mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 19:01:54 +00:00
kevinveenbirkenbachandClaude Opus 5.5
3610e7b9ef
Of the 76 open code scanning alerts, 39 point at code that can change. svc-ai-mcp-adapter: - A path argument that is empty or made only of dots is refused. Percent-encoding keeps a separator inside its segment, but "." and ".." need none, so an upstream that resolves dot segments could answer from a path the contract does not name. - parse_duration splits on the units. The pattern it used before rescanned a long run of digits from every start position. Tests and the README generators: - Every Jinja environment built with autoescape=False and a "noqa: S701" uses select_autoescape now, as six test modules and utils/templating/jinja.py already did. It escapes templates named *.html, *.htm and *.xml, which none of these call sites loads. - Dead code goes: a doubled "rel" block in the email lint, an unread _SKIP_DIRS, and a module that _resolve returned to no caller. - Two "except ...: pass" blocks become contextlib.suppress and assertRaises. - Nine test modules import unittest.mock one way instead of two, and one lookup test imports its module once. Closes #807 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
102 lines
3.2 KiB
Python
102 lines
3.2 KiB
Python
"""Unit tests for ``plugins/lookup/mcp_credential.py``.
|
|
|
|
The sub-lookups are stubbed so the tests stay hermetic: what matters is that
|
|
one call site cannot resolve the owner, the token key or the fallbacks
|
|
differently from another.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import importlib.util
|
|
import unittest
|
|
from unittest.mock import MagicMock, patch
|
|
|
|
from ansible.errors import AnsibleError
|
|
|
|
from . import PROJECT_ROOT
|
|
|
|
|
|
def _load_module():
|
|
path = PROJECT_ROOT / "plugins/lookup/mcp_credential.py"
|
|
spec = importlib.util.spec_from_file_location("lookup_mcp_credential", str(path))
|
|
module = importlib.util.module_from_spec(spec)
|
|
assert spec and spec.loader
|
|
spec.loader.exec_module(module)
|
|
return module
|
|
|
|
|
|
class _DummyTemplar:
|
|
def __init__(self):
|
|
self.available_variables = {}
|
|
|
|
|
|
class TestMcpCredentialLookup(unittest.TestCase):
|
|
@classmethod
|
|
def setUpClass(cls):
|
|
cls.mod = _load_module()
|
|
|
|
def _run(self, terms, owner="mcp-web-app-gitea", users=None):
|
|
lookup = self.mod.LookupModule()
|
|
lookup._templar = _DummyTemplar()
|
|
lookup._loader = MagicMock()
|
|
|
|
class _StubConfig:
|
|
def run(self, terms_, variables=None, **kwargs):
|
|
return [owner]
|
|
|
|
class _StubUsers:
|
|
def run(self, terms_, variables=None, **kwargs):
|
|
return [users if users is not None else {}]
|
|
|
|
def _dispatch(name, **_kwargs):
|
|
return _StubConfig() if name == "config" else _StubUsers()
|
|
|
|
with patch.object(self.mod.lookup_loader, "get", side_effect=_dispatch):
|
|
return lookup.run(terms, variables={})
|
|
|
|
def test_the_stored_token_is_returned_trimmed(self):
|
|
users = {"tokens": {"web-app-gitea": " tok-123 "}}
|
|
self.assertEqual(["tok-123"], self._run(["web-app-gitea"], users=users))
|
|
|
|
def test_a_provider_without_a_token_yet_reads_empty(self):
|
|
self.assertEqual([""], self._run(["web-app-gitea"], users={"tokens": {}}))
|
|
|
|
def test_another_providers_token_is_not_returned(self):
|
|
users = {"tokens": {"web-app-gitlab": "tok-other"}}
|
|
self.assertEqual([""], self._run(["web-app-gitea"], users=users))
|
|
|
|
def test_a_missing_owner_declaration_raises(self):
|
|
with self.assertRaises(AnsibleError):
|
|
self._run(["web-app-gitea"], owner="")
|
|
|
|
def test_zero_or_too_many_terms_raise(self):
|
|
for terms in ([], ["a", "b", "c"], [" "]):
|
|
with self.assertRaises(AnsibleError):
|
|
self._run(terms)
|
|
|
|
def test_an_unknown_role_raises_instead_of_returning_nothing(self):
|
|
with self.assertRaises(AnsibleError):
|
|
self._run(["web-app-gitea", "mcp-writter"])
|
|
|
|
def test_a_writer_token_is_read_from_its_own_key(self):
|
|
self.assertEqual(
|
|
["w-tok"],
|
|
self._run(
|
|
["web-app-gitea", "mcp-writer"],
|
|
users={"tokens": {"web-app-gitea:mcp-writer": "w-tok"}},
|
|
),
|
|
)
|
|
|
|
def test_a_role_reads_a_separate_token(self):
|
|
self.assertEqual(
|
|
[""],
|
|
self._run(
|
|
["web-app-gitea", "mcp-writer"],
|
|
users={"tokens": {"web-app-gitea": "reader-only"}},
|
|
),
|
|
)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|