70 lines
2.3 KiB
Python
70 lines
2.3 KiB
Python
from pathlib import Path
|
|
|
|
from app.config import Settings
|
|
from app.runtime_settings import (
|
|
EncryptedSettingsStore,
|
|
RuntimeSettingsTestResult,
|
|
generate_secret,
|
|
)
|
|
|
|
|
|
def create_store(path: Path) -> EncryptedSettingsStore:
|
|
settings = Settings(
|
|
_env_file=None,
|
|
runtime_settings_dir=str(path),
|
|
database_url="postgresql://user:secret@postgres:5432/app",
|
|
redis_url="redis://:secret@redis:6379/0",
|
|
)
|
|
return EncryptedSettingsStore(settings)
|
|
|
|
|
|
def test_runtime_secrets_are_encrypted_and_never_returned(tmp_path: Path) -> None:
|
|
store = create_store(tmp_path)
|
|
store.update(
|
|
{
|
|
"s3_endpoint": "http://minio:9000",
|
|
"s3_public_endpoint": "http://localhost:9000",
|
|
"s3_access_key_id": "service-account",
|
|
"s3_secret_access_key": "very-private-secret",
|
|
}
|
|
)
|
|
|
|
response = store.public_response()
|
|
assert "s3_secret_access_key" not in response.values
|
|
assert response.configured["s3_secret_access_key"] is True
|
|
assert b"very-private-secret" not in store.data_path.read_bytes()
|
|
|
|
|
|
def test_readiness_requires_configuration_and_successful_tests(tmp_path: Path) -> None:
|
|
store = create_store(tmp_path)
|
|
store.update(
|
|
{
|
|
"s3_endpoint": "http://minio:9000",
|
|
"s3_public_endpoint": "http://localhost:9000",
|
|
"s3_access_key_id": "access",
|
|
"s3_secret_access_key": "secret",
|
|
"ai_provider": "lingke",
|
|
"ai_base_url": "https://example.com/v1",
|
|
"ai_api_key": "api-secret",
|
|
"orchestrator_model": "planner",
|
|
"vision_model": "vision",
|
|
"image_model": "gpt-image-2",
|
|
}
|
|
)
|
|
assert store.public_response().readiness.ready is False
|
|
|
|
for target in ("infrastructure", "storage", "ai_models"):
|
|
store.record_test(RuntimeSettingsTestResult(target=target, ok=True, message="ok"))
|
|
|
|
assert store.public_response().readiness.ready is True
|
|
|
|
store.update({"image_model": "another-image-model"})
|
|
assert store.public_response().readiness.ready is False
|
|
assert store.public_response().tests.get("ai_models") is None
|
|
|
|
|
|
def test_secret_generators_use_expected_lengths() -> None:
|
|
assert len(generate_secret("hex24")) == 48
|
|
assert len(generate_secret("hex32")) == 64
|
|
assert len(generate_secret("base64_32")) == 44
|