93a7267b10
Each removed test re-asserts a contract a stronger test already owns at the real boundary; the keeper is named per group. - api_server CORS: `_origin_allowed` for an allowlisted origin and for an Origin-less client -> the configured-origin preflight test and every Origin-less /health request. The Idempotency-Key allow-header assertion moves into the preflight test instead of running a second identical preflight. - api_server room grants: the execution-policy predicate's two outcomes -> test_api_server_runs' HTTP grant-refresh tests (403 on drift, 200 on the authorized digest). - api_server multimodal: the pure input_image canonicalization -> the /v1/responses test that sends the same parts and asserts the same shape. - credential pool: matched-hint rotation (401) and second-429 rotation -> test_credential_pool_routing's real-pool hint test and TestPoolRotationCycle, which assert the same steps plus the exact rotate kwargs and swap. - shared metrics: two runtime cases that replay the send resolver's truth table -> TestSendRequiresCollection; the e2e gzip-retry test (both attempts compress in the same second, so it cannot see mtime) -> TestCompression::test_gzip_is_deterministic_across_time; e2e outbox untouched -> TestOutboxIsNotAQueue. - mcp oauth: provider reuse across reconnects -> the manager restore test; the non-tty private predicate -> build_oauth_auth's fail-fast test; the manager disk-watch test -> the integration test, which gains its one unique assertion (an unchanged file returns False). - startup watchdog: disarm-without-arm -> test_disarm_is_idempotent, whose second disarm runs in the same state and branch.
89 lines
2.8 KiB
Python
89 lines
2.8 KiB
Python
"""RoomLink grant authority: policy drift, gateway-owned secret, superseded authority."""
|
|
|
|
import time
|
|
from unittest.mock import MagicMock
|
|
|
|
import pytest
|
|
|
|
from gateway.platforms import api_server
|
|
|
|
def test_room_grant_secret_stays_gateway_owned_on_named_profile(
|
|
tmp_path, monkeypatch
|
|
):
|
|
from gateway.hosted_room_peer import gateway_room_grant_secret
|
|
|
|
adapter = api_server.APIServerAdapter.__new__(api_server.APIServerAdapter)
|
|
adapter._api_key = "gateway-api-key-1234567890"
|
|
monkeypatch.setenv("HERMES_HOME", str(tmp_path))
|
|
profile_token = api_server._api_request_profile.set("reviewer")
|
|
try:
|
|
assert adapter._room_grant_secret() == gateway_room_grant_secret()
|
|
finally:
|
|
api_server._api_request_profile.reset(profile_token)
|
|
|
|
def test_superseded_room_authority_cannot_reuse_its_grant(tmp_path, monkeypatch):
|
|
from gateway import hosted_rooms
|
|
from gateway.hosted_room_peer import (
|
|
gateway_room_grant_secret,
|
|
issue_room_grant,
|
|
)
|
|
|
|
monkeypatch.setenv("HERMES_HOME", str(tmp_path))
|
|
secret = gateway_room_grant_secret()
|
|
now = time.time()
|
|
common = {
|
|
"grant_id": "grant-old",
|
|
"room_id": "room-1",
|
|
"home_install_id": "install-home",
|
|
"authority_gateway_id": "gateway-old",
|
|
"authority_epoch": 1,
|
|
"member_id": "member-reviewer",
|
|
"target_install_id": hosted_rooms.local_authority_gateway_id(),
|
|
"target_profile": "reviewer",
|
|
"execution_policy_digest": "d" * 64,
|
|
"issued_at": now,
|
|
"ttl_seconds": 3600,
|
|
}
|
|
old_grant = issue_room_grant(secret, **common)
|
|
old_claims = {
|
|
key: value
|
|
for key, value in common.items()
|
|
if key
|
|
in {
|
|
"room_id",
|
|
"home_install_id",
|
|
"authority_gateway_id",
|
|
"authority_epoch",
|
|
"member_id",
|
|
"target_install_id",
|
|
"target_profile",
|
|
}
|
|
}
|
|
hosted_rooms.reserve_peer_room(
|
|
hosted_rooms.default_db_path(),
|
|
claims=old_claims,
|
|
expires_at=now + 3600,
|
|
now=now,
|
|
)
|
|
|
|
adapter = api_server.APIServerAdapter.__new__(api_server.APIServerAdapter)
|
|
request = MagicMock(headers={"Authorization": f"HermesRoom {old_grant}"})
|
|
assert adapter._room_grant_claims(request, permission="status")[
|
|
"authority_gateway_id"
|
|
] == "gateway-old"
|
|
|
|
hosted_rooms.reserve_peer_room(
|
|
hosted_rooms.default_db_path(),
|
|
claims={
|
|
**old_claims,
|
|
"authority_gateway_id": "gateway-new",
|
|
"authority_epoch": 2,
|
|
"member_id": "member-new",
|
|
},
|
|
expires_at=now + 3600,
|
|
now=now,
|
|
)
|
|
|
|
with pytest.raises(ValueError, match="no longer current"):
|
|
adapter._room_grant_claims(request, permission="status")
|