mirror of
https://github.com/rennf93/roboco.git
synced 2026-08-03 07:23:24 +02:00
7b84162ae9
* feat(github-app): App credentials, installation tokens, and a Select repo picker RoboCo was 100% PAT-based. A singleton Fernet-encrypted github_app_credentials row (migration 077, telegram-credentials pattern) now stores the App id + private key; github_app_auth mints RS256 app JWTs and caches installation tokens until 5 minutes before expiry. Projects can bind an installation (projects.github_installation_id): get_decrypted_token returns a minted installation token for bound projects and falls back to the stored PAT on any minting failure, so all ten token consumers work unchanged. CEO-gated routes expose credentials CRUD plus installation/repo listing, and the New Project dialog gains a Select repo picker (disabled with a HelpTip until the App is configured) that fills the git URL and binds the installation; manual URL + PAT stays the default path. * test(panel): mock the GitHub App credentials card in the settings page test --------- Co-authored-by: Renn F <rennf93@users.noreply.github.com>
97 lines
3.1 KiB
Python
97 lines
3.1 KiB
Python
"""GitHubAppCredentialsService coverage — plain app_id, encrypted private key,
|
|
all-or-nothing set/clear (mirrors ``test_telegram_credentials_service.py``).
|
|
|
|
Drives a real ``db_session`` via the project's Postgres-backed conftest.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
from typing import TYPE_CHECKING
|
|
|
|
import pytest
|
|
import pytest_asyncio
|
|
from roboco.db.tables import GitHubAppCredentialsTable
|
|
from roboco.services.github_app_credentials import (
|
|
GitHubAppCredentialsService,
|
|
GitHubAppCredentialsValidationError,
|
|
get_github_app_credentials_service,
|
|
)
|
|
from sqlalchemy import select
|
|
|
|
if TYPE_CHECKING:
|
|
from collections.abc import AsyncIterator
|
|
|
|
from sqlalchemy.ext.asyncio import AsyncSession
|
|
|
|
_CREDS = {
|
|
"app_id": "123456",
|
|
"private_key": "-----BEGIN PRIVATE KEY-----\nfake-pem\n-----END PRIVATE KEY-----",
|
|
}
|
|
|
|
|
|
@pytest_asyncio.fixture
|
|
async def svc(
|
|
db_session: AsyncSession,
|
|
) -> AsyncIterator[GitHubAppCredentialsService]:
|
|
yield get_github_app_credentials_service(db_session)
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_unset_has_no_credentials(svc: GitHubAppCredentialsService) -> None:
|
|
assert await svc.has_credentials() is False
|
|
assert await svc.get_decrypted() is None
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_set_both_stores_and_roundtrips(
|
|
svc: GitHubAppCredentialsService,
|
|
) -> None:
|
|
has_creds = await svc.set_credentials(**_CREDS)
|
|
assert has_creds is True
|
|
assert await svc.has_credentials() is True
|
|
|
|
decrypted = await svc.get_decrypted()
|
|
assert decrypted is not None
|
|
assert decrypted.app_id == _CREDS["app_id"]
|
|
assert decrypted.private_key == _CREDS["private_key"]
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_app_id_stored_plain_key_encrypted(
|
|
svc: GitHubAppCredentialsService, db_session: AsyncSession
|
|
) -> None:
|
|
await svc.set_credentials(**_CREDS)
|
|
result = await db_session.execute(select(GitHubAppCredentialsTable).limit(1))
|
|
row = result.scalar_one_or_none()
|
|
assert row is not None
|
|
assert row.app_id == _CREDS["app_id"]
|
|
assert row.private_key_encrypted != _CREDS["private_key"]
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_clearing_both_removes_row(svc: GitHubAppCredentialsService) -> None:
|
|
await svc.set_credentials(**_CREDS)
|
|
has_creds = await svc.set_credentials(app_id="", private_key="")
|
|
assert has_creds is False
|
|
assert await svc.has_credentials() is False
|
|
assert await svc.get_decrypted() is None
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_partial_set_is_rejected(svc: GitHubAppCredentialsService) -> None:
|
|
with pytest.raises(GitHubAppCredentialsValidationError):
|
|
await svc.set_credentials(app_id="only-one", private_key="")
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_rotate_overwrites_previous_values(
|
|
svc: GitHubAppCredentialsService,
|
|
) -> None:
|
|
await svc.set_credentials(**_CREDS)
|
|
rotated = {"app_id": "654321", "private_key": _CREDS["private_key"] + "-rotated"}
|
|
await svc.set_credentials(**rotated)
|
|
decrypted = await svc.get_decrypted()
|
|
assert decrypted is not None
|
|
assert decrypted.app_id == rotated["app_id"]
|
|
assert decrypted.private_key == rotated["private_key"]
|