admin_rb
85 lines
4.4 KiB
Python
85 lines
4.4 KiB
Python
"""Protocol robustness tests against a synthetic command, never a real remote host."""
|
|
from dataclasses import replace
|
|
import json
|
|
import os
|
|
from pathlib import Path
|
|
import sys
|
|
import threading
|
|
import time
|
|
import pytest
|
|
from aim_webgui.core.client import CoreClient
|
|
from aim_webgui.config import Settings
|
|
from aim_webgui.core.protocol import validate_secrets, response_result, COUNTS
|
|
from aim_webgui.errors import WebError
|
|
|
|
@pytest.fixture
|
|
def transport(tmp_path):
|
|
script=tmp_path/'fake.py'
|
|
settings=Settings(core_transport='stdio',core_command=(sys.executable,str(script)),core_config=tmp_path/'core.yml')
|
|
return script,settings
|
|
|
|
|
|
def script_write(script,body):
|
|
script.write_text('import sys,json,os,time,stat\n'+body)
|
|
|
|
|
|
def test_credentials_go_only_to_nonstandard_pipe_fd(transport):
|
|
script,settings=transport
|
|
script_write(script,"""
|
|
line=sys.stdin.buffer.readline(); request=json.loads(line)
|
|
assert 'credentials' not in request
|
|
fd=int(sys.argv[sys.argv.index('--credentials-fd')+1]);assert fd>=3 and stat.S_ISFIFO(os.fstat(fd).st_mode)
|
|
with os.fdopen(fd,'rb')as stream:secret=json.load(stream)
|
|
assert secret['vault_password']=='fixture+%!{{data}}'
|
|
assert secret['vault_password'].encode() not in line
|
|
assert all(secret['vault_password']not in x for x in os.environ.values())
|
|
assert all(secret['vault_password']not in x for x in sys.argv)
|
|
print(json.dumps({'type':'response','api_version':'1.0','ok':False,'result':{
|
|
'status':'failed','stage':'credentials','exit_code':None,'remote_work_may_have_started':False,
|
|
'error':{'code':'vault_unlock_failed'},'counts':{},
|
|
'target_summary':{'schema':'target_outcome_summary_v1','requested':1,'successful':0,'failed':0,'unreachable':0,'not_started':1,'indeterminate':0,'complete':True,'accounted':1},
|
|
'targets':[{'host':'h','outcome':'not_started','counts':{'ok':0,'changed':0,'failures':0,'unreachable':0,'skipped':0,'rescued':0,'ignored':0}}]}}),flush=True)
|
|
""")
|
|
request={'customer':'a','playbook':'p','hosts':['h']}
|
|
result=CoreClient(settings).request('execute',request=request,expected_revision='a'*64,credentials={'vault_password':'fixture+%!{{data}}'})
|
|
assert result['status']=='failed' and result['error']['code']=='vault_unlock_failed'
|
|
|
|
@pytest.mark.parametrize('body,code',[
|
|
("print('not-json',flush=True)",'core_protocol'),
|
|
("print(json.dumps({'type':'event','event':{'event_version':'1.0','kind':'stage','sequence':1,'stage':'execution'}}),flush=True)",'core_outcome_unknown'),
|
|
("print(json.dumps({'type':'response','api_version':'9','ok':True,'result':{}}),flush=True)",'core_protocol'),
|
|
("print('X'*1048577,flush=True)",'core_protocol'),
|
|
])
|
|
def test_invalid_wire_is_not_success(transport,body,code):
|
|
script,settings=transport;script_write(script,body)
|
|
with pytest.raises(WebError)as e:CoreClient(settings).request('capabilities')
|
|
assert e.value.code==code
|
|
|
|
|
|
def test_cancellation_stops_child(transport):
|
|
script,settings=transport;script_write(script,'time.sleep(60)')
|
|
cancel=threading.Event();timer=threading.Timer(.25,cancel.set);timer.start()
|
|
try:
|
|
with pytest.raises(WebError)as e:CoreClient(settings).request('capabilities',cancel=cancel)
|
|
assert e.value.code=='core_cancelled'
|
|
finally:timer.cancel()
|
|
|
|
|
|
def test_start_deadline_cancels_preparation(transport):
|
|
script,settings=transport;script_write(script,'time.sleep(60)')
|
|
with pytest.raises(WebError)as e:
|
|
CoreClient(settings).request('execute',request={'customer':'a','playbook':'p','hosts':['h']},
|
|
expected_revision='a'*64,deadline=time.monotonic()+.3)
|
|
assert e.value.code=='credential_expired'
|
|
|
|
@pytest.mark.parametrize('secret',[{'vault_password':'x\n'},{'username':'admin'},{'vault_password':'\ud800'},{'become_password':'x'}])
|
|
def test_invalid_secrets_rejected(secret):
|
|
with pytest.raises(WebError):validate_secrets(secret)
|
|
|
|
|
|
def test_success_needs_valid_complete_counters():
|
|
result={'type':'response','api_version':'1.0','ok':True,'result':{'status':'succeeded','exit_code':0,'remote_work_may_have_started':True,'counts':dict.fromkeys(COUNTS,0),'target_summary':{'schema':'target_outcome_summary_v1','requested':0,'successful':0,'failed':0,'unreachable':0,'not_started':0,'indeterminate':0,'complete':True,'accounted':0},'targets':[]}}
|
|
assert response_result(result,'execute')['status']=='succeeded'
|
|
result['result']['counts']['ok']=-1
|
|
with pytest.raises(WebError):response_result(result,'execute')
|