server-up/tests/test_selfupdate.py

"""Zelf-update: image-afleiding, veiligheidscontroles en de tag-administratie."""
import sys
from pathlib import Path

import pytest

sys.path.insert(0, str(Path(__file__).resolve().parent.parent / "server-up"))

from conftest import login


@pytest.fixture
def su(env):
    from core import selfupdate
    return selfupdate


def _fake_inspect(su, monkeypatch, **overrides):
    info = {"name": "server-up", "image": "git.example.com/bes-r/server-up:0.5.00",
            "image_id": "sha256:abc", "project": "server-up",
            "working_dir": "/opt/server-up",
            "config_files": "/opt/server-up/docker-compose.yml",
            "service": "server-up"}
    info.update(overrides)
    monkeypatch.setattr(su, "inspect_self", lambda: info)
    return info


@pytest.mark.parametrize("image,verwacht", [
    ("git.example.com/bes-r/server-up:0.5.00", "git.example.com/bes-r/server-up"),
    ("git.example.com/bes-r/server-up", "git.example.com/bes-r/server-up"),
    ("server-up:latest", "server-up"),
    # Poortnummer in de registryhost mag niet als tag gelezen worden.
    ("git.example.com:3000/bes-r/server-up", "git.example.com:3000/bes-r/server-up"),
    ("git.example.com:3000/bes-r/server-up:1.2.3", "git.example.com:3000/bes-r/server-up"),
])
def test_image_repo_afleiding(su, monkeypatch, image, verwacht):
    _fake_inspect(su, monkeypatch, image=image)
    assert su.image_repo() == verwacht


def test_expliciet_ingesteld_image_wint(su, env, monkeypatch):
    _fake_inspect(su, monkeypatch)
    env["core"].patch({"UPDATE_IMAGE": "registry.intern/team/server-up"})
    assert su.image_repo() == "registry.intern/team/server-up"


def test_status_ok_bij_registry_image(su, monkeypatch):
    _fake_inspect(su, monkeypatch)
    st = su.status()
    assert st["can_apply"] is True
    assert st["image"] == "git.example.com/bes-r/server-up"


def test_status_weigert_lokaal_gebouwd_image(su, monkeypatch):
    """Een zelfgebouwd image is geen storing maar de normale opzet bij een
    server die na een push zelf bouwt; de melding moet dat ook zeggen."""
    _fake_inspect(su, monkeypatch, image="server-up:latest")
    st = su.status()
    assert st["can_apply"] is False
    assert st["mode"] == "local-build"
    assert "zelfgebouwd" in st["reason"]
    assert "deploy" in st["reason"]      # wijst naar de Git-route
    assert "SU_IMAGE" in st["reason"]    # én naar het alternatief


def test_status_modus_bij_registry_image(su, monkeypatch):
    _fake_inspect(su, monkeypatch)
    assert su.status()["mode"] == "registry"


@pytest.mark.parametrize("overrides,modus", [
    ({"working_dir": ""}, "no-compose"),
])
def test_status_modi(su, monkeypatch, overrides, modus):
    _fake_inspect(su, monkeypatch, **overrides)
    assert su.status()["mode"] == modus


def test_status_modus_zonder_container(su, monkeypatch):
    monkeypatch.setattr(su, "inspect_self", lambda: {})
    assert su.status()["mode"] == "no-container"


def test_status_weigert_zonder_compose_labels(su, monkeypatch):
    _fake_inspect(su, monkeypatch, working_dir="")
    st = su.status()
    assert st["can_apply"] is False
    assert "compose" in st["reason"]


def test_status_zonder_container(su, monkeypatch):
    monkeypatch.setattr(su, "inspect_self", lambda: {})
    st = su.status()
    assert st["can_apply"] is False
    assert "niet te vinden" in st["reason"]


@pytest.mark.parametrize("tag", [
    "../../etc", "0.5.0; rm -rf /", "-x", "", "a" * 200, "tag met spatie",
])
def test_pull_weigert_ongeldige_tag(su, monkeypatch, tag):
    _fake_inspect(su, monkeypatch)
    ok, msg = su.pull(tag)
    assert ok is False
    assert "Ongeldige tag" in msg


def test_write_tag_maakt_env_aan(su, tmp_path):
    su._write_tag(str(tmp_path), "0.5.10")
    assert (tmp_path / ".env").read_text().strip() == "SU_TAG=0.5.10"


def test_write_tag_vervangt_bestaande_regel(su, tmp_path):
    (tmp_path / ".env").write_text("BIND=0.0.0.0\nSU_TAG=0.5.00\nPORT=5000\n")
    su._write_tag(str(tmp_path), "0.5.10")
    regels = (tmp_path / ".env").read_text().splitlines()
    assert regels == ["BIND=0.0.0.0", "SU_TAG=0.5.10", "PORT=5000"]
    assert sum(1 for r in regels if r.startswith("SU_TAG=")) == 1


def test_write_tag_behoudt_andere_instellingen(su, tmp_path):
    (tmp_path / ".env").write_text("SU_IMAGE=git.example.com/bes-r/server-up\n")
    su._write_tag(str(tmp_path), "0.5.10")
    inhoud = (tmp_path / ".env").read_text()
    assert "SU_IMAGE=git.example.com/bes-r/server-up" in inhoud
    assert "SU_TAG=0.5.10" in inhoud


def test_rollback_zonder_vorige_versie(su):
    ok, msg = su.rollback()
    assert ok is False
    assert "Geen vorige versie" in msg


def test_apply_endpoint_weigert_zonder_registry(client, monkeypatch):
    from core import selfupdate
    csrf = login(client)
    monkeypatch.setattr(selfupdate, "inspect_self",
                        lambda: {"image": "server-up:latest", "working_dir": "/opt/x",
                                 "service": "server-up"})
    r = client.post("/api/update/apply", json={"tag": "0.5.10"},
                    headers={"X-CSRF-Token": csrf})
    assert r.status_code == 400
    assert "registry" in r.get_json()["msg"]


def test_rollback_endpoint_weigert_zonder_vorige_tag(client, monkeypatch):
    from core import selfupdate
    csrf = login(client)
    monkeypatch.setattr(selfupdate, "inspect_self",
                        lambda: {"image": "git.example.com/bes-r/server-up:0.5.00",
                                 "working_dir": "/opt/x", "service": "server-up"})
    r = client.post("/api/update/rollback", headers={"X-CSRF-Token": csrf})
    assert r.status_code == 400
    assert "Geen vorige versie" in r.get_json()["msg"]


def test_registry_token_lekt_niet_via_settings(client, env):
    csrf = login(client)
    client.put("/api/settings",
               json={"UPDATE_REGISTRY_USER": "bes-r",
                     "UPDATE_REGISTRY_TOKEN": "geheim-package-token"},
               headers={"X-CSRF-Token": csrf})

    body = client.get("/api/settings").get_data(as_text=True)
    assert "geheim-package-token" not in body
    assert "has_update_registry_token" in body
    # Wel echt opgeslagen:
    assert env["core"].load()["UPDATE_REGISTRY_TOKEN"] == "geheim-package-token"


def test_leeg_registry_token_wist_bestaande_niet(client, env):
    csrf = login(client)
    client.put("/api/settings", json={"UPDATE_REGISTRY_TOKEN": "blijf-staan"},
               headers={"X-CSRF-Token": csrf})
    client.put("/api/settings", json={"UPDATE_REGISTRY_TOKEN": ""},
               headers={"X-CSRF-Token": csrf})
    assert env["core"].load()["UPDATE_REGISTRY_TOKEN"] == "blijf-staan"