Files
computer-playbook/tests/unit/python/utils/github/variant/test_selection.py
T
kevinveenbirkenbachandClaude Opus 5 677a63931c Merge branch 'feature/network/multi-network-serving' into feature/store-i18n
Resolves 68 conflicted files. The governing rule was our structure with their
network semantics: the tor boolean becomes a network mode (clearnet | tor |
multi) throughout the variant layer, while this branch's architecture and mesh
axes, its extracted modules and its i18n content stay.

Where the two sides covered different ground, both are kept rather than one
picked:

- ca_injected answers a ca_client on the deployment's TLS mode OR on an SSO
  issuer that resolves self-signed. 3a3e9ed2c9 records why: an issuer is not
  an object store, so keeping only one side drops the other's coverage.
- get_merged_domains keeps the loud refusal when svc-net-tor is deployed
  without a provisioned node, now gated on their tor_serves_host; their
  node_onion_of returns an empty string there, which would have served every
  onion-exclusive app on clearnet in silence.
- sso_cookie_domains stays the single source for oauth2-proxy's cookie scope.
  Their per-network branch omitted the issuer domain on the onion arm, which
  breaks the callback leg.
- The clearnet CSP batch carries --clearnet-timeout again; their batch dict
  hardcoded zero while the role still passes the flag.
- The dashboard keeps its i18n content dir, image, version and design
  resolution; their side reduced the logo sources to the bare service
  provider values.

Their side wins where it is measurably better: the onion mirror rewrite is
gated per vhost rather than per app, the Playwright onion decision reads the
pass's own domain instead of the role's canonical one, and the matomo
reinjection and dashboard config render per network sibling.

Eight files were broken by the merge without ever carrying a conflict marker,
because git marks only the lines both sides touched:

- utils/cache/domains.py lost the onionize block that sat between two hunks
- roles/sys-front-inj-all/templates/body_filter.lua.j2 called it
- web-app-bluesky, keycloak sso_proxy: the get_entity_name filter was renamed
- trigger/__main__.py, playwright_coverage.py and its test: the deleted tor
  module
- cli/administration/deploy/ci/timings.py read Label.tor
- plugins/filter/csp_filters.py called _aligned_url with four of six arguments
- tests/unit/python/utils/cache/test_domains.py referenced a renamed class
- tests/.../sys-ctl-hlth-csp/files/test_script.py mocked a function main no
  longer calls

Verified: the variant layer (155 tests, 65 subtests), ca_injected (18),
the CI layer (175), the domains cache including the restored guard (32),
retrigger inputs (9), timings and the CSP health script (53). make
quality-high clears autoformat; its remaining findings are tracked separately.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-10-23 09:53:41 +02:00

262 lines
10 KiB
Python

from __future__ import annotations
import unittest
from utils.github.variant import selection
from utils.symbol_glossary import to_emoji
def _row(name: str, variant: int) -> dict:
return {"name": name, "variant": variant}
class TestParseAscii(unittest.TestCase):
def test_a_bare_role_pins_nothing(self) -> None:
pin = selection.parse("web-app-a")
self.assertEqual(pin, selection.Pin("web-app-a"))
self.assertFalse(pin.pinned)
def test_every_axis_is_read(self) -> None:
self.assertEqual(
selection.parse("web-app-a#0,2@swarm+tor%debian/zfs:arm64"),
selection.Pin(
"web-app-a", (0, 2), "swarm", "tor", "debian", "zfs", "arm64"
),
)
def test_the_distro_and_filesystem_are_optional_like_the_rest(self) -> None:
pin = selection.parse("web-app-a@swarm")
self.assertIsNone(pin.distro)
self.assertIsNone(pin.filesystem)
def test_a_filesystem_alone_still_counts_as_a_narrowing(self) -> None:
pin = selection.parse("web-app-a/ext4")
self.assertEqual(pin.filesystem, "ext4")
self.assertTrue(pin.pinned)
def test_an_unknown_distro_aborts(self) -> None:
with self.assertRaises(SystemExit):
selection.parse("web-app-a%debain")
def test_an_unknown_filesystem_aborts(self) -> None:
with self.assertRaises(SystemExit):
selection.parse("web-app-a/xfs")
def test_an_architecture_alone_still_counts_as_a_narrowing(self) -> None:
pin = selection.parse("web-app-a:arm64")
self.assertEqual(pin.architecture, "arm64")
self.assertTrue(pin.pinned)
def test_an_unknown_architecture_aborts(self) -> None:
with self.assertRaises(SystemExit):
selection.parse("web-app-a:riscv64")
def test_the_token_round_trips_through_describe(self) -> None:
token = "web-app-a#0,2@swarm+tor%debian/zfs:arm64"
self.assertEqual(selection.describe(selection.parse(token)), token)
def test_every_network_word_pins_its_network_mode(self) -> None:
for word in ("clearnet", "tor", "multi"):
with self.subTest(word=word):
self.assertEqual(
selection.parse(f"web-app-a@compose+{word}").network, word
)
def test_a_role_id_ending_in_tor_is_not_read_as_an_axis(self) -> None:
self.assertEqual(selection.parse("svc-net-tor"), selection.Pin("svc-net-tor"))
def test_an_unknown_mode_aborts(self) -> None:
with self.assertRaises(SystemExit):
selection.parse("web-app-a@swrm")
def test_an_unknown_network_mode_aborts(self) -> None:
with self.assertRaises(SystemExit):
selection.parse("web-app-a+onion")
def test_an_unparsable_token_aborts(self) -> None:
with self.assertRaises(SystemExit):
selection.parse("web-app-a#zwei")
class TestParseLabel(unittest.TestCase):
def _label(self, mode: str, network: str) -> str:
return f"{to_emoji(mode)}{to_emoji(network)}web-app-a#2"
def test_the_glyphs_carry_mode_and_network_mode(self) -> None:
self.assertEqual(
selection.parse(self._label("swarm", "tor")),
selection.Pin("web-app-a", (2,), "swarm", "tor"),
)
def test_every_network_glyph_pins_its_network_mode(self) -> None:
for word in ("clearnet", "tor", "multi"):
with self.subTest(word=word):
self.assertEqual(
selection.parse(self._label("compose", word)).network, word
)
def test_the_priority_star_is_not_part_of_the_name(self) -> None:
pasted = f"{self._label('compose', 'tor')} {to_emoji('priority')}"
self.assertEqual(selection.parse(pasted).app, "web-app-a")
def test_a_host_label_pins_the_mode_only(self) -> None:
pasted = f"{to_emoji('host')}{to_emoji('test_host')}web-app-a"
self.assertEqual(
selection.parse(pasted), selection.Pin("web-app-a", (), "host")
)
def test_the_distro_and_filesystem_glyphs_are_read_too(self) -> None:
pasted = (
f"{to_emoji('swarm')}{to_emoji('tor')}"
f"{to_emoji('fedora')}{to_emoji('btrfs')}web-app-a#2"
)
self.assertEqual(
selection.parse(pasted),
selection.Pin("web-app-a", (2,), "swarm", "tor", "fedora", "btrfs"),
)
def test_the_architecture_glyph_is_read_too(self) -> None:
pasted = (
f"{to_emoji('swarm')}{to_emoji('tor')}{to_emoji('fedora')}"
f"{to_emoji('btrfs')}{to_emoji('arm64')}web-app-a#2"
)
self.assertEqual(
selection.parse(pasted),
selection.Pin(
"web-app-a", (2,), "swarm", "tor", "fedora", "btrfs", "arm64"
),
)
def test_a_title_pasted_with_its_caller_path_aborts_rather_than_guessing(
self,
) -> None:
"""``/`` opens the filesystem axis, so a pasted caller path must abort
loudly instead of splitting the token somewhere inside the path."""
pasted = "🎶 Orchestrate CI / test-deploy-chunk-1 / " + self._label(
"swarm", "tor"
)
with self.assertRaises(SystemExit):
selection.parse(pasted)
def test_the_two_spellings_may_not_contradict_each_other(self) -> None:
with self.assertRaises(SystemExit):
selection.parse(f"{to_emoji('swarm')}web-app-a@compose")
class TestNames(unittest.TestCase):
def test_the_query_filters_on_role_ids_only(self) -> None:
pins = selection.parse_list("web-app-a#0@swarm web-app-b+tor")
self.assertEqual(selection.names(pins), "web-app-a web-app-b")
def test_a_role_pinned_twice_is_named_once(self) -> None:
pins = selection.parse_list("web-app-a#0 web-app-a#1")
self.assertEqual(selection.names(pins), "web-app-a")
_ROWS = [_row("web-app-a", 0), _row("web-app-a", 1), _row("web-app-b", 0)]
class TestApply(unittest.TestCase):
def test_no_selection_keeps_every_row_untouched(self) -> None:
self.assertEqual(selection.apply(_ROWS, []), _ROWS)
def test_a_pinned_variant_drops_the_other_variants(self) -> None:
kept = selection.apply(_ROWS, selection.parse_list("web-app-a#1"))
self.assertEqual([row["variant"] for row in kept], [1])
def test_the_pinned_axes_ride_along_on_the_row(self) -> None:
kept = selection.apply(_ROWS, selection.parse_list("web-app-a#0@swarm+tor"))
self.assertEqual(kept[0]["pin_mode"], "swarm")
self.assertEqual(kept[0]["pin_network"], "tor")
def test_an_unpinned_row_carries_open_axes(self) -> None:
kept = selection.apply(_ROWS, selection.parse_list("web-app-b"))
self.assertEqual([kept[0]["pin_mode"], kept[0]["pin_network"]], [None, None])
self.assertEqual(
[kept[0]["pin_distro"], kept[0]["pin_filesystem"]], [None, None]
)
def test_the_pinned_distro_and_filesystem_ride_along_too(self) -> None:
kept = selection.apply(_ROWS, selection.parse_list("web-app-a#0%debian/zfs"))
self.assertEqual(kept[0]["pin_distro"], "debian")
self.assertEqual(kept[0]["pin_filesystem"], "zfs")
def test_the_pinned_architecture_rides_along_too(self) -> None:
kept = selection.apply(_ROWS, selection.parse_list("web-app-a#0:arm64"))
self.assertEqual(kept[0]["pin_architecture"], "arm64")
def test_one_variant_that_failed_on_two_architectures_comes_back_twice(
self,
) -> None:
kept = selection.apply(
_ROWS, selection.parse_list("web-app-a#0:amd64 web-app-a#0:arm64")
)
self.assertEqual([row["pin_architecture"] for row in kept], ["amd64", "arm64"])
def test_one_variant_that_failed_on_two_distros_comes_back_twice(self) -> None:
kept = selection.apply(
_ROWS, selection.parse_list("web-app-a#0%debian web-app-a#0%fedora")
)
self.assertEqual([row["pin_distro"] for row in kept], ["debian", "fedora"])
def test_one_variant_that_failed_in_two_modes_comes_back_twice(self) -> None:
kept = selection.apply(
_ROWS,
selection.parse_list("web-app-a#0@compose+tor web-app-a#0@swarm+tor"),
)
self.assertEqual(
[(row["variant"], row["pin_mode"], row["pin_network"]) for row in kept],
[(0, "compose", "tor"), (0, "swarm", "tor")],
)
def test_one_variant_that_failed_in_two_network_modes_comes_back_twice(
self,
) -> None:
kept = selection.apply(
_ROWS,
selection.parse_list("web-app-a#0@swarm+tor web-app-a#0@swarm+multi"),
)
self.assertEqual([row["pin_network"] for row in kept], ["tor", "multi"])
def test_the_same_narrowing_written_twice_stays_one_deploy(self) -> None:
kept = selection.apply(
_ROWS,
selection.parse_list("web-app-a#0@swarm+tor web-app-a#0@swarm+tor"),
)
self.assertEqual(len(kept), 1)
def test_a_bare_role_loses_to_a_token_that_narrows_the_same_row(self) -> None:
kept = selection.apply(
_ROWS, selection.parse_list("web-app-a web-app-a#0@swarm+tor")
)
self.assertEqual(
[(row["variant"], row["pin_mode"]) for row in kept],
[(0, "swarm"), (1, None)],
)
def test_two_pins_on_one_role_keep_their_own_axes(self) -> None:
kept = selection.apply(
_ROWS, selection.parse_list("web-app-a#0@swarm web-app-a#1@compose")
)
self.assertEqual([row["pin_mode"] for row in kept], ["swarm", "compose"])
def test_the_query_order_survives_the_selection(self) -> None:
kept = selection.apply(_ROWS, selection.parse_list("web-app-b web-app-a"))
self.assertEqual([row["name"] for row in kept], [row["name"] for row in _ROWS])
def test_a_pin_that_matches_nothing_aborts_instead_of_running_empty(self) -> None:
with self.assertRaises(SystemExit):
selection.apply(_ROWS, selection.parse_list("web-app-b#7"))
def test_a_bare_role_that_matches_nothing_is_tolerated(self) -> None:
self.assertEqual(selection.apply(_ROWS, selection.parse_list("web-app-c")), [])
def test_a_pin_on_an_undiscovered_role_is_tolerated_like_a_bare_one(self) -> None:
self.assertEqual(
selection.apply(_ROWS, selection.parse_list("web-app-c#0,2")), []
)
if __name__ == "__main__":
unittest.main()