276 lines
10 KiB
Python
276 lines
10 KiB
Python
"""Full HTTP/FastAPI plus PostgreSQL contract for the unchanged legacy Agent."""
|
|
|
|
import os
|
|
import unittest
|
|
from uuid import UUID
|
|
|
|
from fastapi.testclient import TestClient
|
|
|
|
from app.agent_auth.service import hash_agent_secret
|
|
from app.config import settings
|
|
from app.main import app
|
|
|
|
|
|
SITE_A = UUID("00000000-0000-4000-8000-000000001a01")
|
|
SITE_B = UUID("00000000-0000-4000-8000-000000001a02")
|
|
ZONE_C = UUID("00000000-0000-4000-8000-000000001a03")
|
|
MINER_A = UUID("00000000-0000-4000-8000-000000001a11")
|
|
MINER_B = UUID("00000000-0000-4000-8000-000000001a12")
|
|
LEGACY_AGENT = "legacy-plexus-http"
|
|
ENROLLED_AGENT = "enrolled-http-agent"
|
|
REVOKED_AGENT = "revoked-http-agent"
|
|
ENROLLED_SECRET = "enrolled-http-agent-secret"
|
|
REVOKED_SECRET = "revoked-http-agent-secret"
|
|
ZONE_A_NETWORK = "10.31.0.0/24"
|
|
ZONE_B_NETWORK = "10.81.0.0/24"
|
|
ZONE_C_NETWORK = "10.82.0.0/24"
|
|
|
|
|
|
def connect():
|
|
from app.agent_auth.repository import default_connection_factory
|
|
|
|
return default_connection_factory()
|
|
|
|
|
|
class LegacyAgentHttpPostgresTests(unittest.TestCase):
|
|
@classmethod
|
|
def setUpClass(cls):
|
|
if os.environ.get("MINEROPS_LEGACY_HTTP_POSTGRES_DISPOSABLE") != "1":
|
|
raise unittest.SkipTest(
|
|
"full-stack legacy contract requires its disposable runner"
|
|
)
|
|
if settings.minerops_agent_id != LEGACY_AGENT:
|
|
raise AssertionError("runner did not bind the configured legacy identity")
|
|
|
|
connection = connect()
|
|
try:
|
|
with connection.cursor() as cur:
|
|
cur.execute(
|
|
"""
|
|
SELECT agent_zone_id
|
|
FROM minerops_site_agents
|
|
WHERE agent_id = %s
|
|
""",
|
|
(LEGACY_AGENT,),
|
|
)
|
|
cls.zone_a = cur.fetchone()[0]
|
|
cur.execute(
|
|
"""
|
|
SELECT id FROM agent_zones
|
|
WHERE site_id = %s AND name = 'Default Zone'
|
|
""",
|
|
(SITE_B,),
|
|
)
|
|
cls.zone_b = cur.fetchone()[0]
|
|
cur.execute(
|
|
"""
|
|
INSERT INTO agent_zone_network_ranges (agent_zone_id, network)
|
|
VALUES
|
|
(%s, %s::cidr),
|
|
(%s, %s::cidr)
|
|
""",
|
|
(cls.zone_a, ZONE_A_NETWORK, cls.zone_b, ZONE_B_NETWORK),
|
|
)
|
|
cur.execute(
|
|
"""
|
|
INSERT INTO agent_zones (id, site_id, name)
|
|
VALUES (%s, %s, 'Revoked Contract Zone')
|
|
""",
|
|
(ZONE_C, SITE_B),
|
|
)
|
|
cur.execute(
|
|
"""
|
|
INSERT INTO agent_zone_network_ranges (agent_zone_id, network)
|
|
VALUES (%s, %s::cidr)
|
|
""",
|
|
(ZONE_C, ZONE_C_NETWORK),
|
|
)
|
|
cur.execute(
|
|
"""
|
|
INSERT INTO minerops_site_agents (
|
|
agent_id, site_id, agent_zone_id, site_name, display_name,
|
|
agent_secret_hash, credential_created_at,
|
|
credential_revoked_at, legacy_auth_disabled_at
|
|
) VALUES
|
|
(%s, %s, %s, 'Contract Site B', 'Enrolled Agent',
|
|
%s, now(), NULL, now()),
|
|
(%s, %s, %s, 'Contract Site B', 'Revoked Agent',
|
|
%s, now() - interval '1 hour', now(),
|
|
now() - interval '1 hour')
|
|
""",
|
|
(
|
|
ENROLLED_AGENT,
|
|
SITE_B,
|
|
cls.zone_b,
|
|
hash_agent_secret(ENROLLED_SECRET),
|
|
REVOKED_AGENT,
|
|
SITE_B,
|
|
ZONE_C,
|
|
hash_agent_secret(REVOKED_SECRET),
|
|
),
|
|
)
|
|
connection.commit()
|
|
finally:
|
|
connection.close()
|
|
|
|
# Deliberately do not enter TestClient as a context manager. That keeps
|
|
# unrelated application startup jobs out of this focused HTTP contract
|
|
# while exercising the real ASGI middleware, dependencies, and routes.
|
|
cls.client = TestClient(app)
|
|
|
|
@classmethod
|
|
def tearDownClass(cls):
|
|
cls.client.close()
|
|
|
|
@staticmethod
|
|
def legacy_headers():
|
|
return {"X-MinerOps-Agent-Secret": settings.minerops_agent_shared_secret}
|
|
|
|
@staticmethod
|
|
def agent_headers(agent_id, secret):
|
|
return {
|
|
"X-MinerOps-Agent-ID": agent_id,
|
|
"X-MinerOps-Agent-Secret": secret,
|
|
}
|
|
|
|
def assert_no_credentials(self, response):
|
|
lowered = response.text.lower()
|
|
for forbidden in (
|
|
"agent_secret_hash", "credential_created_at", "token_hash",
|
|
settings.minerops_agent_shared_secret.lower(),
|
|
ENROLLED_SECRET.lower(), REVOKED_SECRET.lower(),
|
|
):
|
|
self.assertNotIn(forbidden, lowered)
|
|
|
|
def test_10_secret_only_config_is_legacy_identity_and_zone_bound(self):
|
|
response = self.client.get(
|
|
"/api/agent/config?agent_id=" + ENROLLED_AGENT
|
|
+ "&agent_zone_id=" + str(self.zone_b),
|
|
headers=self.legacy_headers(),
|
|
)
|
|
self.assertEqual(response.status_code, 200, response.text)
|
|
payload = response.json()
|
|
self.assertEqual(payload["agent_id"], LEGACY_AGENT)
|
|
self.assertEqual(payload["agent_zone_id"], str(self.zone_a))
|
|
self.assertEqual(
|
|
[item["cidr"] for item in payload["ip_ranges"]],
|
|
[ZONE_A_NETWORK],
|
|
)
|
|
self.assertNotIn(ZONE_B_NETWORK, response.text)
|
|
self.assertNotIn(ZONE_C_NETWORK, response.text)
|
|
self.assert_no_credentials(response)
|
|
|
|
def test_20_known_miners_returns_only_migrated_legacy_zone(self):
|
|
response = self.client.get(
|
|
"/api/agent/known-miners", headers=self.legacy_headers()
|
|
)
|
|
self.assertEqual(response.status_code, 200, response.text)
|
|
self.assertEqual(
|
|
[item["miner_id"] for item in response.json()["miners"]],
|
|
[str(MINER_A)],
|
|
)
|
|
self.assertNotIn(str(MINER_B), response.text)
|
|
self.assert_no_credentials(response)
|
|
|
|
def test_30_exact_old_checkin_shape_succeeds_and_spoofing_fails(self):
|
|
old_body = {
|
|
"agent_id": LEGACY_AGENT,
|
|
"site_name": "Plexus",
|
|
"hostname": "legacy-contract-host",
|
|
"version": "0.4-command-queue",
|
|
"ip_address": "",
|
|
"local_time": "2026-08-31T00:00:00Z",
|
|
}
|
|
response = self.client.post(
|
|
"/api/agent/checkin", headers=self.legacy_headers(), json=old_body
|
|
)
|
|
self.assertEqual(response.status_code, 200, response.text)
|
|
self.assertEqual(response.json()["agent_id"], LEGACY_AGENT)
|
|
self.assertEqual(response.json()["agent_zone_id"], str(self.zone_a))
|
|
self.assert_no_credentials(response)
|
|
|
|
spoofed = self.client.post(
|
|
"/api/agent/checkin?agent_id=" + ENROLLED_AGENT,
|
|
headers=self.legacy_headers(),
|
|
json={**old_body, "agent_id": "body-spoof-agent"},
|
|
)
|
|
self.assertEqual(spoofed.status_code, 422, spoofed.text)
|
|
connection = connect()
|
|
try:
|
|
with connection.cursor() as cur:
|
|
cur.execute(
|
|
"SELECT count(*) FROM minerops_site_agents WHERE agent_id = %s",
|
|
("body-spoof-agent",),
|
|
)
|
|
self.assertEqual(cur.fetchone()[0], 0)
|
|
finally:
|
|
connection.close()
|
|
|
|
def test_40_global_secret_rejects_unknown_and_enrolled_explicit_ids(self):
|
|
for agent_id, expected_status in (
|
|
("unknown-agent", 403),
|
|
(ENROLLED_AGENT, 401),
|
|
):
|
|
with self.subTest(agent_id=agent_id):
|
|
response = self.client.get(
|
|
"/api/agent/config",
|
|
headers=self.agent_headers(
|
|
agent_id, settings.minerops_agent_shared_secret
|
|
),
|
|
)
|
|
self.assertEqual(response.status_code, expected_status, response.text)
|
|
self.assert_no_credentials(response)
|
|
|
|
def test_50_enrolled_agent_uses_per_agent_secret_and_own_zone(self):
|
|
response = self.client.get(
|
|
"/api/agent/config",
|
|
headers=self.agent_headers(ENROLLED_AGENT, ENROLLED_SECRET),
|
|
)
|
|
self.assertEqual(response.status_code, 200, response.text)
|
|
payload = response.json()
|
|
self.assertEqual(payload["agent_id"], ENROLLED_AGENT)
|
|
self.assertEqual(payload["agent_zone_id"], str(self.zone_b))
|
|
self.assertEqual(
|
|
[item["cidr"] for item in payload["ip_ranges"]],
|
|
[ZONE_B_NETWORK],
|
|
)
|
|
self.assertNotIn(ZONE_A_NETWORK, response.text)
|
|
self.assertNotIn(ZONE_C_NETWORK, response.text)
|
|
self.assert_no_credentials(response)
|
|
|
|
def test_60_revoked_credential_cannot_use_per_agent_or_global_secret(self):
|
|
for secret in (REVOKED_SECRET, settings.minerops_agent_shared_secret):
|
|
with self.subTest(secret_kind="global" if secret != REVOKED_SECRET else "agent"):
|
|
response = self.client.get(
|
|
"/api/agent/config",
|
|
headers=self.agent_headers(REVOKED_AGENT, secret),
|
|
)
|
|
self.assertEqual(response.status_code, 403, response.text)
|
|
self.assert_no_credentials(response)
|
|
|
|
def test_90_durably_retired_legacy_identity_loses_secret_only_fallback(self):
|
|
connection = connect()
|
|
try:
|
|
with connection.cursor() as cur:
|
|
cur.execute(
|
|
"""
|
|
UPDATE minerops_site_agents
|
|
SET legacy_auth_disabled_at = now()
|
|
WHERE agent_id = %s
|
|
""",
|
|
(LEGACY_AGENT,),
|
|
)
|
|
connection.commit()
|
|
finally:
|
|
connection.close()
|
|
|
|
response = self.client.get(
|
|
"/api/agent/config", headers=self.legacy_headers()
|
|
)
|
|
self.assertEqual(response.status_code, 401, response.text)
|
|
self.assert_no_credentials(response)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|