Files
computer-playbook/utils/roles/playwright_coverage.py
T
kevinveenbirkenbachandClaude Opus 5 677a63931c Merge branch 'feature/network/multi-network-serving' into feature/store-i18n
Resolves 68 conflicted files. The governing rule was our structure with their
network semantics: the tor boolean becomes a network mode (clearnet | tor |
multi) throughout the variant layer, while this branch's architecture and mesh
axes, its extracted modules and its i18n content stay.

Where the two sides covered different ground, both are kept rather than one
picked:

- ca_injected answers a ca_client on the deployment's TLS mode OR on an SSO
  issuer that resolves self-signed. 3a3e9ed2c9 records why: an issuer is not
  an object store, so keeping only one side drops the other's coverage.
- get_merged_domains keeps the loud refusal when svc-net-tor is deployed
  without a provisioned node, now gated on their tor_serves_host; their
  node_onion_of returns an empty string there, which would have served every
  onion-exclusive app on clearnet in silence.
- sso_cookie_domains stays the single source for oauth2-proxy's cookie scope.
  Their per-network branch omitted the issuer domain on the onion arm, which
  breaks the callback leg.
- The clearnet CSP batch carries --clearnet-timeout again; their batch dict
  hardcoded zero while the role still passes the flag.
- The dashboard keeps its i18n content dir, image, version and design
  resolution; their side reduced the logo sources to the bare service
  provider values.

Their side wins where it is measurably better: the onion mirror rewrite is
gated per vhost rather than per app, the Playwright onion decision reads the
pass's own domain instead of the role's canonical one, and the matomo
reinjection and dashboard config render per network sibling.

Eight files were broken by the merge without ever carrying a conflict marker,
because git marks only the lines both sides touched:

- utils/cache/domains.py lost the onionize block that sat between two hunks
- roles/sys-front-inj-all/templates/body_filter.lua.j2 called it
- web-app-bluesky, keycloak sso_proxy: the get_entity_name filter was renamed
- trigger/__main__.py, playwright_coverage.py and its test: the deleted tor
  module
- cli/administration/deploy/ci/timings.py read Label.tor
- plugins/filter/csp_filters.py called _aligned_url with four of six arguments
- tests/unit/python/utils/cache/test_domains.py referenced a renamed class
- tests/.../sys-ctl-hlth-csp/files/test_script.py mocked a function main no
  longer calls

Verified: the variant layer (155 tests, 65 subtests), ca_injected (18),
the CI layer (175), the domains cache including the restored guard (32),
retrigger inputs (9), timings and the CSP health script (53). make
quality-high clears autoformat; its remaining findings are tracked separately.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-10-23 09:53:41 +02:00

113 lines
3.7 KiB
Python

"""Which sweep row first triggers each Playwright spec.
A spec runs when the role that ships it is deployed, so its first trigger is
the first row of the sweep carrying that role. Shared by the reporting command
and the integration test that holds the line, so both read one answer.
Two rows are not holes. A row the budget drops still counts: the cut is a
property of the runner's wall clock, not of the coverage the matrix was built
to give. And a role outside the tested lifecycle envelope is excluded on
purpose, so listing its specs beside the real holes is how a reader ends up
writing manual checks for a role nobody deploys.
The caller supplies the entries and the chunk plan, which keeps this module
free of the CI command layer that builds them.
"""
from __future__ import annotations
from typing import TYPE_CHECKING, NamedTuple
from utils.roles.lifecycle import tested_lifecycles
from utils.roles.meta_lookup import get_role_lifecycle
if TYPE_CHECKING:
from collections.abc import Iterable, Mapping, Sequence
from pathlib import Path
SPEC_GLOB = "*/files/playwright/*.js"
class Triggered(NamedTuple):
"""One spec and the row that first runs it."""
role: str
spec: str
variant: str
mode: str
chunk: str
class Excluded(NamedTuple):
"""One spec of a role the sweep does not test, and that role's lifecycle."""
role: str
spec: str
lifecycle: str
class Coverage(NamedTuple):
triggered: list[Triggered]
uncovered: list[tuple[str, str]]
excluded: list[Excluded]
def specs_by_role(roles_dir: Path) -> dict[str, list[str]]:
"""Return ``{role: [spec file name, ...]}`` for every role shipping specs."""
found: dict[str, list[str]] = {}
for path in sorted(roles_dir.glob(SPEC_GLOB)):
found.setdefault(path.parts[-4], []).append(path.name)
return found
def first_rows(entries: Iterable[Mapping[str, str]]) -> dict[str, Mapping[str, str]]:
"""The first entry of the sweep per role, in plan order."""
first: dict[str, Mapping[str, str]] = {}
for entry in entries:
first.setdefault(entry["apps"], entry)
return first
def chunk_index(plan: Iterable[Sequence[Mapping[str, str]]] | None) -> dict[int, str]:
"""Map each entry's identity to its chunk number, in one pass.
Resolving the chunk by scanning the plan per row is quadratic, and the
plan holds the very objects the entry list does, so identity indexes them
without needing the rows to be hashable or comparable.
"""
index: dict[int, str] = {}
for number, chunk in enumerate(plan or []):
for entry in chunk:
index[id(entry)] = str(number)
return index
def classify(
by_role: Mapping[str, list[str]],
first: Mapping[str, Mapping[str, str]],
chunks: Mapping[int, str],
roles_dir: Path,
) -> Coverage:
"""Split every spec into triggered, genuinely uncovered, and excluded."""
tested = tested_lifecycles()
triggered: list[Triggered] = []
uncovered: list[tuple[str, str]] = []
excluded: list[Excluded] = []
for role, names in sorted(by_role.items()):
entry = first.get(role)
if entry is None:
lifecycle = get_role_lifecycle(roles_dir / role, role_name=role) or "unset"
if lifecycle not in tested:
excluded.extend(Excluded(role, name, lifecycle) for name in names)
else:
uncovered.extend((role, name) for name in names)
continue
chunk = chunks.get(id(entry), "-")
triggered.extend(
Triggered(
role, name, entry.get("variant", ""), entry.get("mode", ""), chunk
)
for name in names
)
return Coverage(triggered, uncovered, excluded)