPC_REPOS_DIR", raising=False)
|
|
|
|
def test_resolve_precedence_env_over_yaml(
|
|
self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
|
|
) -> None:
|
|
from wildpc_core.config import _DEFAULT_DATA_DIR, _resolve_root_path
|
|
|
|
monkeypatch.setenv("X_ROOT_ENV", "/from/env")
|
|
p = _resolve_root_path("X_ROOT_ENV", "/from/yaml", tmp_path, _DEFAULT_DATA_DIR)
|
|
assert p == Path("/from/env")
|
|
|
|
def test_resolve_yaml_over_default(self, tmp_path: Path) -> None:
|
|
from wildpc_core.config import _DEFAULT_DATA_DIR, _resolve_root_path
|
|
|
|
p = _resolve_root_path(
|
|
"UNSET_ROOT_ENV", "/from/yaml", tmp_path, _DEFAULT_DATA_DIR
|
|
)
|
|
assert p == Path("/from/yaml")
|
|
|
|
def test_resolve_default_when_neither(self, tmp_path: Path) -> None:
|
|
from wildpc_core.config import _DEFAULT_DATA_DIR, _resolve_root_path
|
|
|
|
p = _resolve_root_path("UNSET_ROOT_ENV", None, tmp_path, _DEFAULT_DATA_DIR)
|
|
assert p == _DEFAULT_DATA_DIR # returned as-is so save_config can compare equal
|
|
|
|
def test_resolve_expanduser(
|
|
self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
|
|
) -> None:
|
|
from wildpc_core.config import _DEFAULT_DATA_DIR, _resolve_root_path
|
|
|
|
monkeypatch.setenv("X_ROOT_ENV", "~/box")
|
|
p = _resolve_root_path("X_ROOT_ENV", None, tmp_path, _DEFAULT_DATA_DIR)
|
|
assert p == (Path.home() / "box").resolve()
|
|
|
|
def test_resolve_relative_anchored_to_anchor_not_cwd(self, tmp_path: Path) -> None:
|
|
"""A relative root is anchored to the dir holding wildpc.yaml — never cwd, or
|
|
the CLI (shell cwd) and api (unit cwd) would diverge again."""
|
|
from wildpc_core.config import _DEFAULT_DATA_DIR, _resolve_root_path
|
|
|
|
p = _resolve_root_path(
|
|
"UNSET_ROOT_ENV", "sub/data", tmp_path, _DEFAULT_DATA_DIR
|
|
)
|
|
assert p == (tmp_path / "sub" / "data").resolve()
|
|
|
|
def test_load_config_reads_data_dir_from_yaml(self, tmp_path: Path) -> None:
|
|
(tmp_path / "wildpc.yaml").write_text(
|
|
yaml.dump({"gateway": {"port": 9000}, "data_dir": "/srv/box/data"})
|
|
)
|
|
config = load_config(tmp_path)
|
|
assert config.data_dir == Path("/srv/box/data")
|
|
|
|
def test_load_config_data_dir_defaults(self, tmp_path: Path) -> None:
|
|
from wildpc_core.config import _DEFAULT_DATA_DIR
|
|
|
|
(tmp_path / "wildpc.yaml").write_text(yaml.dump({"gateway": {"port": 9000}}))
|
|
config = load_config(tmp_path)
|
|
assert config.data_dir == _DEFAULT_DATA_DIR
|
|
|
|
def test_save_round_trips_nondefault_roots(self, tmp_path: Path) -> None:
|
|
from wildpc_core.config import GatewayConfig
|
|
|
|
cfg = WildpcConfig(
|
|
root=tmp_path,
|
|
gateway=GatewayConfig(port=9000),
|
|
repo=None,
|
|
programs={},
|
|
data_dir=Path("/srv/box/data"),
|
|
repos_dir=Path("/srv/box/repos"),
|
|
)
|
|
save_config(cfg)
|
|
text = (tmp_path / "wildpc.yaml").read_text()
|
|
assert "data_dir: /srv/box/data" in text
|
|
assert "repos_dir: /srv/box/repos" in text
|
|
reloaded = load_config(tmp_path)
|
|
assert reloaded.data_dir == Path("/srv/box/data")
|
|
assert reloaded.repos_dir == Path("/srv/box/repos")
|
|
|
|
def test_save_omits_default_roots(self, tmp_path: Path) -> None:
|
|
from wildpc_core.config import (
|
|
_DEFAULT_DATA_DIR,
|
|
_DEFAULT_REPOS_DIR,
|
|
GatewayConfig,
|
|
)
|
|
|
|
cfg = WildpcConfig(
|
|
root=tmp_path,
|
|
gateway=GatewayConfig(port=9000),
|
|
repo=None,
|
|
programs={},
|
|
data_dir=_DEFAULT_DATA_DIR,
|
|
repos_dir=_DEFAULT_REPOS_DIR,
|
|
)
|
|
save_config(cfg)
|
|
text = (tmp_path / "wildpc.yaml").read_text()
|
|
assert "data_dir" not in text
|
|
assert "repos_dir" not in text
|
|
|
|
def test_ensure_dirs_raises_actionable_error(
|
|
self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
|
|
) -> None:
|
|
"""An uncreatable data dir yields a WildpcDirError with a fix, not a bare OSError."""
|
|
import wildpc_core.config as C
|
|
from wildpc_core.config import GatewayConfig
|
|
|
|
# Redirect the in-$HOME dirs to tmp so the test never touches the real ~/.wildpc.
|
|
for name in (
|
|
"WILDPC_HOME",
|
|
"CODE_DIR",
|
|
"SPECS_DIR",
|
|
"CONTENT_DIR",
|
|
"SECRETS_DIR",
|
|
):
|
|
monkeypatch.setattr(C, name, tmp_path / name.lower())
|
|
# data_dir whose parent is a FILE → mkdir raises NotADirectoryError (OSError),
|
|
# deterministically, even if the suite runs as root.
|
|
blocker = tmp_path / "afile"
|
|
blocker.write_text("x")
|
|
cfg = WildpcConfig(
|
|
root=tmp_path,
|
|
gateway=GatewayConfig(port=9000),
|
|
repo=None,
|
|
programs={},
|
|
data_dir=blocker / "sub",
|
|
)
|
|
with pytest.raises(C.WildpcDirError) as ei:
|
|
C.ensure_dirs(cfg)
|
|
assert "data_dir" in str(ei.value)
|