| ... | ... | @@ -4,6 +4,7 @@ import json |
| 4 | 4 | import os |
| 5 | 5 | from pathlib import Path |
| 6 | 6 | import subprocess |
| 7 | import shutil |
| 7 | 8 | import tempfile |
| 8 | 9 | import unittest |
| 9 | 10 | import uuid |
| ... | ... | @@ -58,36 +59,9 @@ class DeploymentBoundary(unittest.TestCase): |
| 58 | 59 | def call(self, operation, **kwargs): |
| 59 | 60 | return self.host.handle({"operation": operation, **kwargs}) |
| 60 | 61 | |
| 61 | | def test_iam_requests_are_bounded_before_any_worker_starts(self): |
| 62 | | user = "/users/" + str(uuid.uuid4()) |
| 63 | | bad = [ |
| 64 | | ("/clients", "GET", None), ("/roles", "POST", {}), |
| 65 | | ("/users?username=fixture&exact=true&first=0", "GET", None), |
| 66 | | ("/users?username=fixture&exact=true&exact=true", "GET", None), |
| 67 | | (user + "/../../clients", "GET", None), (user + "/users", "POST", {}), |
| 68 | | (user, "PUT", {"realmRoles": ["admin"]}), |
| 69 | | (user, "PUT", {"attributes": {"admin": ["true"]}}), |
| 70 | | (user + "/role-mappings/realm", "POST", [{"id": "fixture", "name": "admin"}]), |
| 71 | | (user + "/role-mappings/realm", "POST", [{"id": "fixture", "name": []}]), |
| 72 | | (user + "/reset-password", "PUT", {"type": "password", "value": "password", "temporary": 1}), |
| 73 | | (user + "/execute-actions-email", "PUT", ["arbitrary"]), |
| 74 | | (user + "/logout", "POST", {"redirect": "https://elsewhere.invalid"}), |
| 75 | | ] |
| 76 | | with patch.object(runs.subprocess, "run") as process: |
| 77 | | for path, method, body in bad: |
| 78 | | with self.subTest(path=path), self.assertRaises(runs.Error): |
| 79 | | self.call("iam.request", path=path, method=method, body=body) |
| 80 | | for operation in ["get", "set", "rotate"]: |
| 81 | | fields = {"service": "keycloak", "key": "password"} |
| 82 | | if operation == "set": |
| 83 | | fields["value"] = "known-password" |
| 84 | | with self.assertRaises(runs.Error) as denied: |
| 85 | | self.call("deploy.secret." + operation, **fields) |
| 86 | | self.assertEqual(denied.exception.status, 403) |
| 87 | | process.assert_not_called() |
| 88 | | |
| 89 | 62 | def test_requests_cannot_select_commands_paths_or_environment(self): |
| 90 | | requests = [{"operation": "deploy.start", "action": "destroy", "target": self.stage, "argv": ["sh"]}, |
| 63 | requests = [{"operation": "iam.request", "path": "/users", "method": "GET", "body": None}, |
| 64 | {"operation": "deploy.start", "action": "destroy", "target": self.stage, "argv": ["sh"]}, |
| 91 | 65 | {"operation": "deploy.start", "action": "deploy", "target": self.version, "env": {"PATH": "/tmp"}}, |
| 92 | 66 | {"operation": "deploy.release", "release": "../private"}, |
| 93 | 67 | {"operation": "deploy.run", "id": "../../nomad.token"}, |
| ... | ... | @@ -113,6 +87,19 @@ class DeploymentBoundary(unittest.TestCase): |
| 113 | 87 | with self.subTest(action=action), self.assertRaisesRegex(ValueError, "contents changed"): |
| 114 | 88 | runs.command(action, target) |
| 115 | 89 | |
| 90 | def test_destroy_verifies_releases_from_before_guest_sources_were_added(self): |
| 91 | with patch.object(release, "SOURCES", tuple(name for name in release.SOURCES if name != "guest")): |
| 92 | digest = release.tree_digest(self.snapshot) |
| 93 | shutil.rmtree(self.snapshot / "guest") |
| 94 | manifest = self.snapshot / ".studio-release.json" |
| 95 | details = json.loads(manifest.read_text()) |
| 96 | details["digest"] = digest |
| 97 | manifest.write_text(json.dumps(details)) |
| 98 | self.assertEqual(runs.command("destroy", self.stage)[1:], [str(self.snapshot / "tools/studio.py"), "destroy", self.stage]) |
| 99 | shutil.rmtree(self.snapshot / "tools") |
| 100 | with self.assertRaisesRegex(ValueError, "contents changed"): |
| 101 | runs.command("destroy", self.stage) |
| 102 | |
| 116 | 103 | def test_service_control_is_limited_to_managed_names(self): |
| 117 | 104 | self.assertEqual(self.call("deploy.managed"), ["fixture"]) |
| 118 | 105 | for action in ["start", "stop", "restart"]: |
clover caruso <git@paperclover.net> 2026-10-08 10:54:44-07:00