Simone
9d7bbee35d
Stage A: swap CSS tokens to the real Gitea dark palette (accent blue #4183c4); add Jinja formatting filters (humanbytes/duration/relative_time/localtime/shorten_path/thousands), a health status-header, and an inline SVG icon sprite; fix two UI bugs — unthemed action pages (htmx swap into #action-slot with a full-page HX-Request fallback) and polling wiping form input (hx-preserve). Stage B: four read-only panels that degrade to notices (never 500) — host resources (/proc, two-sample CPU%), VMware module health, template inventory (.vmem warn + last backup), and a path-contained file browser; backup card becomes a validated template dropdown; expensive dir-size walk is TTL-cached. Adds operations/inventory.py plus host_resources()/vmware_module_health() in operations/host.py. Stage C: parse_clone_name() adds a Job column (job_id + started) to the VM table; nav gains a Gitea link-out derived from the OIDC issuer origin (no fabricated run URLs); audit page gets action icons, relative time, and a client-side filter. Gates: 989 tests pass, coverage 94.12%, ruff + mypy --strict clean. Stage D (service management) intentionally deferred.
254 lines
9.2 KiB
Python
254 lines
9.2 KiB
Python
"""Tests for the ``[web]`` / ``[web.oidc]`` config section (W3 of the web-UI plan).
|
|
|
|
Contract: ``[web]`` absent means the web UI is disabled by default; secrets
|
|
are NEVER read from TOML — only keyring key *names* (``client_secret_cred``,
|
|
``session_secret_cred``).
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
from pathlib import Path
|
|
|
|
from ci_orchestrator.config import WebConfig, WebOidcConfig, gitea_base_url, load_config
|
|
|
|
|
|
def _paths_section() -> str:
|
|
return (
|
|
'[paths]\nroot = "/var/lib/ci"\ntemplates = "/var/lib/ci/templates"\n'
|
|
'build_vms = "/var/lib/ci/build-vms"\nartifacts = "/var/lib/ci/artifacts"\n'
|
|
'keys = "/var/lib/ci/keys"\n'
|
|
)
|
|
|
|
|
|
def _write_toml(tmp_path: Path, extra: str = "") -> Path:
|
|
toml = tmp_path / "config.toml"
|
|
toml.write_text(_paths_section() + extra, encoding="utf-8")
|
|
return toml
|
|
|
|
|
|
# ── [web] absent ─────────────────────────────────────────────────────────────
|
|
|
|
|
|
def test_web_absent_defaults_to_disabled(tmp_path: Path) -> None:
|
|
cfg = load_config(config_path=_write_toml(tmp_path), env={})
|
|
|
|
assert cfg.web == WebConfig()
|
|
assert cfg.web.enabled is False
|
|
assert cfg.web.oidc is None
|
|
|
|
|
|
def test_web_absent_when_no_toml_file_at_all(tmp_path: Path) -> None:
|
|
# No config file at all -> pure defaults.
|
|
cfg = load_config(config_path=tmp_path / "nope.toml", env={})
|
|
|
|
assert cfg.web.enabled is False
|
|
assert cfg.web.oidc is None
|
|
|
|
|
|
# ── [web] present ────────────────────────────────────────────────────────────
|
|
|
|
|
|
def test_web_section_populates_fields(tmp_path: Path) -> None:
|
|
extra = (
|
|
"\n[web]\n"
|
|
"enabled = true\n"
|
|
'bind_host = "192.168.1.50"\n'
|
|
"bind_port = 9000\n"
|
|
'audit_log = "/var/lib/ci/logs/custom-audit.jsonl"\n'
|
|
'allowed_users = ["simone", "alice"]\n'
|
|
'session_secret_cred = "MySessionCred"\n'
|
|
)
|
|
cfg = load_config(config_path=_write_toml(tmp_path, extra), env={})
|
|
|
|
assert cfg.web.enabled is True
|
|
assert cfg.web.bind_host == "192.168.1.50"
|
|
assert cfg.web.bind_port == 9000
|
|
assert cfg.web.audit_log == Path("/var/lib/ci/logs/custom-audit.jsonl")
|
|
assert cfg.web.allowed_users == ["simone", "alice"]
|
|
assert cfg.web.session_secret_cred == "MySessionCred"
|
|
assert cfg.web.oidc is None
|
|
|
|
|
|
def test_web_section_partial_uses_defaults_for_rest(tmp_path: Path) -> None:
|
|
extra = "\n[web]\nenabled = true\n"
|
|
cfg = load_config(config_path=_write_toml(tmp_path, extra), env={})
|
|
|
|
assert cfg.web.enabled is True
|
|
assert cfg.web.bind_host == "127.0.0.1"
|
|
assert cfg.web.bind_port == 8800
|
|
assert cfg.web.audit_log == Path("/var/lib/ci/logs/web-audit.jsonl")
|
|
assert cfg.web.allowed_users == []
|
|
assert cfg.web.session_secret_cred == "WebSessionSecret"
|
|
|
|
|
|
# ── [web.oidc] ───────────────────────────────────────────────────────────────
|
|
|
|
|
|
def test_web_oidc_section_populates_fields(tmp_path: Path) -> None:
|
|
extra = (
|
|
"\n[web]\nenabled = true\n"
|
|
"\n[web.oidc]\n"
|
|
'issuer = "https://gitea.lan"\n'
|
|
'client_id = "ci-web"\n'
|
|
'redirect_url = "http://192.168.1.50:8800/auth/callback"\n'
|
|
'client_secret_cred = "MyOidcCred"\n'
|
|
'scopes = ["openid", "profile", "email"]\n'
|
|
)
|
|
cfg = load_config(config_path=_write_toml(tmp_path, extra), env={})
|
|
|
|
assert cfg.web.oidc == WebOidcConfig(
|
|
issuer="https://gitea.lan",
|
|
client_id="ci-web",
|
|
redirect_url="http://192.168.1.50:8800/auth/callback",
|
|
client_secret_cred="MyOidcCred",
|
|
scopes=["openid", "profile", "email"],
|
|
)
|
|
|
|
|
|
def test_web_oidc_section_defaults_client_secret_cred_and_scopes(tmp_path: Path) -> None:
|
|
extra = (
|
|
"\n[web.oidc]\n"
|
|
'issuer = "https://gitea.lan"\n'
|
|
'client_id = "ci-web"\n'
|
|
'redirect_url = "http://192.168.1.50:8800/auth/callback"\n'
|
|
)
|
|
cfg = load_config(config_path=_write_toml(tmp_path, extra), env={})
|
|
|
|
assert cfg.web.oidc is not None
|
|
assert cfg.web.oidc.client_secret_cred == "WebOidcClientSecret"
|
|
assert cfg.web.oidc.scopes == ["openid", "profile"]
|
|
|
|
|
|
def test_web_oidc_missing_required_key_yields_none_not_crash(tmp_path: Path) -> None:
|
|
# Missing redirect_url -> oidc must degrade to None, never raise.
|
|
extra = (
|
|
"\n[web.oidc]\n"
|
|
'issuer = "https://gitea.lan"\n'
|
|
'client_id = "ci-web"\n'
|
|
)
|
|
cfg = load_config(config_path=_write_toml(tmp_path, extra), env={})
|
|
|
|
assert cfg.web.oidc is None
|
|
|
|
|
|
def test_web_oidc_empty_section_yields_none(tmp_path: Path) -> None:
|
|
extra = "\n[web.oidc]\n"
|
|
cfg = load_config(config_path=_write_toml(tmp_path, extra), env={})
|
|
|
|
assert cfg.web.oidc is None
|
|
|
|
|
|
# ── security: no secret values ever stored ──────────────────────────────────
|
|
|
|
|
|
def test_no_secret_value_fields_exist_on_web_config() -> None:
|
|
"""Only keyring key *names* are stored -- never a secret value."""
|
|
field_names = set(WebConfig.__dataclass_fields__)
|
|
assert "session_secret" not in field_names
|
|
assert "session_secret_value" not in field_names
|
|
assert "session_secret_cred" in field_names
|
|
|
|
|
|
def test_no_secret_value_fields_exist_on_web_oidc_config() -> None:
|
|
field_names = set(WebOidcConfig.__dataclass_fields__)
|
|
assert "client_secret" not in field_names
|
|
assert "client_secret_value" not in field_names
|
|
assert "client_secret_cred" in field_names
|
|
|
|
|
|
def test_toml_secret_looking_value_is_never_surfaced_as_a_secret(tmp_path: Path) -> None:
|
|
"""Even if a TOML author mistakenly writes a secret-shaped value under
|
|
``client_secret_cred``/``session_secret_cred``, config.py only ever
|
|
treats it as a keyring key *name* -- there is no code path that reads a
|
|
``client_secret``/``session_secret`` key from TOML at all.
|
|
"""
|
|
extra = (
|
|
"\n[web]\nenabled = true\n"
|
|
'session_secret_cred = "sk-not-a-real-secret-just-a-name"\n'
|
|
"\n[web.oidc]\n"
|
|
'issuer = "https://gitea.lan"\n'
|
|
'client_id = "ci-web"\n'
|
|
'redirect_url = "http://192.168.1.50:8800/auth/callback"\n'
|
|
'client_secret_cred = "another-cred-name"\n'
|
|
# If config.py ever started reading these, this test would need to
|
|
# change -- their presence here proves they are ignored.
|
|
'client_secret = "should-never-be-read"\n'
|
|
)
|
|
cfg = load_config(config_path=_write_toml(tmp_path, extra), env={})
|
|
|
|
assert cfg.web.session_secret_cred == "sk-not-a-real-secret-just-a-name"
|
|
assert cfg.web.oidc is not None
|
|
assert cfg.web.oidc.client_secret_cred == "another-cred-name"
|
|
# No attribute on WebOidcConfig can ever hold "should-never-be-read".
|
|
for value in vars(cfg.web.oidc).values():
|
|
assert value != "should-never-be-read"
|
|
|
|
|
|
# ── [web].gitea_url (Stage C2) ───────────────────────────────────────────────
|
|
|
|
|
|
def test_gitea_url_absent_from_toml_defaults_to_none() -> None:
|
|
assert WebConfig().gitea_url is None
|
|
|
|
|
|
def test_gitea_url_explicit_toml_value_populates_field(tmp_path: Path) -> None:
|
|
extra = '\n[web]\ngitea_url = "https://gitea.example.lan"\n'
|
|
cfg = load_config(config_path=_write_toml(tmp_path, extra), env={})
|
|
|
|
assert cfg.web.gitea_url == "https://gitea.example.lan"
|
|
|
|
|
|
def test_gitea_base_url_explicit_override_wins_over_issuer(tmp_path: Path) -> None:
|
|
extra = (
|
|
"\n[web]\n"
|
|
'gitea_url = "https://gitea.explicit.lan"\n'
|
|
"\n[web.oidc]\n"
|
|
'issuer = "https://gitea.emulab.it"\n'
|
|
'client_id = "ci-web"\n'
|
|
'redirect_url = "http://192.168.1.50:8800/auth/callback"\n'
|
|
)
|
|
cfg = load_config(config_path=_write_toml(tmp_path, extra), env={})
|
|
|
|
assert gitea_base_url(cfg.web) == "https://gitea.explicit.lan"
|
|
|
|
|
|
def test_gitea_base_url_derives_origin_from_oidc_issuer(tmp_path: Path) -> None:
|
|
extra = (
|
|
"\n[web.oidc]\n"
|
|
'issuer = "https://gitea.emulab.it"\n'
|
|
'client_id = "ci-web"\n'
|
|
'redirect_url = "http://192.168.1.50:8800/auth/callback"\n'
|
|
)
|
|
cfg = load_config(config_path=_write_toml(tmp_path, extra), env={})
|
|
|
|
assert cfg.web.gitea_url is None # not set explicitly
|
|
assert gitea_base_url(cfg.web) == "https://gitea.emulab.it"
|
|
|
|
|
|
def test_gitea_base_url_strips_issuer_path_and_query() -> None:
|
|
web = WebConfig(
|
|
oidc=WebOidcConfig(
|
|
issuer="https://gitea.emulab.it/some/path?query=1",
|
|
client_id="ci-web",
|
|
redirect_url="http://127.0.0.1:8800/auth/callback",
|
|
)
|
|
)
|
|
|
|
assert gitea_base_url(web) == "https://gitea.emulab.it"
|
|
|
|
|
|
def test_gitea_base_url_none_when_oidc_unset_and_no_explicit_url() -> None:
|
|
assert gitea_base_url(WebConfig()) is None
|
|
|
|
|
|
def test_gitea_base_url_none_when_issuer_unparseable() -> None:
|
|
web = WebConfig(
|
|
oidc=WebOidcConfig(
|
|
issuer="not-a-url",
|
|
client_id="ci-web",
|
|
redirect_url="http://127.0.0.1:8800/auth/callback",
|
|
)
|
|
)
|
|
|
|
assert gitea_base_url(web) is None
|