mirror of
https://github.com/rennf93/roboco.git
synced 2026-08-03 07:23:24 +02:00
* feat(sandbox): throwaway per-agent Postgres/Redis sandbox containers
Orchestrator-provisioned sibling containers per agent spawn
(SandboxProvisioner, roboco/runtime/sandbox.py). Per-project opt-in via
projects.sandbox_services (migration 057); master switch
ROBOCO_SANDBOX_DB_ENABLED, default-off, armed in the NAS compose only.
When active, ROBOCO_TEST_DB_* / ROBOCO_TEST_REDIS_* point at the sandbox
and the prod-creds gate-env injection is suppressed (sandbox replaces,
never coexists). Sandbox lifetime tracks the agent container: teardown at
every removal path, orphan janitor at startup + each reaper tick with a
grace window for mid-flight spawns. The pre-spawn stale-clear spares the
just-provisioned sandbox; provision pre-clears stale same-named
containers from a crash-missed teardown.
Panel: per-project sandbox-service switches in the edit dialog + feature
flag card entry.
* docs: CLAUDE.md entry for the sandboxed dev DB/Redis subsystem
* feat(security): isolate prod Postgres/Redis from agent containers (roboco_data network)
Second user-defined bridge roboco_data carries postgres+redis only; the
orchestrator is multi-homed (default + data). Spawned agents and their
sandbox sidecars stay on roboco_default and can no longer resolve or
reach roboco-postgres:5432 / roboco-redis:6379 (redis has no auth —
membership is its only containment). Normal bridge, so host-published
ports (15432/16379) keep working. Applied to both build composes and
the registry compose; docker-compose.yml re-synced byte-identical with
docker-compose.yaml (it had drifted by the sandbox flag block).
ROBOCO_DB_NETWORK_ISOLATED (config default false, armed alongside the
topology) suppresses the legacy _append_gate_env prod-creds injection:
under isolation those creds dead-end, and unreachable creds are worse
than none. DB-needing projects opt into sandbox_services instead. The
flag is deliberately not a panel feature flag - it must travel with the
compose networks: stanzas.
Preserved by construction: agent<->agent A2A and orchestrator->agent SDK
polls on :9000, MCP->orchestrator on :8000, ollama reachability, docker
exec/inspect (daemon socket), host port publishing.
* feat(panel): full mobile responsiveness pass
Shared primitives: useIsMobile (useSyncExternalStore, hydration-safe,
memoized matchMedia subscribe), ResponsiveTable table->card switch below
md (single subtree mounted, no duplicated interactive rows), scrollable
snap TabsList in the base primitive (justify-center-safe so the first
tab stays reachable on overflow), persistent md:hidden bottom tab bar
(Overview/Tasks/Kanban/Chat, safe-area padded).
Applied: card lists for tasks/projects/products/work-sessions/sessions
+ the three raw metrics tables; CEO approval queue / release proposal /
playbook review action rows stack on narrow; command-center reorders
approvals above the fold on mobile; task-header metadata wraps;
Communications + A2A become URL-driven single-pane drill-downs below lg
(fixes the unconstrained-height ScrollArea bug) with dvh heights;
recharts label density/radius adapts via useIsMobile; git diff viewer
gets mobile font + wrap toggle; vh->dvh sweep; chat composers get
safe-area-inset padding; dashboard main p-4 md:p-6 + pb-20 for the bar.
Verified at 375px on the built app: bottom bar, drawer, approval-first
overview, swipeable kanban tab strip. All gates green (eslint, tsc,
vitest 249, next build 24/24 routes).
* feat(auth): cloud auth via FastAPI Users (default-off, single-user cookie session)
ROBOCO_CLOUD_AUTH_ENABLED (default off) lets the panel/API be exposed
beyond localhost without changing the CEO's local no-login flow while
off — get_agent_context and the WS gate are byte-for-byte unchanged in
off-mode. On: header-trust dies for humans — any agent-role claim (ceo
or a privileged PM/board role) with no valid HMAC token or session
cookie is 401, closing the header-spoof hole on the host-published
:8000 port for every role. The agent-fleet HMAC path and the system
self-PATCH keep working unmodified in both modes.
Single seeded CEO user (migration 058 users table, UserTable), no
registration router — idempotent env-driven upsert at startup by PK.
Cookie transport (httponly/secure/samesite=lax) + a JWTStrategy bound
to a fingerprint of the current password hash (rotating the password
invalidates every prior session). Sliding 30-day session: every
authenticated request re-mints the cookie, so an active session never
expires — no unexpected logouts.
Panel: (auth)/login page + proxy.ts (Next 16 rename of middleware; probes
/auth/status over the docker-internal URL, fails open to off) gate the
dashboard; client.ts gets withCredentials + 401->/login. nginx unchanged.
Review hardening: broadened the on-mode rejection from ceo-only to every
non-CEO role without a valid token (was only closed when
ROBOCO_AGENT_AUTH_REQUIRED was also armed); Next-16 proxy.ts rename to
clear the middleware deprecation warning.
* feat(x): RoboCo X account engine — HoM drafts, per-post CEO approval (default-off)
ROBOCO_X_ENGINE_ENABLED (default off, inert without creds). Mirrors the
ReleaseManagerEngine held-artifact shape: XEngine drafts a post when a
release publishes (via a draft_release_post seam on ReleaseProposalService
.approve) and drafts replies to meaningful mentions (dedicated poll loop,
x_seen_mentions dedup ledger, per-cycle/open caps). Drafting is
local-model-only, clamped to 280 chars. Nothing auto-posts — every tweet
is a held task (source x_post/x_reply, confirmed_by_human=False,
Secretary-owned, dispatcher-skipped) the CEO edits/approves/rejects in a
panel queue.
The four OAuth 1.0a secrets live Fernet-encrypted in a singleton
x_credentials row (migration 059, all-or-nothing, API returns only
has_credentials); decryption is server-side, agents never hold creds or
egress. Hand-rolled OAuth 1.0a HMAC-SHA1 signer, no new dependency;
NullXClient makes the unconfigured path a graceful no-op.
XPostService.approve (CEO-only) is the sole caller of post_tweet.
Review hardening: closed a double-post race — the approve path now
re-reads committed task state inside the Redis lock and commits COMPLETED
before releasing, so a concurrent approve that acquires the lock after the
winner released can't re-post (SET-NX is non-waiting, and the route-level
commit landed after the lock dropped). Added a regression test.
* feat(roadmap): board roadmap engine — PO proposes themed cycles, CEO approves per-item (default-off)
ROBOCO_ROADMAP_ENGINE_ENABLED (default off). Weekly, RoadmapEngine opens
ONE held exploration task (source=board_roadmap, confirmed_by_human=False,
Product-Owner-assigned), deduped to one open cycle. A dedicated one-shot
_dispatch_roadmap_exploration spawns the PO solo (not the two-reviewer
board path, which would also spawn HoM + fire Approve-&-Start). The PO
explores read-only (git/KB/metrics/releases/charter/web) and makes one
propose_roadmap call (PO-only content verb) authoring a themed cycle —
goal + 3-7 item drafts — persisted as a roadmap_cycle marker (no table,
no migration; head stays 059).
The CEO acts per-item in the panel roadmap queue: approve materializes a
BACKLOG task (source=roadmap, no assignee — never auto-starts), reject
records a reason; all-items-terminal completes the exploration task.
RoadmapService is idempotent per item. Dispatchers skip board_roadmap.
Includes a real SQLAlchemy dirty-check fix (deep-copy the JSON marker
before mutating, or the in-place edit + reassign compares equal to its
own baseline and the UPDATE is skipped).
Review hardening: create_task_from_draft now honors a draft-declared
source only from a {prompter, roadmap} whitelist — drafts are
LLM-authored, so an unbounded source could impersonate a privileged
origin (release_manager would even wedge that engine's dedup).
* chore(release): 0.17.0
Wave 3 — six default-off subsystems: sandboxed dev DB/Redis, prod
Postgres/Redis network isolation, full mobile UI pass, cloud auth
(FastAPI Users), the RoboCo X account engine, and the board roadmap
engine. Plus the waves 1+2 work already on master since 0.16.0.
Version bumped across the canonical set (config.py, __init__.py,
pyproject.toml, panel/package.json, uv.lock); CHANGELOG [Unreleased]
cut to [0.17.0]; docs/map delta added.
Compose: every optional feature armed :-true in the NAS composes, OFF
in the user-facing registry compose. Two opt-in exceptions default off
(CLOUD_AUTH — needs email/password/secret + TLS, would otherwise fail
startup; ROUTING_STRICT — fail-closed spawning). DB_NETWORK_ISOLATED
stays on in both (coupled to the roboco_data topology).
* chore(compose): arm cloud_auth + routing_strict ON in the NAS composes
Every feature defaults ON in the NAS composes per policy — these two
were wrongly left off. Both keep the ${VAR:-true} form so the operator
controls the real runtime via .env: cloud auth needs
ROBOCO_CLOUD_AUTH_EMAIL/_PASSWORD/_SECRET + TLS set there before a boot
(else startup fails loud), and routing_strict is fail-closed. Registry
compose keeps both off.
* fix(ci): reflow board.md prose (quality gate) + document v0.17.0 env creds
The roadmap section added hard-wrapped prose that failed the markdown
prose gate; reflowed (token-invariant). Also brought .env.example
current: cloud auth (now armed — needs SECRET or startup fails), routing
strict, the X engine (panel-entered OAuth), and web research.
* fix(ci): reduce cyclomatic complexity of five wave-3 blocks (xenon gate)
The wave-3 subagents introduced C-rank functions the CI xenon gate
rejects (my per-item reviews ran ruff/mypy/pytest but not xenon):
- sandbox.janitor_sweep -> extract _list_labeled_sandboxes /
_list_live_agent_containers / _prune_grace
- x_client.fetch_mentions -> extract _parse_mention_items
- x_engine.run_cycle -> extract _process_mentions
- orchestrator._dispatch_pm_work -> extract the source-skip into a
MODULE-level _is_held_ceo_source (module, not method, so the
wholesale-mocked dispatcher unit tests exercise the real logic)
- auth/seed.ensure_seed_user -> extract _apply_seed_updates (module avg -> A)
Behavior-preserving; full suite green (11902), xenon clean.
* fix(ci): declare pyjwt + fastapi-users-db-sqlalchemy as direct deps (deptry)
The cloud-auth code imports jwt and fastapi_users_db_sqlalchemy directly
but they were only transitive deps (via fastapi-users), which deptry
(quality gate, DEP003) rejects. Declared explicitly; deptry roboco/ clean.
Missed originally because local make quality stopped at earlier gates
before reaching deptry.
* feat(x): gate mention replies behind ROBOCO_X_REPLIES_ENABLED (default off)
Per CEO decision: the X engine should only post about releases by
default. Reading mentions needs a paid X API tier, so the mention-reply
half is now a deliberate opt-in on top of release posting.
New default-off flag x_replies_enabled gates the mentions poll loop
(_x_mentions_poll_loop) and XEngine.run_cycle; release-post drafting
(the release-proposal approve hook) is unaffected and still runs when
x_engine_enabled + credentials are set. Added to FEATURE_FLAGS + the
panel card. Tests: release posting works with replies off; run_cycle +
the poll loop are no-ops with replies off.
* fix: 401 only redirects to /login when cloud auth is on; panel-token strips .env quotes
Two bugs that together dead-ended login in secure mode:
- client.ts redirected to /login on ANY 401, so a mismatched panel
token (header-trust/secure mode, cloud auth off) bounced the user to a
login page whose backend route isn't mounted -> 404. Now it probes
/auth/status (bare fetch, no interceptor re-entry) and only redirects
when cloud_auth_enabled.
- make panel-token read the .env secret with grep|cut without stripping
surrounding quotes, so a quoted ROBOCO_AGENT_AUTH_SECRET produced a
token signed with the quotes included — which never verifies against
the orchestrator (docker-compose/pydantic unquote the secret). Now
strips surrounding single/double quotes.
* fix: git-log 500 on '|' in commit message; X queue shows an empty state
- GET /api/git/log 500'd (ValueError: Invalid isoformat) when a commit
SUBJECT contained a '|' (e.g. the 'curl|sh' lockdown commit): the
fixed '|' field delimiter let the subject's pipe shift the split so
author+date collapsed into one field. Switched to \x1f (Unit
Separator), which can't appear in commit content. Regression test with
a piped subject.
- The X Post Queue returned null when empty, so there was no visible
place for the X drafts. It now renders a discoverable empty state
pointing at Settings -> X credentials.
* docs: bring docs/rag + docs/map current for v0.17.0 (waves 1-3)
Agent-facing RAG corpus and codebase map updated for every feature in
the 0.17.0 span, code-verified:
- wave 3: sandbox DB, DB network isolation, cloud auth, X engine
(+ x_replies_enabled sub-flag), board roadmap engine — new RAG
architecture pages + role/tool/config-reference updates; new symbols,
migrations 057-059, panel surfaces, and the get_agent_context
dual-path across the map slices.
- waves 1-2: A2A live view + switchboard, prompter memory
(search_past_tasks), Secretary edit access + PM-lighter scope, the
PR-gate auto-submit turn cut (ROBOCO_PR_GATE_AUTO_SUBMIT_ENABLED).
- correctness fix: api-routes-schemas.md no longer claims the A2A admin
routes are reachable by any authenticated agent — they carry a
_require_ceo gate (wave 2c).
docs/internal, _front.md deltas, and the frozen _complete_map.md
snapshot untouched.
* fix(rag): atomic upsert for indexed-doc tracking (kills e2e segfault)
The indexed-document tracking write used check-then-insert in two paths
(IndexedDocumentRepository.upsert_batch and the file-source
_upsert_doc_record). Under concurrent indexing both callers saw no row
and both inserted, so the second violated uq_indexed_doc_source and
poisoned its transaction — surfacing in CI as the intermittent
_checkin_failed SIGSEGV on the failed connection's pool checkin.
Both paths now use INSERT ... ON CONFLICT DO UPDATE against the
constraint: coalesce keeps an existing title/preview when the new value
is empty (matching the old guards) and metadata is jsonb-merged. The
batch dedupes within itself first (ON CONFLICT can't touch a row twice
in one statement). expire_all after the Core upsert keeps same-session
ORM reads consistent with the merged DB row.
---------
Co-authored-by: Renn F <rennf93@users.noreply.github.com>
283 lines
10 KiB
Python
283 lines
10 KiB
Python
"""api.app coverage — FastAPI factory + lifespan.
|
|
|
|
`create_app()` wires every router. We assert the FastAPI instance comes back
|
|
with the expected metadata and that every prefixed route is mounted, then
|
|
exercise the lifespan with all heavy I/O patched out (init_db, transcription,
|
|
extraction, optimal-service).
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
from contextlib import ExitStack, asynccontextmanager
|
|
from typing import TYPE_CHECKING
|
|
from unittest.mock import AsyncMock, MagicMock, patch
|
|
|
|
import pytest
|
|
from fastapi import FastAPI
|
|
from roboco.api.app import app as default_app
|
|
from roboco.api.app import create_app, lifespan
|
|
from roboco.api.deps import clear_orchestrator, set_orchestrator
|
|
|
|
if TYPE_CHECKING:
|
|
from collections.abc import AsyncIterator
|
|
|
|
|
|
def _registered_paths(app: FastAPI) -> set[str]:
|
|
"""Every registered path, robust to FastAPI 0.137+ routing internals.
|
|
|
|
From 0.137, ``include_router`` wraps each sub-router in an ``_IncludedRouter``
|
|
(a ``BaseRoute`` with no ``.path``) instead of flattening its routes into
|
|
``app.routes`` — so ``{r.path for r in app.routes}`` raised AttributeError
|
|
and missed every included route. Collect HTTP paths from the OpenAPI schema
|
|
(the stable public contract) plus each included router's prefix, which also
|
|
covers websocket mounts like ``/ws`` that never appear in the schema.
|
|
"""
|
|
paths = set(app.openapi().get("paths", {}))
|
|
for r in app.routes:
|
|
path = getattr(r, "path", None)
|
|
if isinstance(path, str):
|
|
paths.add(path)
|
|
prefix = getattr(getattr(r, "include_context", None), "prefix", None)
|
|
if prefix:
|
|
paths.add(prefix)
|
|
return paths
|
|
|
|
|
|
def test_default_app_is_a_fastapi_instance() -> None:
|
|
"""Importing the module yields a configured FastAPI instance."""
|
|
assert isinstance(default_app, FastAPI)
|
|
assert default_app.title == "RoboCo API"
|
|
|
|
|
|
def test_create_app_returns_new_instance_each_call() -> None:
|
|
a = create_app()
|
|
b = create_app()
|
|
assert a is not b
|
|
assert isinstance(a, FastAPI)
|
|
|
|
|
|
def test_create_app_registers_all_router_prefixes() -> None:
|
|
"""Every router is mounted under its expected prefix."""
|
|
app = create_app()
|
|
paths = _registered_paths(app)
|
|
# Spot-check a representative path from each prefix group.
|
|
expected_prefixes = [
|
|
"/api/agents",
|
|
"/api/channels",
|
|
"/api/groups",
|
|
"/api/sessions",
|
|
"/api/messages",
|
|
"/api/notifications",
|
|
"/api/stream",
|
|
"/api/optimal",
|
|
"/api/journals",
|
|
"/api/tasks",
|
|
"/api/kanban",
|
|
"/api/dashboard",
|
|
"/api/orchestrator",
|
|
"/api/a2a",
|
|
"/api/git",
|
|
"/api/projects",
|
|
"/api/providers",
|
|
"/api/work-sessions",
|
|
"/api/docs",
|
|
"/api/auth",
|
|
"/ws",
|
|
]
|
|
for prefix in expected_prefixes:
|
|
assert any(p.startswith(prefix) for p in paths), (
|
|
f"No routes registered under {prefix}"
|
|
)
|
|
|
|
|
|
def test_create_app_includes_v1_flow_routes() -> None:
|
|
"""API v1 (intent-verb) routers from `routes/v1/*` are mounted."""
|
|
app = create_app()
|
|
paths = _registered_paths(app)
|
|
# v1 routers register their own prefixes; we just confirm /api/v1 paths
|
|
# exist after include_router.
|
|
assert any(p.startswith("/api/v1") for p in paths)
|
|
|
|
|
|
def test_create_app_attaches_cors_middleware() -> None:
|
|
app = create_app()
|
|
middleware_classes = [getattr(m.cls, "__name__", "") for m in app.user_middleware]
|
|
assert "CORSMiddleware" in middleware_classes
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Lifespan — startup + shutdown with heavy IO patched
|
|
# ---------------------------------------------------------------------------
|
|
|
|
|
|
@asynccontextmanager
|
|
async def _stub_get_optimal() -> AsyncIterator[MagicMock]:
|
|
"""Stand-in for the optimal-service factory."""
|
|
yield MagicMock()
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_lifespan_startup_and_shutdown_happy_path() -> None:
|
|
"""Lifespan does init_db + service starts + optimal init + clean shutdown."""
|
|
transcription_mock = MagicMock()
|
|
transcription_mock.start = AsyncMock()
|
|
transcription_mock.stop = AsyncMock()
|
|
|
|
with (
|
|
patch("roboco.api.app.init_db", new=AsyncMock()),
|
|
patch("roboco.api.app.close_db", new=AsyncMock()),
|
|
patch("roboco.api.app.TranscriptionService", return_value=transcription_mock),
|
|
patch("roboco.api.app.ExtractionService"),
|
|
patch("roboco.api.app.ExtractionPipeline"),
|
|
patch(
|
|
"roboco.api.app.get_optimal_service",
|
|
new=AsyncMock(return_value=MagicMock()),
|
|
),
|
|
patch("roboco.api.app.close_optimal_service", new=AsyncMock()),
|
|
):
|
|
app = create_app()
|
|
async with lifespan(app):
|
|
# During startup transcription was started + state populated.
|
|
transcription_mock.start.assert_awaited_once()
|
|
assert app.state.transcription is transcription_mock
|
|
assert app.state.extraction is not None
|
|
assert app.state.optimal is not None
|
|
# After yield, shutdown ran.
|
|
transcription_mock.stop.assert_awaited_once()
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_lifespan_stops_orchestrator_before_closing_db_and_optimal() -> None:
|
|
"""orchestrator.stop() runs BEFORE close_optimal_service / close_db on
|
|
shutdown — stop() drains fire-and-forget DB writes (respawn_tracker
|
|
upserts, audit-log rows) and finalizes work sessions, all needing the
|
|
DB still open."""
|
|
order: list[str] = []
|
|
|
|
def _record(label: str) -> AsyncMock:
|
|
async def _fn() -> None:
|
|
order.append(label)
|
|
|
|
return AsyncMock(side_effect=_fn)
|
|
|
|
transcription_mock = MagicMock()
|
|
transcription_mock.start = AsyncMock()
|
|
transcription_mock.stop = AsyncMock()
|
|
orchestrator_mock = MagicMock()
|
|
orchestrator_mock.stop = _record("orchestrator.stop")
|
|
|
|
set_orchestrator(orchestrator_mock)
|
|
try:
|
|
with (
|
|
patch("roboco.api.app.init_db", new=AsyncMock()),
|
|
patch("roboco.api.app.close_db", new=_record("close_db")),
|
|
patch(
|
|
"roboco.api.app.close_optimal_service",
|
|
new=_record("close_optimal_service"),
|
|
),
|
|
patch(
|
|
"roboco.api.app.TranscriptionService", return_value=transcription_mock
|
|
),
|
|
patch("roboco.api.app.ExtractionService"),
|
|
patch("roboco.api.app.ExtractionPipeline"),
|
|
patch(
|
|
"roboco.api.app.get_optimal_service",
|
|
new=AsyncMock(return_value=MagicMock()),
|
|
),
|
|
):
|
|
app = create_app()
|
|
async with lifespan(app):
|
|
pass
|
|
finally:
|
|
# Clear the global so it doesn't leak into other tests.
|
|
clear_orchestrator()
|
|
|
|
# orchestrator.stop() ran, and it ran BEFORE close_optimal_service + close_db.
|
|
assert "orchestrator.stop" in order
|
|
assert order.index("orchestrator.stop") < order.index("close_optimal_service")
|
|
assert order.index("orchestrator.stop") < order.index("close_db")
|
|
# The DB is still the last thing closed (innermost resource).
|
|
assert order.index("close_optimal_service") < order.index("close_db")
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_lifespan_handles_optimal_init_failure_gracefully() -> None:
|
|
"""Optimal-service init failure → app.state.optimal=None, no raise."""
|
|
transcription_mock = MagicMock()
|
|
transcription_mock.start = AsyncMock()
|
|
transcription_mock.stop = AsyncMock()
|
|
|
|
with (
|
|
patch("roboco.api.app.init_db", new=AsyncMock()),
|
|
patch("roboco.api.app.close_db", new=AsyncMock()),
|
|
patch("roboco.api.app.TranscriptionService", return_value=transcription_mock),
|
|
patch("roboco.api.app.ExtractionService"),
|
|
patch("roboco.api.app.ExtractionPipeline"),
|
|
patch(
|
|
"roboco.api.app.get_optimal_service",
|
|
new=AsyncMock(side_effect=RuntimeError("boom")),
|
|
),
|
|
patch("roboco.api.app.close_optimal_service", new=AsyncMock()),
|
|
):
|
|
app = create_app()
|
|
async with lifespan(app):
|
|
assert app.state.optimal is None
|
|
|
|
|
|
def _lifespan_io_patches() -> list:
|
|
transcription_mock = MagicMock()
|
|
transcription_mock.start = AsyncMock()
|
|
transcription_mock.stop = AsyncMock()
|
|
return [
|
|
patch("roboco.api.app.init_db", new=AsyncMock()),
|
|
patch("roboco.api.app.close_db", new=AsyncMock()),
|
|
patch("roboco.api.app.TranscriptionService", return_value=transcription_mock),
|
|
patch("roboco.api.app.ExtractionService"),
|
|
patch("roboco.api.app.ExtractionPipeline"),
|
|
patch(
|
|
"roboco.api.app.get_optimal_service",
|
|
new=AsyncMock(return_value=MagicMock()),
|
|
),
|
|
patch("roboco.api.app.close_optimal_service", new=AsyncMock()),
|
|
]
|
|
|
|
|
|
def _header_trust_warnings(logger_mock: MagicMock) -> list:
|
|
return [
|
|
c
|
|
for c in logger_mock.warning.call_args_list
|
|
if c.args and "HEADER-TRUST" in c.args[0]
|
|
]
|
|
|
|
|
|
async def _run_lifespan_with(*, auth_required: bool, logger_mock: MagicMock) -> None:
|
|
"""Run the lifespan with heavy I/O patched and the auth flag forced."""
|
|
with ExitStack() as stack:
|
|
for cm in _lifespan_io_patches():
|
|
stack.enter_context(cm)
|
|
stack.enter_context(
|
|
patch("roboco.api.app._auth_required", return_value=auth_required)
|
|
)
|
|
stack.enter_context(patch("roboco.api.app.logger", logger_mock))
|
|
app = create_app()
|
|
async with lifespan(app):
|
|
pass
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_lifespan_warns_in_header_trust_mode() -> None:
|
|
"""Startup warns when agent auth is not enforced (header-trust mode)."""
|
|
logger_mock = MagicMock()
|
|
await _run_lifespan_with(auth_required=False, logger_mock=logger_mock)
|
|
assert _header_trust_warnings(logger_mock), (
|
|
"header-trust startup warning expected when auth is not required"
|
|
)
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_lifespan_no_header_trust_warning_when_auth_required() -> None:
|
|
"""No header-trust warning when ROBOCO_AGENT_AUTH_REQUIRED enforces tokens."""
|
|
logger_mock = MagicMock()
|
|
await _run_lifespan_with(auth_required=True, logger_mock=logger_mock)
|
|
assert not _header_trust_warnings(logger_mock)
|