"""Zelf-update: image-afleiding, veiligheidscontroles en de tag-administratie.""" import sys from pathlib import Path import pytest sys.path.insert(0, str(Path(__file__).resolve().parent.parent / "server-up")) from conftest import login @pytest.fixture def su(env): from core import selfupdate return selfupdate def _fake_inspect(su, monkeypatch, **overrides): info = {"name": "server-up", "image": "git.example.com/bes-r/server-up:0.5.00", "image_id": "sha256:abc", "project": "server-up", "working_dir": "/opt/server-up", "config_files": "/opt/server-up/docker-compose.yml", "service": "server-up"} info.update(overrides) monkeypatch.setattr(su, "inspect_self", lambda: info) return info @pytest.mark.parametrize("image,verwacht", [ ("git.example.com/bes-r/server-up:0.5.00", "git.example.com/bes-r/server-up"), ("git.example.com/bes-r/server-up", "git.example.com/bes-r/server-up"), ("server-up:latest", "server-up"), # Poortnummer in de registryhost mag niet als tag gelezen worden. ("git.example.com:3000/bes-r/server-up", "git.example.com:3000/bes-r/server-up"), ("git.example.com:3000/bes-r/server-up:1.2.3", "git.example.com:3000/bes-r/server-up"), ]) def test_image_repo_afleiding(su, monkeypatch, image, verwacht): _fake_inspect(su, monkeypatch, image=image) assert su.image_repo() == verwacht def test_expliciet_ingesteld_image_wint(su, env, monkeypatch): _fake_inspect(su, monkeypatch) env["core"].patch({"UPDATE_IMAGE": "registry.intern/team/server-up"}) assert su.image_repo() == "registry.intern/team/server-up" def test_status_ok_bij_registry_image(su, monkeypatch): _fake_inspect(su, monkeypatch) st = su.status() assert st["can_apply"] is True assert st["image"] == "git.example.com/bes-r/server-up" def test_status_weigert_lokaal_gebouwd_image(su, monkeypatch): """Een zelfgebouwd image is geen storing maar de normale opzet bij een server die na een push zelf bouwt; de melding moet dat ook zeggen.""" _fake_inspect(su, monkeypatch, image="server-up:latest") st = su.status() assert st["can_apply"] is False assert st["mode"] == "local-build" assert "zelfgebouwd" in st["reason"] assert "deploy" in st["reason"] # wijst naar de Git-route assert "SU_IMAGE" in st["reason"] # én naar het alternatief def test_status_modus_bij_registry_image(su, monkeypatch): _fake_inspect(su, monkeypatch) assert su.status()["mode"] == "registry" @pytest.mark.parametrize("overrides,modus", [ ({"working_dir": ""}, "no-compose"), ]) def test_status_modi(su, monkeypatch, overrides, modus): _fake_inspect(su, monkeypatch, **overrides) assert su.status()["mode"] == modus def test_status_modus_zonder_container(su, monkeypatch): monkeypatch.setattr(su, "inspect_self", lambda: {}) assert su.status()["mode"] == "no-container" def test_status_weigert_zonder_compose_labels(su, monkeypatch): _fake_inspect(su, monkeypatch, working_dir="") st = su.status() assert st["can_apply"] is False assert "compose" in st["reason"] def test_status_zonder_container(su, monkeypatch): monkeypatch.setattr(su, "inspect_self", lambda: {}) st = su.status() assert st["can_apply"] is False assert "niet te vinden" in st["reason"] @pytest.mark.parametrize("tag", [ "../../etc", "0.5.0; rm -rf /", "-x", "", "a" * 200, "tag met spatie", ]) def test_pull_weigert_ongeldige_tag(su, monkeypatch, tag): _fake_inspect(su, monkeypatch) ok, msg = su.pull(tag) assert ok is False assert "Ongeldige tag" in msg def test_write_tag_maakt_env_aan(su, tmp_path): su._write_tag(str(tmp_path), "0.5.10") assert (tmp_path / ".env").read_text().strip() == "SU_TAG=0.5.10" def test_write_tag_vervangt_bestaande_regel(su, tmp_path): (tmp_path / ".env").write_text("BIND=0.0.0.0\nSU_TAG=0.5.00\nPORT=5000\n") su._write_tag(str(tmp_path), "0.5.10") regels = (tmp_path / ".env").read_text().splitlines() assert regels == ["BIND=0.0.0.0", "SU_TAG=0.5.10", "PORT=5000"] assert sum(1 for r in regels if r.startswith("SU_TAG=")) == 1 def test_write_tag_behoudt_andere_instellingen(su, tmp_path): (tmp_path / ".env").write_text("SU_IMAGE=git.example.com/bes-r/server-up\n") su._write_tag(str(tmp_path), "0.5.10") inhoud = (tmp_path / ".env").read_text() assert "SU_IMAGE=git.example.com/bes-r/server-up" in inhoud assert "SU_TAG=0.5.10" in inhoud def test_rollback_zonder_vorige_versie(su): ok, msg = su.rollback() assert ok is False assert "Geen vorige versie" in msg def test_apply_endpoint_weigert_zonder_registry(client, monkeypatch): from core import selfupdate csrf = login(client) monkeypatch.setattr(selfupdate, "inspect_self", lambda: {"image": "server-up:latest", "working_dir": "/opt/x", "service": "server-up"}) r = client.post("/api/update/apply", json={"tag": "0.5.10"}, headers={"X-CSRF-Token": csrf}) assert r.status_code == 400 assert "registry" in r.get_json()["msg"] def test_rollback_endpoint_weigert_zonder_vorige_tag(client, monkeypatch): from core import selfupdate csrf = login(client) monkeypatch.setattr(selfupdate, "inspect_self", lambda: {"image": "git.example.com/bes-r/server-up:0.5.00", "working_dir": "/opt/x", "service": "server-up"}) r = client.post("/api/update/rollback", headers={"X-CSRF-Token": csrf}) assert r.status_code == 400 assert "Geen vorige versie" in r.get_json()["msg"] def test_registry_token_lekt_niet_via_settings(client, env): csrf = login(client) client.put("/api/settings", json={"UPDATE_REGISTRY_USER": "bes-r", "UPDATE_REGISTRY_TOKEN": "geheim-package-token"}, headers={"X-CSRF-Token": csrf}) body = client.get("/api/settings").get_data(as_text=True) assert "geheim-package-token" not in body assert "has_update_registry_token" in body # Wel echt opgeslagen: assert env["core"].load()["UPDATE_REGISTRY_TOKEN"] == "geheim-package-token" def test_leeg_registry_token_wist_bestaande_niet(client, env): csrf = login(client) client.put("/api/settings", json={"UPDATE_REGISTRY_TOKEN": "blijf-staan"}, headers={"X-CSRF-Token": csrf}) client.put("/api/settings", json={"UPDATE_REGISTRY_TOKEN": ""}, headers={"X-CSRF-Token": csrf}) assert env["core"].load()["UPDATE_REGISTRY_TOKEN"] == "blijf-staan"