mirror of
https://scm.tikali.ai/tikali/applications/monky/monky-deployd.git
synced 2026-09-18 07:56:14 +00:00
mdella
fcf2dcb1eb
The renderer's .env.template header literally says "substitutes every
${VAR}", which the refusal check counted as an unresolved variable
(ENV_INCOMPLETE: unresolved: VAR) — env-qa-02's first bundle was refused.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KLB7jieMNRkTsJ2epr4Ds1
95 lines
3.8 KiB
Python
95 lines
3.8 KiB
Python
import pytest
|
|
|
|
from monky_deployd import bundle as b
|
|
from monky_deployd.bao import ManifestPathError, kv_data_path
|
|
from tests.fakes import ENV, make_files, make_manifest, tar_bytes
|
|
|
|
|
|
def test_parse_and_sha_match_tenancy_formula():
|
|
files = make_files()
|
|
bd = b.parse(tar_bytes(files))
|
|
assert bd.sha == b.bundle_sha(files) and len(bd.sha) == 64
|
|
assert bd.compose_name == "docker-compose.yml"
|
|
assert bd.env_id == ENV and bd.tier == "qa"
|
|
assert b.manifest_vars(bd) == {"GEMINI_API_KEY", "POSTGRES_PASSWORD", "SEE_ADMIN_TOKEN"}
|
|
assert b.unresolved_vars(bd, b.manifest_vars(bd)) == []
|
|
|
|
|
|
def test_unresolved_vars_names_only_defaults_resolve():
|
|
files = make_files(
|
|
compose="services:\n x:\n image: i:${TAG:-dev}\n environment:\n A: ${NOT_IN_MANIFEST}\n B: ${POSTGRES_PASSWORD}\n"
|
|
)
|
|
bd = b.parse(tar_bytes(files))
|
|
assert b.unresolved_vars(bd, b.manifest_vars(bd)) == ["NOT_IN_MANIFEST"]
|
|
|
|
|
|
def test_privileged_and_host_network_detected():
|
|
files = make_files(
|
|
compose="services:\n x:\n image: i\n privileged: true\n network_mode: host\n cap_add:\n - SYS_ADMIN\n"
|
|
)
|
|
bd = b.parse(tar_bytes(files))
|
|
assert b.privileged_findings(bd) == ["privileged: true", "network_mode: host", "cap_add SYS_ADMIN/ALL"]
|
|
assert bd.flag("allow_privileged") is False
|
|
bd2 = b.parse(tar_bytes(make_files(meta={"agent": {"allow_privileged": True}})))
|
|
assert bd2.flag("allow_privileged") is True
|
|
|
|
|
|
def test_manifest_with_value_is_refused():
|
|
m = make_manifest()
|
|
m["entries"][0]["value"] = "leaked"
|
|
with pytest.raises(b.BundleError, match="carries a value"):
|
|
b.parse(tar_bytes(make_files(manifest=m)))
|
|
|
|
|
|
def test_unsafe_members_refused():
|
|
import io
|
|
import tarfile
|
|
|
|
buf = io.BytesIO()
|
|
with tarfile.open(fileobj=buf, mode="w") as tar:
|
|
info = tarfile.TarInfo(name="../etc/passwd")
|
|
info.size = 1
|
|
tar.addfile(info, io.BytesIO(b"x"))
|
|
with pytest.raises(b.BundleError, match="unsafe"):
|
|
b.parse(buf.getvalue())
|
|
|
|
|
|
def test_render_env_quotes_the_compose_way():
|
|
tmpl = "# c\nA=${A}\nB=${B}\nC=${C}\nKEEP=${KEEP}\n"
|
|
out = b.render_env(tmpl, {"A": "plain-value.1", "B": 'has "quote" and $dollar', "C": "multi\nline"})
|
|
assert 'A=plain-value.1\nB="has \\"quote\\" and $$dollar"\nC="multi\\nline"\nKEEP=${KEEP}\n' in out
|
|
assert b.referenced_vars(out) == {"KEEP"}
|
|
|
|
|
|
def test_kv_paths_are_pinned_to_the_env():
|
|
assert kv_data_path("monky", f"monky/{ENV}/see/pg_password", ENV) == f"/v1/monky/data/{ENV}/see/pg_password"
|
|
assert kv_data_path("monky", f"monky/data/{ENV}/see/x", ENV) == f"/v1/monky/data/{ENV}/see/x"
|
|
for bad in (
|
|
"monky/env-dev-01/see/x",
|
|
"monky/companies/c1/ai/gemini",
|
|
"other/env-qa-02/see/x",
|
|
f"monky/{ENV}/zitadel/x",
|
|
f"monky/{ENV}/see/../x",
|
|
):
|
|
with pytest.raises(ManifestPathError):
|
|
kv_data_path("monky", bad, ENV)
|
|
|
|
|
|
def test_disk_need_bytes_spellings():
|
|
assert b.parse(tar_bytes(make_files(meta={"agent": {"disk_need_bytes": 5}}))).disk_need_bytes == 5
|
|
assert b.parse(tar_bytes(make_files(meta={"disk": {"need_bytes": 7}}))).disk_need_bytes == 7
|
|
assert b.parse(tar_bytes(make_files())).disk_need_bytes == 0
|
|
|
|
|
|
def test_placeholders_in_comment_lines_are_not_references():
|
|
"""The renderer's .env.template header says '... substitutes every ${VAR} ...' — that must not
|
|
become an unresolved 'VAR' (env-qa-02 pilot: ENV_INCOMPLETE: unresolved: VAR)."""
|
|
from monky_deployd.bundle import defaulted_vars, referenced_vars
|
|
|
|
text = (
|
|
"# The on-box agent substitutes every ${VAR} from OpenBao per secrets.manifest.json.\n"
|
|
" # ${ALSO_COMMENT}\nGEMINI_API_KEY=${GEMINI_API_KEY}\nPG=${PGPASSWORD:-x}\n"
|
|
)
|
|
assert referenced_vars(text) == {"GEMINI_API_KEY", "PGPASSWORD"}
|
|
assert defaulted_vars(text) == {"PGPASSWORD"}
|