phase: 173_docs_push_creds_split
All gates green. Final report: **Phase 173 — final verification pass (all tasks already complete in `complete/`)** - Verified the full implementation is in the working tree: `docs_user`/`docs_token` settings + catalogue rows (task 01), `docs_repo` PUT 422 guard + `docs_token` write-only pin (task 02), `run_git(env)` + `push_document(user, token)` credential env (task 03), `settings_migrate.py` wired into `create_app()` (task 04), E2E suite (task 05). - **Completion criteria:** 1. GET `/api/admin/settings` lists `docs_user` (plain) + `docs_token` (secret, `value=null`), token never in any body — ✅ `test_docs_token_is_write_only_masked_end_to_end` + E2E sentinel-absent-from-DOM 2. PUT `docs_repo` with `://user:pass@` → 422 naming the fields; clean URL passes — ✅ integration + E2E UI-side 3. Token set → `GIT_CURL_USERNAME`/`GIT_CURL_PASSWORD`/`GIT_TERMINAL_PROMPT=0` on every git step; empty → `env=None` — ✅ mocked-git unit tests 4. Legacy env split once at startup, idempotent, one INFO line, `.env` untouched — ✅ `test_settings_migrate.py` (4 shapes) + `test_docs_push_migrate.py` 5. Full suite green, coverage >90%, lint clean — ✅ 6. E2E isolated: `test_docs_push_creds.py` 4/4; regression set (panel + layout + response_to_docs) 21/21 — ✅ 7. Commit + phase move — harness's job (per instructions, not mine). 8. README/AGENTS consistent — ✅ (below) - Tests/lint: `uv run pytest` exit 0 (4112 passed) · `uv run pytest --cov=app --cov-report=term-missing` TOTAL 99% · `uv run ruff check .` clean · `uv run pyright` 0 errors - Docs: README.md (incl. Docs-push config section, guard/migration paragraph, `.env.example` block) and AGENTS.md verified consistent in full; fixed two stale docstrings in `app/config.py` + `app/core/settings_catalog.py` (`is_set` → the API's actual `has_value` field). - No live-infrastructure changes (no live step in this phase). No next pending phase — `todo/` held only 173.
This commit is contained in:
@@ -9,19 +9,33 @@ ever involved.
|
||||
|
||||
The module skips (``pytest.skip``) when ``git --version`` fails — a
|
||||
machine without git must not see hard failures.
|
||||
|
||||
Phase 173 (C2/C5) adds a mocked-``run_git`` section: the FULL 10-step
|
||||
sequence is exercised against a fake git (no real repo) to pin the
|
||||
credential transport — no token → every step gets ``env=None``
|
||||
(byte-identical to the pre-phase call); a token → every step gets
|
||||
``GIT_CURL_USERNAME`` / ``GIT_CURL_PASSWORD`` / ``GIT_TERMINAL_PROMPT=0``
|
||||
merged over a controlled ``os.environ`` (``PATH`` survives the
|
||||
subprocess env-replacement trap); a whitespace-only token = empty;
|
||||
and a failing step still raises :class:`DocsPushError` with git's
|
||||
stderr, credential-agnostic.
|
||||
"""
|
||||
from __future__ import annotations
|
||||
|
||||
import subprocess
|
||||
from pathlib import Path
|
||||
from typing import TypedDict
|
||||
|
||||
import pytest
|
||||
|
||||
import app.core.docs_push as docs_push_mod
|
||||
from app.core.docs_push import DocsPushError, push_document
|
||||
from scripts.git_sync import GitSyncError
|
||||
|
||||
BASE = "main"
|
||||
BRANCH = "bor-docs"
|
||||
REL = "docs/note.md"
|
||||
CLEAN_REPO = "https://git.example.com/docs.git" # phase 173: the credential-free form
|
||||
IDENTITY = ("-c", "commit.gpgsign=false", "-c", "user.name=Test", "-c", "user.email=t@example.com")
|
||||
|
||||
|
||||
@@ -198,3 +212,158 @@ def test_unsafe_rel_path_is_refused_before_any_git(bare_repo: Path, tmp_path: Pa
|
||||
)
|
||||
# No checkout was even attempted.
|
||||
assert not (tmp_path / "w").exists()
|
||||
|
||||
|
||||
# --- phase 173: credentials on the wire (C2/C5, mocked git) ---------------
|
||||
|
||||
|
||||
class _GitCall(TypedDict):
|
||||
"""One recorded ``run_git`` call (argv / cwd / env)."""
|
||||
|
||||
argv: list[str]
|
||||
cwd: Path
|
||||
env: dict[str, str] | None
|
||||
|
||||
|
||||
def _fake_run_git(
|
||||
monkeypatch: pytest.MonkeyPatch, push_stderr: str = ""
|
||||
) -> list[_GitCall]:
|
||||
"""Monkeypatch ``app.core.docs_push.run_git``; record each call
|
||||
(argv / cwd / env).
|
||||
|
||||
The FULL 10-step sequence runs: clone (the work dir is absent) →
|
||||
the base fetch → the ``FETCH_HEAD`` capture → the branch fetch
|
||||
(ALWAYS raises — the branch does not exist on the remote yet,
|
||||
the swallowed path) → the branch probe → ``checkout -B`` → add →
|
||||
commit → push (raises when *push_stderr* is set — the
|
||||
un-swallowed failure, task 03 5d) → the ``HEAD`` capture. Returns
|
||||
``(BRANCH, "b" * 40)`` on success.
|
||||
"""
|
||||
calls: list[_GitCall] = []
|
||||
|
||||
def fake_run(
|
||||
argv: list[str], cwd: Path, env: dict[str, str] | None = None
|
||||
) -> str:
|
||||
calls.append({"argv": list(argv), "cwd": cwd, "env": env})
|
||||
key = tuple(argv)
|
||||
if key == ("git", "fetch", "--depth", "100", "origin", BRANCH):
|
||||
raise GitSyncError(
|
||||
f"git fetch --depth 100 origin {BRANCH} failed (exit 128): "
|
||||
f"fatal: couldn't find remote ref {BRANCH}"
|
||||
)
|
||||
if push_stderr and key == ("git", "push", "origin", BRANCH):
|
||||
raise GitSyncError(
|
||||
f"git push origin {BRANCH} failed (exit 128): {push_stderr}"
|
||||
)
|
||||
if key[:2] == ("git", "rev-parse"):
|
||||
return "a" * 40 if key[-1] == "FETCH_HEAD" else "b" * 40
|
||||
return ""
|
||||
|
||||
monkeypatch.setattr(docs_push_mod, "run_git", fake_run)
|
||||
return calls
|
||||
|
||||
|
||||
def _args(work: Path) -> dict[str, str]:
|
||||
return dict(
|
||||
repo=CLEAN_REPO,
|
||||
base_branch=BASE,
|
||||
branch=BRANCH,
|
||||
work_dir=str(work),
|
||||
rel_path=REL,
|
||||
content="# Note\n",
|
||||
commit_message="docs: note",
|
||||
)
|
||||
|
||||
|
||||
def test_no_token_env_is_none_on_every_step(
|
||||
tmp_path: Path, monkeypatch: pytest.MonkeyPatch
|
||||
) -> None:
|
||||
"""Task 03 5a (C5 byte-identity pin): default args (no token) →
|
||||
EVERY git step of the full sequence gets ``env=None`` — the
|
||||
pre-phase ``subprocess.run`` shape, unchanged."""
|
||||
work = tmp_path / "work" # absent — the clone step runs too
|
||||
calls = _fake_run_git(monkeypatch)
|
||||
|
||||
branch, sha = push_document(**_args(work))
|
||||
|
||||
assert (branch, sha) == (BRANCH, "b" * 40)
|
||||
assert len(calls) == 10 # clone, fetch×2, rev-parse×2, branch, checkout, add, commit, push
|
||||
for call in calls:
|
||||
assert call["env"] is None
|
||||
# The CLEAN URL stays in the argv (the credential never appears
|
||||
# because it is not passed at all).
|
||||
assert calls[0]["argv"][-2] == CLEAN_REPO
|
||||
|
||||
|
||||
def test_token_env_on_every_step_merged_over_environ(
|
||||
tmp_path: Path, monkeypatch: pytest.MonkeyPatch
|
||||
) -> None:
|
||||
"""Task 03 5b (C2): token set → EVERY git step of a successful push
|
||||
gets the 3-var credential env MERGED OVER a controlled
|
||||
``os.environ`` — ``PATH`` survives the subprocess
|
||||
env-replacement trap, the credential never lands in the argv,
|
||||
and the clean URL stays in it."""
|
||||
monkeypatch.setenv("PATH", "/usr/bin")
|
||||
monkeypatch.setenv("BOR_TEST_ENV", "sentinel")
|
||||
work = tmp_path / "work"
|
||||
calls = _fake_run_git(monkeypatch)
|
||||
|
||||
push_document(**_args(work), user="alice", token="s3cret")
|
||||
|
||||
assert len(calls) == 10
|
||||
for call in calls:
|
||||
env = call["env"]
|
||||
assert isinstance(env, dict)
|
||||
assert env["GIT_CURL_USERNAME"] == "alice"
|
||||
assert env["GIT_CURL_PASSWORD"] == "s3cret"
|
||||
assert env["GIT_TERMINAL_PROMPT"] == "0"
|
||||
assert env["PATH"] == "/usr/bin" # the merge-over-os.environ pin
|
||||
assert env["BOR_TEST_ENV"] == "sentinel" # the parent env survives
|
||||
# C2: the credential travels ONLY in the environment.
|
||||
assert "alice" not in call["argv"]
|
||||
assert "s3cret" not in call["argv"]
|
||||
# The clean URL is in the argv, untouched.
|
||||
assert CLEAN_REPO in calls[0]["argv"]
|
||||
|
||||
|
||||
def test_whitespace_only_token_is_treated_as_empty(
|
||||
tmp_path: Path, monkeypatch: pytest.MonkeyPatch
|
||||
) -> None:
|
||||
"""Task 03 5c (the ``.strip()`` rule): a whitespace-only token is
|
||||
the no-credentials state → every step gets ``env=None``."""
|
||||
calls = _fake_run_git(monkeypatch)
|
||||
|
||||
push_document(**_args(tmp_path / "work"), user="alice", token=" ")
|
||||
|
||||
assert len(calls) == 10
|
||||
for call in calls:
|
||||
assert call["env"] is None
|
||||
|
||||
|
||||
def test_failing_step_raises_docs_push_error_with_and_without_credentials(
|
||||
tmp_path: Path, monkeypatch: pytest.MonkeyPatch
|
||||
) -> None:
|
||||
"""Task 03 5d: a failing step (the push) still raises
|
||||
:class:`DocsPushError` with git's stderr — the error path is
|
||||
credential-agnostic (with and without the credential env); the
|
||||
failing step itself still carries the credential env when a token
|
||||
is set."""
|
||||
stderr = "fatal: rejected (simulated non-fast-forward)"
|
||||
|
||||
# without credentials (C5 — the pre-phase error path)
|
||||
calls = _fake_run_git(monkeypatch, push_stderr=stderr)
|
||||
with pytest.raises(DocsPushError) as excinfo:
|
||||
push_document(**_args(tmp_path / "w1"))
|
||||
msg = str(excinfo.value)
|
||||
assert f"git push origin {BRANCH} failed (exit 128): {stderr}" in msg
|
||||
assert calls[-1]["env"] is None # the failed push step — no env
|
||||
|
||||
# with credentials (the error carries the full stderr for logs;
|
||||
# the API layer's sanitize_error stays the defense-in-depth)
|
||||
calls = _fake_run_git(monkeypatch, push_stderr=stderr)
|
||||
with pytest.raises(DocsPushError) as excinfo:
|
||||
push_document(**_args(tmp_path / "w2"), user="alice", token="s3cret")
|
||||
msg = str(excinfo.value)
|
||||
assert f"git push origin {BRANCH} failed (exit 128): {stderr}" in msg
|
||||
assert isinstance(calls[-1]["env"], dict)
|
||||
assert calls[-1]["env"]["GIT_CURL_PASSWORD"] == "s3cret"
|
||||
|
||||
Reference in New Issue
Block a user