mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-08 11:46:35 +00:00
kevinveenbirkenbachandClaude Opus 4.8
fc77d9d265
Resolve the 80 open CodeQL/code-scanning alerts on this branch. Security-sensitive fixes: - cli/administration/deploy/development: break the unsafe import cycle by extracting the env/arg helpers into a leaf module `env.py`, giving the load-time DAG compose -> common -> deps -> env. - web-app-bluesky login-broker server.js: prototype-pollution guard on cookie parsing, CR/LF + control-char log sanitisation, HTML-escaped exception text, and a ReDoS-bounded handle regex. - web-app-baserow SSO: harden the open-redirect `next` handling. - network diagnose probes: require TLS >= 1.2. - actionlint installer: validate tar members against path traversal. - decidim/apt-purge lint regexes: rewrite to avoid catastrophic backtracking. - 6x Playwright URL regexes anchored; crs-k/stale-branches pinned to a commit SHA. Mechanical cleanups: unused imports/globals/locals, empty-except comments, import-and-import-from, implicit-string-concat, multiple-definition, unreachable/useless-assignment. False positives are intentionally left in place (Django settings patches, Odoo __manifest__, side-effect imports, cross-module symbols). Recurrence guards: - import-linter contract (pyproject + tests/lint) locks the dev-deploy package acyclic; a new cycle now fails CI instead of only CodeQL. - new lint test requires every bandit (S###) `noqa` to carry a justification. - BLE001 (blind-except) added to ruff as a ratchet (tests/roles exempt, current production offenders grandfathered). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
79 lines
3.2 KiB
Python
79 lines
3.2 KiB
Python
"""Unit tests for :mod:`utils.install.primitives`."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import os
|
|
import unittest
|
|
import unittest.mock as mock
|
|
|
|
from utils.install import primitives
|
|
|
|
|
|
class TestRunPrivileged(unittest.TestCase):
|
|
def test_runs_directly_as_root(self) -> None:
|
|
with (
|
|
mock.patch.object(primitives.os, "geteuid", return_value=0),
|
|
mock.patch.object(primitives.subprocess, "run") as run,
|
|
):
|
|
primitives.run_privileged(["apt-get", "update"])
|
|
run.assert_called_once_with(["apt-get", "update"], check=True)
|
|
|
|
def test_prepends_sudo_for_non_root(self) -> None:
|
|
with (
|
|
mock.patch.object(primitives.os, "geteuid", return_value=1000),
|
|
mock.patch.object(primitives.shutil, "which", return_value="/usr/bin/sudo"),
|
|
mock.patch.object(primitives.subprocess, "run") as run,
|
|
):
|
|
primitives.run_privileged(["apt-get", "update"])
|
|
run.assert_called_once_with(["sudo", "apt-get", "update"], check=True)
|
|
|
|
def test_no_sudo_when_unavailable(self) -> None:
|
|
with (
|
|
mock.patch.object(primitives.os, "geteuid", return_value=1000),
|
|
mock.patch.object(primitives.shutil, "which", return_value=None),
|
|
mock.patch.object(primitives.subprocess, "run") as run,
|
|
):
|
|
primitives.run_privileged(["echo", "hi"])
|
|
run.assert_called_once_with(["echo", "hi"], check=True)
|
|
|
|
|
|
class TestEnsureDirOnPath(unittest.TestCase):
|
|
def test_prepends_when_absent(self) -> None:
|
|
with mock.patch.dict(os.environ, {"PATH": "/usr/bin:/bin"}, clear=False):
|
|
primitives.ensure_dir_on_path("/opt/bin")
|
|
self.assertTrue(os.environ["PATH"].startswith("/opt/bin" + os.pathsep))
|
|
|
|
def test_idempotent_when_present(self) -> None:
|
|
with mock.patch.dict(os.environ, {"PATH": "/opt/bin:/usr/bin"}, clear=False):
|
|
primitives.ensure_dir_on_path("/opt/bin")
|
|
self.assertEqual(os.environ["PATH"], "/opt/bin:/usr/bin")
|
|
|
|
def test_empty_directory_noop(self) -> None:
|
|
original = "/usr/bin"
|
|
with mock.patch.dict(os.environ, {"PATH": original}, clear=False):
|
|
primitives.ensure_dir_on_path("")
|
|
self.assertEqual(os.environ["PATH"], original)
|
|
|
|
|
|
class TestInstallWithOptionalSudo(unittest.TestCase):
|
|
def test_succeeds_without_sudo(self) -> None:
|
|
with mock.patch.object(primitives.subprocess, "run") as run:
|
|
primitives.install_with_optional_sudo(["install", "-d", "/tmp/x"])
|
|
run.assert_called_once_with(["install", "-d", "/tmp/x"], check=True)
|
|
|
|
def test_retries_with_sudo_on_failure(self) -> None:
|
|
err = primitives.subprocess.CalledProcessError(returncode=1, cmd=["install"])
|
|
with (
|
|
mock.patch.object(
|
|
primitives.subprocess, "run", side_effect=err
|
|
) as plain_run,
|
|
mock.patch.object(primitives, "run_privileged") as privileged,
|
|
):
|
|
primitives.install_with_optional_sudo(["install", "-d", "/usr/local/bin"])
|
|
plain_run.assert_called_once()
|
|
privileged.assert_called_once_with(["install", "-d", "/usr/local/bin"])
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|