252 lines
10 KiB
Python
252 lines
10 KiB
Python
"""Tests for the Chronos cron-fire webhook ON THE DASHBOARD APP (web_server).
|
|
|
|
Regression guard for the relocation bug: the fire webhook MUST live on the
|
|
dashboard FastAPI app (`hermes_cli.web_server.app`) — the agent's public HTTP
|
|
surface on hosted deployments — not only on the aiohttp APIServerAdapter (which
|
|
hosted agents don't expose). It must:
|
|
- be a registered route on the dashboard app,
|
|
- be in PUBLIC_API_PATHS so the dashboard cookie gate doesn't 401 it before
|
|
the JWT verifier runs,
|
|
- reject a bad/missing NAS-JWT with 401 (the JWT is the real gate),
|
|
- 400 on missing job_id,
|
|
- on a valid token, resolve the job's profile and run fire_due in the
|
|
background, returning 202.
|
|
"""
|
|
|
|
import pytest
|
|
from starlette.testclient import TestClient
|
|
|
|
from hermes_cli import web_server
|
|
from hermes_cli.dashboard_auth.public_paths import PUBLIC_API_PATHS
|
|
|
|
|
|
def _client(auth_required: bool):
|
|
prev_auth = getattr(web_server.app.state, "auth_required", None)
|
|
prev_host = getattr(web_server.app.state, "bound_host", None)
|
|
web_server.app.state.auth_required = auth_required
|
|
web_server.app.state.bound_host = None
|
|
client = TestClient(web_server.app)
|
|
return client, prev_auth, prev_host
|
|
|
|
|
|
def _restore(prev_auth, prev_host):
|
|
if prev_auth is None:
|
|
if hasattr(web_server.app.state, "auth_required"):
|
|
delattr(web_server.app.state, "auth_required")
|
|
else:
|
|
web_server.app.state.auth_required = prev_auth
|
|
if prev_host is None:
|
|
if hasattr(web_server.app.state, "bound_host"):
|
|
delattr(web_server.app.state, "bound_host")
|
|
else:
|
|
web_server.app.state.bound_host = prev_host
|
|
|
|
|
|
|
|
|
|
def test_fire_path_is_public():
|
|
"""Must bypass the dashboard cookie gate so the NAS bearer-JWT callback
|
|
reaches the verifier (the JWT is the real auth)."""
|
|
assert "/api/cron/fire" in PUBLIC_API_PATHS
|
|
|
|
|
|
def test_bad_token_401(monkeypatch):
|
|
"""Invalid NAS-JWT -> 401, even with the dashboard auth gate ENGAGED
|
|
(proves the route is reachable past the cookie gate and the verifier is the
|
|
gate). fire_due must NOT run."""
|
|
fired = []
|
|
monkeypatch.setattr(
|
|
"plugins.cron_providers.chronos.verify.get_fire_verifier",
|
|
lambda: (lambda **kw: None), # verification fails
|
|
)
|
|
monkeypatch.setattr(web_server, "_find_cron_job_profile", lambda jid: "default")
|
|
monkeypatch.setattr(web_server, "_fire_cron_job_for_profile",
|
|
lambda p, j: fired.append((p, j)))
|
|
|
|
client, pa, ph = _client(auth_required=True)
|
|
try:
|
|
resp = client.post("/api/cron/fire",
|
|
headers={"Authorization": "Bearer forged"},
|
|
json={"job_id": "abc"})
|
|
assert resp.status_code == 401
|
|
assert fired == []
|
|
finally:
|
|
_restore(pa, ph)
|
|
client.close()
|
|
|
|
|
|
def test_missing_job_id_400(monkeypatch):
|
|
monkeypatch.setattr(
|
|
"plugins.cron_providers.chronos.verify.get_fire_verifier",
|
|
lambda: (lambda **kw: {"purpose": "cron_fire"}),
|
|
)
|
|
client, pa, ph = _client(auth_required=False)
|
|
try:
|
|
resp = client.post("/api/cron/fire",
|
|
headers={"Authorization": "Bearer good"},
|
|
json={})
|
|
assert resp.status_code == 400
|
|
finally:
|
|
_restore(pa, ph)
|
|
client.close()
|
|
|
|
|
|
def test_unknown_job_200_gone(monkeypatch):
|
|
"""Valid token but the job isn't found in any profile -> 200 'gone'
|
|
(NAS shouldn't retry a fire for a cancelled/completed job)."""
|
|
monkeypatch.setattr(
|
|
"plugins.cron_providers.chronos.verify.get_fire_verifier",
|
|
lambda: (lambda **kw: {"purpose": "cron_fire"}),
|
|
)
|
|
monkeypatch.setattr(web_server, "_find_cron_job_profile", lambda jid: None)
|
|
client, pa, ph = _client(auth_required=False)
|
|
try:
|
|
resp = client.post("/api/cron/fire",
|
|
headers={"Authorization": "Bearer good"},
|
|
json={"job_id": "ghost"})
|
|
assert resp.status_code == 200
|
|
assert resp.json().get("status") == "gone"
|
|
finally:
|
|
_restore(pa, ph)
|
|
client.close()
|
|
|
|
|
|
def test_valid_fire_forwards_to_gateway(monkeypatch):
|
|
"""The dashboard is the public door only: a verified fire is FORWARDED to
|
|
the gateway api_server (which owns the live adapters — relay/E2EE
|
|
delivery), with the NAS bearer preserved, and the gateway's response is
|
|
passed through. The deprecated in-dashboard execution must NOT run."""
|
|
forwarded = []
|
|
executed = []
|
|
|
|
async def fake_forward(profile, job_id, authorization):
|
|
forwarded.append((profile, job_id, authorization))
|
|
return 202, {"status": "accepted", "job_id": job_id}
|
|
|
|
monkeypatch.setattr(
|
|
"plugins.cron_providers.chronos.verify.get_fire_verifier",
|
|
lambda: (lambda **kw: {"purpose": "cron_fire"}),
|
|
)
|
|
monkeypatch.setattr(web_server, "_find_cron_job_profile", lambda jid: "default")
|
|
monkeypatch.setattr(web_server, "_forward_cron_fire_to_gateway", fake_forward)
|
|
monkeypatch.setattr(web_server, "_fire_cron_job_for_profile",
|
|
lambda p, j: executed.append((p, j)))
|
|
|
|
client, pa, ph = _client(auth_required=False)
|
|
try:
|
|
resp = client.post("/api/cron/fire",
|
|
headers={"Authorization": "Bearer nas-jwt"},
|
|
json={"job_id": "j1"})
|
|
assert resp.status_code == 202
|
|
assert resp.json().get("status") == "accepted"
|
|
assert forwarded == [("default", "j1", "Bearer nas-jwt")]
|
|
assert executed == [] # no local execution — gateway owns cron
|
|
finally:
|
|
_restore(pa, ph)
|
|
client.close()
|
|
|
|
|
|
def test_gateway_unreachable_503_for_nas_retry(monkeypatch):
|
|
"""Gateway down (scale-to-zero wake window / restart) -> 503 so NAS
|
|
retries per the Chronos contract. Deliberately NO local-execution
|
|
fallback — delivering from the dashboard process cannot serve
|
|
relay-fronted or E2EE targets."""
|
|
executed = []
|
|
|
|
async def fake_forward(profile, job_id, authorization):
|
|
return None # unreachable
|
|
|
|
monkeypatch.setattr(
|
|
"plugins.cron_providers.chronos.verify.get_fire_verifier",
|
|
lambda: (lambda **kw: {"purpose": "cron_fire"}),
|
|
)
|
|
monkeypatch.setattr(web_server, "_find_cron_job_profile", lambda jid: "default")
|
|
monkeypatch.setattr(web_server, "_forward_cron_fire_to_gateway", fake_forward)
|
|
monkeypatch.setattr(web_server, "_fire_cron_job_for_profile",
|
|
lambda p, j: executed.append((p, j)))
|
|
|
|
client, pa, ph = _client(auth_required=False)
|
|
try:
|
|
resp = client.post("/api/cron/fire",
|
|
headers={"Authorization": "Bearer nas-jwt"},
|
|
json={"job_id": "j2"})
|
|
assert resp.status_code == 503
|
|
assert executed == []
|
|
finally:
|
|
_restore(pa, ph)
|
|
client.close()
|
|
|
|
|
|
def test_gateway_error_status_passes_through(monkeypatch):
|
|
"""A non-2xx gateway response (e.g. its own 401 on a replayed JWT) passes
|
|
through unchanged — the dashboard adds no interpretation of its own."""
|
|
|
|
async def fake_forward(profile, job_id, authorization):
|
|
return 401, {"error": "invalid fire token"}
|
|
|
|
monkeypatch.setattr(
|
|
"plugins.cron_providers.chronos.verify.get_fire_verifier",
|
|
lambda: (lambda **kw: {"purpose": "cron_fire"}),
|
|
)
|
|
monkeypatch.setattr(web_server, "_find_cron_job_profile", lambda jid: "default")
|
|
monkeypatch.setattr(web_server, "_forward_cron_fire_to_gateway", fake_forward)
|
|
|
|
client, pa, ph = _client(auth_required=False)
|
|
try:
|
|
resp = client.post("/api/cron/fire",
|
|
headers={"Authorization": "Bearer nas-jwt"},
|
|
json={"job_id": "j3"})
|
|
assert resp.status_code == 401
|
|
finally:
|
|
_restore(pa, ph)
|
|
client.close()
|
|
|
|
|
|
# ── _gateway_fire_endpoint URL resolution ────────────────────────────────
|
|
|
|
|
|
def test_fire_endpoint_default_port(tmp_path, monkeypatch):
|
|
monkeypatch.delenv("API_SERVER_PORT", raising=False)
|
|
monkeypatch.delenv("GATEWAY_MULTIPLEX_PROFILES", raising=False)
|
|
monkeypatch.setattr(web_server, "load_config", lambda: {})
|
|
url = web_server._gateway_fire_endpoint("default", tmp_path)
|
|
assert url == "http://127.0.0.1:8642/api/cron/fire"
|
|
|
|
|
|
def test_fire_endpoint_config_yaml_port_wins(tmp_path, monkeypatch):
|
|
"""The profile config.yaml port (read via the CANONICAL load_config, per
|
|
the config-read guard) wins over the process env API_SERVER_PORT."""
|
|
monkeypatch.setenv("API_SERVER_PORT", "9999")
|
|
monkeypatch.delenv("GATEWAY_MULTIPLEX_PROFILES", raising=False)
|
|
monkeypatch.setattr(
|
|
web_server,
|
|
"load_config",
|
|
lambda: {"platforms": {"api_server": {"extra": {"port": 8700}}}},
|
|
)
|
|
url = web_server._gateway_fire_endpoint("default", tmp_path)
|
|
assert url == "http://127.0.0.1:8700/api/cron/fire"
|
|
|
|
|
|
def test_fire_endpoint_profile_env_port(tmp_path, monkeypatch):
|
|
"""A non-default profile reads API_SERVER_PORT from its own .env, not the
|
|
dashboard process env (per-profile-gateway topology)."""
|
|
monkeypatch.setenv("API_SERVER_PORT", "9999") # dashboard process env
|
|
monkeypatch.delenv("GATEWAY_MULTIPLEX_PROFILES", raising=False)
|
|
monkeypatch.setattr(web_server, "load_config", lambda: {})
|
|
monkeypatch.setattr(web_server, "_cron_default_profile", lambda: "default")
|
|
(tmp_path / ".env").write_text("API_SERVER_PORT=8701\n", encoding="utf-8")
|
|
url = web_server._gateway_fire_endpoint("worker_alpha", tmp_path)
|
|
assert url == "http://127.0.0.1:8701/api/cron/fire"
|
|
|
|
|
|
def test_fire_endpoint_multiplex_profile_prefix(tmp_path, monkeypatch):
|
|
"""Multiplex mode: a non-default profile routes through the default
|
|
gateway's port with the /p/<profile>/ prefix mirror."""
|
|
monkeypatch.delenv("API_SERVER_PORT", raising=False)
|
|
monkeypatch.setenv("GATEWAY_MULTIPLEX_PROFILES", "1")
|
|
monkeypatch.setattr(web_server, "load_config", lambda: {})
|
|
url = web_server._gateway_fire_endpoint("worker_alpha", tmp_path)
|
|
assert url == "http://127.0.0.1:8642/p/worker_alpha/api/cron/fire"
|
|
|
|
|