Files
pmg/packagemanager/pypi_test.go
T
Sahil BansalandGitHub 94781d6bda Remove guard mode: proxy interception is now the only flow (#386)
* refactor: remove guard mode execution paths and guard-only packages

Guard (non-proxy) mode is removed; all package-manager commands now
always run the proxy flow. Removes the guard engine, the common flow,
the extractor package, the npm/pypi dependency resolvers and the
PackageResolver plumbing that only guard mode consumed.

The guard package retains only PackageManagerGuardInteraction, which
the proxy flow and confirmation interceptors reuse for user prompts.
Proxy behavior is unchanged.

* refactor: remove proxy opt-out surfaces, guard references in config, action and docs

Removes Config.ProxyMode, ProxyConfig.Enabled, IsProxyModeEnabled, the
proxy_mode legacy fallback, PMG_PROXY_ENABLED handling and the
--proxy-mode / --include-dev-dependencies flags. Proxy interception can
no longer be disabled.

Also removes the proxy-mode input from the GitHub Action, the
proxy-mode doctor check and setup info row, updates the E2E workflow to
stop passing --proxy-mode=false, and sweeps guard-mode wording from
docs and the config template.

The legacy proxy_install_only flat key and PMG_PROXY_INSTALL_ONLY env
var remain supported. audit.FlowTypeGuard is kept so previously
recorded audit events still translate for cloud sync.

* feat: fail loudly when a removed proxy opt-out is still configured

A leftover proxy.enabled: false / proxy_mode: false config key or
PMG_PROXY_ENABLED=false / PMG_PROXY_MODE=false env var previously meant
guard mode; silently ignoring it would switch those users to proxy
interception without notice. PMG now exits with an actionable error
naming the exact source. Precedence mirrors the old resolution order:
env (ignored under lockdown) > proxy.enabled > legacy proxy_mode.

The pmg config subtree is exempt so the config file can still be fixed
with pmg config edit/set. The GitHub Action's proxy-mode input is kept
as a tombstone that fails the action when set to false and warns
otherwise.

* refactor: extract flows.RunProxy and address review findings

Collapses the identical parse-then-run body duplicated across the 12
package manager commands into flows.RunProxy. Documents the cache-hit /
offline analysis trade-off versus the removed guard manifest path,
fixes a stale non-proxy label in the E2E workflow and a stale guard
reference in the uvx parser comment.

* fix(config): mirror old proxy opt-out precedence exactly

PMG_PROXY_MODE only ever took effect through the legacy fallback, which
was gated on the presence of a proxy: key in the config file (even a
null one). Promoting it to the top env tier caused two inversions: a
stale PMG_PROXY_MODE=false hard-failed configs that resolved to proxy
mode, and PMG_PROXY_MODE=true silently overrode an explicit
proxy.enabled: false file opt-out. The check now resolves in the old
order: PMG_PROXY_ENABLED > proxy: section (presence gates the legacy
tier) > PMG_PROXY_MODE > flat proxy_mode.

parseOptOutBool also accepts numeric values (0 = false) to match
viper's WeaklyTypedInput/cast.ToBool coercion, so proxy.enabled: 0 and
proxy_mode: 0 are detected as opt-outs.

* refactor: move package manager interaction out of guard

* refactor: trim package manager interaction

* fix(config): normalize config keys viper-style in proxy opt-out check

Viper resolved config file keys case-insensitively and expanded dotted
keys, so spellings like Proxy:, Enabled:, a literal proxy.enabled key or
Proxy_Mode selected guard mode before the removal. The opt-out check now
lowercases keys recursively and nests dotted keys before matching, so
those existing opt-outs fail loudly instead of being silently ignored.

* refactor: remove inert transitive controls, dead parser state and guard audit variant

transitive / transitive_depth lost their only consumers with the
dependency resolvers; remove the config fields, flags, template and doc
entries, and the report/audit plumbing that misreported transitive
analysis as enabled.

Remove write-only parser state (PackageInstallTarget.Extras,
ParsedCommand.ManifestFiles, ShouldExtractFromManifest); IsManifestInstall
stays as it feeds sandbox gating via IsInstallationCommand.

Remove audit.FlowTypeGuard and its cloud mapping; guard events recorded
by pre-removal versions in an unsynced WAL translate to UNSPECIFIED.

* fix: address review findings on the opt-out wiring and cleanups

Move the removed-opt-out rejection from the CLI PersistentPreRun into
proxyFlow.Run: the check now fires exactly for package-manager runs, so
non-install commands (pmg setup remove, doctor, config, version) stay
usable to fix or remove an opted-out installation, and future commands
inherit or avoid the check by construction instead of by exemption list.

Also: make the e2e malicious-package assertion actually fail the job
when an install is not blocked, route pmg go through flows.RunProxy,
and drop the dead extras return from pypiParsePackageInfo (extras are
still stripped from package names).

* fix(config): make the removed opt-out check faithful to the old resolution

The gate that silenced the legacy proxy_mode surfaces matched the raw
proxy key case-sensitively in the old code, while values resolved
viper-style (case-insensitive, dotted keys); applying each semantic
where the old code did fixes both divergences: a case-variant Proxy:
section no longer hides a flat proxy_mode: false opt-out, and a dotted
proxy.enabled: false overridden by proxy_mode: true no longer errors.

Replace the generic key-tree normalization with two targeted lookups
(the check only ever resolves proxy.enabled and proxy_mode), which also
makes colliding spellings resolve deterministically. Coerce legacy-tier
values cast.ToBool-style so PMG_PROXY_MODE=off style opt-outs are
detected, log the config read error instead of swallowing it, and
shorten the error to a one-line statement with the specific remedy in
the help text.

Add lockdown coverage (env inert both directions) and a repeated-run
determinism test.

* fix(config): fall back to defaults for unrecognized proxy opt-out values

The old loader swallowed viper errors and ran on defaults, so values
like proxy.enabled: yes or PMG_PROXY_ENABLED=banana silently discarded
the whole config and defaulted to proxy. Treat them the same way now:
unrecognized values mean the default (proxy on) instead of a hard
error, and the doc comment no longer claims the old loader failed
loudly. Only values that actually meant guard mode fail.

Also check the removed opt-out before the CA trust check in pmg go,
restoring the old error precedence: a config problem must not steer
the user into an unnecessary OS trust store change.

* fix(e2e): PMG_PROXY_MODE assertion must match the legacy gate semantics

The runner's setup step writes the template config, which has a proxy:
section — and with one present the legacy PMG_PROXY_MODE was always
inert, so expecting a loud failure there asserts pre-fidelity-fix
behavior. Assert both sides instead: inert (command succeeds) with the
standard config, loud failure against an empty config dir where the
legacy fallback actually applied.

* refactor(config): collapse parseOptOutBool to ParseBool over the string form

YAML hands us typed values (bool, int), so route them through
fmt.Sprintf %v and strconv.ParseBool instead of a per-type switch.
Identical behavior for every recognized value; numbers other than 0/1
now read as no opinion instead of cast.ToBool's nonzero-true, which no
real config relies on.
2026-07-22 15:19:19 +05:30

921 lines
23 KiB
Go

package packagemanager
import (
"strings"
"testing"
"github.com/stretchr/testify/assert"
)
func TestPipParsePackageInfo(t *testing.T) {
cases := []struct {
name string
input string
pkgName string
version string
wantErr bool
}{
{
name: "simple package name",
input: "fastapi",
pkgName: "fastapi",
version: "",
wantErr: false,
},
{
name: "package with exact version & extra",
input: "fastapi[all]==0.115.7",
pkgName: "fastapi",
version: "==0.115.7",
wantErr: false,
},
{
name: "package with version range",
input: "requests>=2.0,<3.0",
pkgName: "requests",
version: ">=2.0,<3.0",
wantErr: false,
},
{
name: "package with exclusion",
input: "pydantic!=1.8,!=1.8.1",
pkgName: "pydantic",
version: "!=1.8,!=1.8.1",
wantErr: false,
},
{
name: "package with compatible release",
input: "django~=3.1.0",
pkgName: "django",
version: "~=3.1.0",
wantErr: false,
},
{
name: "package with greater than with empty extra",
input: "numpy[]>1.20.0",
pkgName: "numpy",
version: ">1.20.0",
wantErr: false,
},
{
name: "package with less than",
input: "pandas<2.0.0",
pkgName: "pandas",
version: "<2.0.0",
wantErr: false,
},
{
name: "empty input",
input: "",
pkgName: "",
version: "",
wantErr: true,
},
{
name: "only version specifier",
input: "==1.0.0",
pkgName: "",
version: "",
wantErr: true,
},
{
name: "package with whitespace",
input: " requests == 2.0.0 ",
pkgName: "requests",
version: "== 2.0.0",
wantErr: false,
},
}
for _, tc := range cases {
t.Run(tc.name, func(t *testing.T) {
pkgName, version, err := pypiParsePackageInfo(tc.input)
if tc.wantErr {
assert.Error(t, err)
} else {
assert.NoError(t, err)
assert.Equal(t, tc.pkgName, pkgName)
assert.Equal(t, tc.version, version)
}
})
}
}
func TestPipParseCommand(t *testing.T) {
pm, err := NewPypiPackageManager(DefaultPipPackageManagerConfig())
assert.NoError(t, err)
cases := []struct {
name string
args []string
expectedManifest bool
expectedTargets int
}{
{
name: "pip install with -r flag",
args: []string{"install", "-r", "requirements.txt"},
expectedManifest: true,
expectedTargets: 0,
},
{
name: "pip install with -r flag with different filename",
args: []string{"install", "-r", "requirements-dev.txt"},
expectedManifest: true,
expectedTargets: 0,
},
{
name: "pip install with --requirement flag",
args: []string{"install", "--requirement", "requirements.txt"},
expectedManifest: true,
expectedTargets: 0,
},
{
name: "pip install with combined -r flag",
args: []string{"install", "-rrequirements.txt"},
expectedManifest: true,
expectedTargets: 0,
},
{
name: "pip install without args",
args: []string{"install"},
expectedManifest: false,
expectedTargets: 0,
},
{
name: "pip install with explicit package",
args: []string{"install", "django"},
expectedManifest: false,
expectedTargets: 1,
},
{
name: "pip install with mixed args",
args: []string{"install", "django", "-r", "requirements.txt"},
expectedManifest: true,
expectedTargets: 1,
},
{
name: "pip install with multiple -r flags",
args: []string{"install", "-r", "requirements.txt", "-r", "dev-requirements.txt"},
expectedManifest: true,
expectedTargets: 0,
},
{
name: "non-install command",
args: []string{"list"},
expectedManifest: false,
expectedTargets: 0,
},
}
for _, tc := range cases {
t.Run(tc.name, func(t *testing.T) {
parsed, err := pm.ParseCommand(tc.args)
assert.NoError(t, err)
assert.Equal(t, tc.expectedManifest, parsed.IsManifestInstall, "IsManifestInstall mismatch")
assert.Equal(t, tc.expectedTargets, len(parsed.InstallTargets), "InstallTargets count mismatch")
// Test helper methods
assert.Equal(t, tc.expectedManifest, parsed.HasManifestInstall(), "HasManifestInstall mismatch")
})
}
}
func TestPip3ParseCommand(t *testing.T) {
pm, err := NewPypiPackageManager(DefaultPip3PackageManagerConfig())
assert.NoError(t, err)
cases := []struct {
name string
args []string
expectedManifest bool
expectedTargets int
}{
{
name: "pip3 install with -r flag",
args: []string{"install", "-r", "requirements.txt"},
expectedManifest: true,
expectedTargets: 0,
},
{
name: "pip3 install with -r flag with different filename",
args: []string{"install", "-r", "requirements-dev.txt"},
expectedManifest: true,
expectedTargets: 0,
},
{
name: "pip3 install with --requirement flag",
args: []string{"install", "--requirement", "requirements.txt"},
expectedManifest: true,
expectedTargets: 0,
},
{
name: "pip3 install with combined -r flag",
args: []string{"install", "-rrequirements.txt"},
expectedManifest: true,
expectedTargets: 0,
},
{
name: "pip3 install without args",
args: []string{"install"},
expectedManifest: false,
expectedTargets: 0,
},
{
name: "pip3 install with explicit package",
args: []string{"install", "django"},
expectedManifest: false,
expectedTargets: 1,
},
{
name: "pip3 install with mixed args",
args: []string{"install", "django", "-r", "requirements.txt"},
expectedManifest: true,
expectedTargets: 1,
},
{
name: "pip3 install with multiple -r flags",
args: []string{"install", "-r", "requirements.txt", "-r", "dev-requirements.txt"},
expectedManifest: true,
expectedTargets: 0,
},
{
name: "non-install command",
args: []string{"list"},
expectedManifest: false,
expectedTargets: 0,
},
}
for _, tc := range cases {
t.Run(tc.name, func(t *testing.T) {
parsed, err := pm.ParseCommand(tc.args)
assert.NoError(t, err)
assert.Equal(t, tc.expectedManifest, parsed.IsManifestInstall, "IsManifestInstall mismatch")
assert.Equal(t, tc.expectedTargets, len(parsed.InstallTargets), "InstallTargets count mismatch")
assert.Equal(t, tc.expectedManifest, parsed.HasManifestInstall(), "HasManifestInstall mismatch")
})
}
}
func TestPipConvertCompatibleRelease(t *testing.T) {
cases := []struct {
name string
input string
expected string
}{
{
name: "standard version",
input: "~=3.1.0",
expected: ">=3.1.0,<3.2.0",
},
{
name: "single digit minor",
input: "~=2.1.5",
expected: ">=2.1.5,<2.2.0",
},
{
name: "double digit minor",
input: "~=1.10.0",
expected: ">=1.10.0,<1.11.0",
},
{
name: "invalid format",
input: "~=1",
expected: "",
},
{
name: "missing prefix",
input: "3.1.0",
expected: "3.1.0",
},
{
name: "extra segments",
input: "~=2.1.5.2",
expected: ">=2.1.5.2,<2.1.6",
},
}
for _, tc := range cases {
t.Run(tc.name, func(t *testing.T) {
result := pypiConvertCompatibleRelease(tc.input)
assert.Equal(t, tc.expected, result)
})
}
}
func TestPypiConvertPoetryVersionConstraints(t *testing.T) {
cases := []struct {
name string
input string
expected string
wantErr bool
}{
// Basic functionality tests
{
name: "empty string",
input: "",
expected: "",
wantErr: true,
},
{
name: "package name only",
input: "pendulum",
expected: "pendulum",
wantErr: false,
},
{
name: "inequality constraints",
input: "pendulum>=2.0.0",
expected: "pendulum>=2.0.0",
wantErr: false,
},
{
name: "empty package name",
input: "@^1.0.0",
expected: "",
wantErr: true,
},
{
name: "whitespace handling",
input: " pendulum@^2.0.5 ",
expected: "pendulum>=2.0.5,<3.0.0",
wantErr: false,
},
// Caret constraint tests
{
name: "caret basic major version",
input: "pendulum@^2.0.5",
expected: "pendulum>=2.0.5,<3.0.0",
wantErr: false,
},
{
name: "caret with major version 0",
input: "requests@^0.2.3",
expected: "requests>=0.2.3,<0.3.0",
wantErr: false,
},
{
name: "caret with major and minor version 0",
input: "numpy@^0.0.5",
expected: "numpy>=0.0.5,<0.0.6",
wantErr: false,
},
{
name: "caret with two parts",
input: "flask@^1.1",
expected: "flask>=1.1.0,<2.0.0",
wantErr: false,
},
{
name: "caret with one part",
input: "pytest@^7",
expected: "pytest>=7.0.0,<8.0.0",
wantErr: false,
},
{
name: "caret with zero major & two parts",
input: "package@^0.5",
expected: "package>=0.5.0,<0.6.0",
wantErr: false,
},
{
name: "caret invalid version",
input: "invalid@^abc.def",
expected: "",
wantErr: true,
},
// Tilde constraint tests
{
name: "tilde basic three parts",
input: "pendulum@~2.0.5",
expected: "pendulum>=2.0.5,<2.1.0",
wantErr: false,
},
{
name: "tilde with two parts",
input: "requests@~1.2",
expected: "requests>=1.2.0,<1.3.0",
wantErr: false,
},
{
name: "tilde with one part",
input: "numpy@~2",
expected: "numpy>=2.0.0,<3.0.0",
wantErr: false,
},
{
name: "tilde with zero major",
input: "package@~0.5.2",
expected: "package>=0.5.2,<0.6.0",
wantErr: false,
},
{
name: "tilde invalid version",
input: "invalid@~abc.def",
expected: "",
wantErr: true,
},
{
name: "tilde without @ separator",
input: "requests~1.2.0",
expected: "requests>=1.2.0,<1.3.0",
wantErr: false,
},
// With extras
{
name: "caret with extras using @ format",
input: "fastapi[all]@^0.68.0",
expected: "fastapi[all]>=0.68.0,<0.69.0",
wantErr: false,
},
{
name: "caret with extras without @ separator",
input: "django[mysql,redis]^3.0",
expected: "django[mysql,redis]>=3.0.0,<4.0.0",
wantErr: false,
},
{
name: "tilde with multiple extras",
input: "uvicorn[standard,dev]~0.15.0",
expected: "uvicorn[standard,dev]>=0.15.0,<0.16.0",
wantErr: false,
},
{
name: "empty extras with caret",
input: "numpy[]^1.20.0",
expected: "numpy[]>=1.20.0,<2.0.0",
wantErr: false,
},
// Standard constraint pass-through tests (no Poetry operators)
{
name: "standard python format",
input: "pendulum>=2.0.0",
expected: "pendulum>=2.0.0",
wantErr: false,
},
{
name: "standard exact version",
input: "django==3.2.0",
expected: "django==3.2.0",
wantErr: false,
},
{
name: "standard with extras",
input: "fastapi[all]>=0.68.0",
expected: "fastapi[all]>=0.68.0",
wantErr: false,
},
{
name: "complex version range",
input: "requests>=2.0,<3.0",
expected: "requests>=2.0,<3.0",
wantErr: false,
},
// Wildcard constraint tests
{
name: "wildcard all versions",
input: "requests@*",
expected: "requests>=0.0.0",
wantErr: false,
},
{
name: "wildcard major version",
input: "django@1.*",
expected: "django>=1.0.0,<2.0.0",
wantErr: false,
},
{
name: "wildcard minor version",
input: "flask@1.2.*",
expected: "flask>=1.2.0,<1.3.0",
wantErr: false,
},
{
name: "wildcard without @ separator",
input: "numpy@2.*",
expected: "numpy>=2.0.0,<3.0.0",
wantErr: false,
},
{
name: "wildcard with extras",
input: "fastapi[all]@1.*",
expected: "fastapi[all]>=1.0.0,<2.0.0",
wantErr: false,
},
{
name: "wildcard with extras without @ separator",
input: "uvicorn[standard]@0.*",
expected: "uvicorn[standard]>=0.0.0,<1.0.0",
wantErr: false,
},
}
for _, tc := range cases {
t.Run(tc.name, func(t *testing.T) {
result, err := pypiConvertPoetryVersionConstraints(tc.input)
if tc.wantErr {
assert.Error(t, err)
} else {
assert.NoError(t, err)
assert.Equal(t, tc.expected, result)
}
})
}
}
func TestPypiConvertCaretConstraint(t *testing.T) {
cases := []struct {
name string
input string
expected string
}{
{
name: "standard major version",
input: "1.2.3",
expected: ">=1.2.3,<2.0.0",
},
{
name: "major version zero",
input: "0.2.3",
expected: ">=0.2.3,<0.3.0",
},
{
name: "major and minor version zero",
input: "0.0.3",
expected: ">=0.0.3,<0.0.4",
},
{
name: "two parts",
input: "1.2",
expected: ">=1.2.0,<2.0.0",
},
{
name: "one part",
input: "7",
expected: ">=7.0.0,<8.0.0",
},
{
name: "zero major two parts",
input: "0.5",
expected: ">=0.5.0,<0.6.0",
},
{
name: "double digit versions",
input: "10.15.22",
expected: ">=10.15.22,<11.0.0",
},
{
name: "invalid version",
input: "abc.def",
expected: "",
},
{
name: "empty version",
input: "",
expected: "",
},
}
for _, tc := range cases {
t.Run(tc.name, func(t *testing.T) {
result := pypiConvertCaretConstraint(tc.input)
assert.Equal(t, tc.expected, result)
})
}
}
func TestPypiConvertTildeConstraint(t *testing.T) {
cases := []struct {
name string
input string
expected string
}{
{
name: "three parts",
input: "1.2.3",
expected: ">=1.2.3,<1.3.0",
},
{
name: "two parts",
input: "1.2",
expected: ">=1.2.0,<1.3.0",
},
{
name: "one part",
input: "2",
expected: ">=2.0.0,<3.0.0",
},
{
name: "zero major version",
input: "0.5.2",
expected: ">=0.5.2,<0.6.0",
},
{
name: "double digit versions",
input: "10.15.22",
expected: ">=10.15.22,<10.16.0",
},
{
name: "large version numbers",
input: "99.99.99",
expected: ">=99.99.99,<99.100.0",
},
{
name: "invalid version",
input: "abc.def",
expected: "",
},
{
name: "empty version",
input: "",
expected: "",
},
}
for _, tc := range cases {
t.Run(tc.name, func(t *testing.T) {
result := pypiConvertTildeConstraint(tc.input)
assert.Equal(t, tc.expected, result)
})
}
}
func TestUvParseCommand(t *testing.T) {
pm, err := NewPypiPackageManager(DefaultUvPackageManagerConfig())
assert.NoError(t, err)
cases := []struct {
name string
args []string
expectedManifest bool
expectedTargets int
expectedPackages []string
wantErr bool
}{
{
name: "uv add simple package",
args: []string{"add", "flask"},
expectedManifest: false,
expectedTargets: 1,
expectedPackages: []string{"flask"},
wantErr: false,
},
{
name: "uv add multiple packages",
args: []string{"add", "flask", "requests"},
expectedManifest: false,
expectedTargets: 2,
expectedPackages: []string{
"flask",
"requests",
},
wantErr: false,
},
{
name: "uv pip install simple package",
args: []string{"pip", "install", "fastapi"},
expectedManifest: false,
expectedTargets: 2,
expectedPackages: []string{"fastapi"},
wantErr: false,
},
{
name: "uv pip install multiple packages",
args: []string{"pip", "install", "flask", "requests"},
expectedManifest: false,
expectedTargets: 2,
expectedPackages: []string{
"flask",
"requests",
},
wantErr: false,
},
{
name: "uv pip install from manifest file",
args: []string{"pip", "install", "-r", "requirements.txt"},
expectedManifest: true,
expectedTargets: 0,
expectedPackages: []string{},
wantErr: false,
},
{
name: "uv pip install from multiple manifest files",
args: []string{"pip", "install", "-r", "requirements.txt", "-r", "dev-requirements.txt"},
expectedManifest: true,
expectedTargets: 0,
expectedPackages: []string{},
wantErr: false,
},
{
name: "uv sync",
args: []string{"sync"},
expectedManifest: true,
expectedTargets: 0,
expectedPackages: []string{},
wantErr: false,
},
}
for _, tc := range cases {
t.Run(tc.name, func(t *testing.T) {
result, err := pm.ParseCommand(tc.args)
if tc.wantErr {
assert.Error(t, err)
return
}
assert.NoError(t, err)
assert.Equal(t, tc.expectedManifest, result.HasManifestInstall(), "HasManifestInstall mismatch")
assert.Equal(t, len(tc.expectedPackages), len(result.InstallTargets), "Number of install targets mismatch")
for i, expectedPkg := range tc.expectedPackages {
if i < len(result.InstallTargets) {
target := result.InstallTargets[i]
assert.Equal(t, expectedPkg, target.PackageVersion.Package.Name, "Package name mismatch for package %d", i)
}
}
})
}
}
func TestPypiConvertWildcardConstraint(t *testing.T) {
cases := []struct {
name string
input string
expected string
}{
{
name: "all versions wildcard",
input: "*",
expected: ">=0.0.0",
},
{
name: "major version wildcard",
input: "1.*",
expected: ">=1.0.0,<2.0.0",
},
{
name: "minor version wildcard",
input: "2.5.*",
expected: ">=2.5.0,<2.6.0",
},
{
name: "zero major version wildcard",
input: "0.*",
expected: ">=0.0.0,<1.0.0",
},
{
name: "zero minor version wildcard",
input: "1.0.*",
expected: ">=1.0.0,<1.1.0",
},
{
name: "high version numbers",
input: "12.34.*",
expected: ">=12.34.0,<12.35.0",
},
{
name: "invalid wildcard format",
input: "1.2.3.*",
expected: "",
},
{
name: "invalid non-numeric parts",
input: "abc.*",
expected: "",
},
{
name: "wildcard without dot",
input: "1*",
expected: "",
},
}
for _, tc := range cases {
t.Run(tc.name, func(t *testing.T) {
result := pypiConvertWildcardConstraint(tc.input)
assert.Equal(t, tc.expected, result)
})
}
}
func TestPypiProxyBehavior(t *testing.T) {
cases := []struct {
name string
pm func() (*pypiPackageManager, error)
command string
isKnownNonDownloadCmd bool // proxy skipped when proxy_install_only=true
isInstallationCommand bool
}{
// Commands where proxy MUST run
{
name: "poetry update — proxy runs (may download)",
pm: func() (*pypiPackageManager, error) { return NewPypiPackageManager(DefaultPoetryPackageManagerConfig()) },
command: "poetry update",
isKnownNonDownloadCmd: false,
isInstallationCommand: false,
},
{
name: "poetry add — proxy runs (installation command)",
pm: func() (*pypiPackageManager, error) { return NewPypiPackageManager(DefaultPoetryPackageManagerConfig()) },
command: "poetry add django",
isKnownNonDownloadCmd: false,
isInstallationCommand: true,
},
{
name: "uv sync — proxy runs (manifest install)",
pm: func() (*pypiPackageManager, error) { return NewPypiPackageManager(DefaultUvPackageManagerConfig()) },
command: "uv sync",
isKnownNonDownloadCmd: false,
isInstallationCommand: true,
},
{
name: "pip download — proxy runs (explicitly downloads packages)",
pm: func() (*pypiPackageManager, error) { return NewPypiPackageManager(DefaultPipPackageManagerConfig()) },
command: "pip download requests",
isKnownNonDownloadCmd: false,
isInstallationCommand: false,
},
{
name: "pip3 download — proxy runs (explicitly downloads packages)",
pm: func() (*pypiPackageManager, error) { return NewPypiPackageManager(DefaultPip3PackageManagerConfig()) },
command: "pip3 download django",
isKnownNonDownloadCmd: false,
isInstallationCommand: false,
},
{
name: "uv pip download — proxy runs (uv has complex subcommands, fail safe)",
pm: func() (*pypiPackageManager, error) { return NewPypiPackageManager(DefaultUvPackageManagerConfig()) },
command: "uv pip download requests",
isKnownNonDownloadCmd: false,
isInstallationCommand: false,
},
{
name: "uv run — proxy runs (auto-installs script dependencies)",
pm: func() (*pypiPackageManager, error) { return NewPypiPackageManager(DefaultUvPackageManagerConfig()) },
command: "uv run script.py",
isKnownNonDownloadCmd: false,
isInstallationCommand: false,
},
// Commands where proxy is safely skipped
{
name: "pip list — proxy skipped (lists installed packages)",
pm: func() (*pypiPackageManager, error) { return NewPypiPackageManager(DefaultPipPackageManagerConfig()) },
command: "pip list",
isKnownNonDownloadCmd: true,
isInstallationCommand: false,
},
{
name: "pip show — proxy skipped (shows package metadata)",
pm: func() (*pypiPackageManager, error) { return NewPypiPackageManager(DefaultPipPackageManagerConfig()) },
command: "pip show requests",
isKnownNonDownloadCmd: true,
isInstallationCommand: false,
},
{
name: "poetry show — proxy skipped (shows dependency info)",
pm: func() (*pypiPackageManager, error) { return NewPypiPackageManager(DefaultPoetryPackageManagerConfig()) },
command: "poetry show",
isKnownNonDownloadCmd: true,
isInstallationCommand: false,
},
{
name: "poetry check — proxy skipped (validates pyproject.toml)",
pm: func() (*pypiPackageManager, error) { return NewPypiPackageManager(DefaultPoetryPackageManagerConfig()) },
command: "poetry check",
isKnownNonDownloadCmd: true,
isInstallationCommand: false,
},
// Unknown commands default to proxy running (fail safe)
{
name: "unknown pip subcommand — proxy runs (fail safe)",
pm: func() (*pypiPackageManager, error) { return NewPypiPackageManager(DefaultPipPackageManagerConfig()) },
command: "pip some-future-command",
isKnownNonDownloadCmd: false,
isInstallationCommand: false,
},
}
for _, tc := range cases {
t.Run(tc.name, func(t *testing.T) {
pm, err := tc.pm()
assert.NoError(t, err)
parsed, err := pm.ParseCommand(strings.Split(tc.command, " "))
assert.NoError(t, err)
assert.Equal(t, tc.isKnownNonDownloadCmd, parsed.IsKnownNonDownloadCommand)
assert.Equal(t, tc.isInstallationCommand, parsed.IsInstallationCommand())
assert.Equal(t, !tc.isKnownNonDownloadCmd, parsed.MayDownloadPackages())
})
}
}