284dbaf537
Activation reaches plugin discovery before the application dependencies exist. Give PM its own locked Python project and runtime so it can install or repair the application without importing that dependency tree. Keep PM outside the application workspace. A shared uv workspace resolves the application graph and cannot provide this isolation. Route mutations through an isolated worker and preserve transaction callbacks, cancellation, custom package registrations, and correlated receipts. Use the same runtime builder for source installs and packaged payloads. Keep offline wheelhouse support in that builder. Nix builds the independent PM lock as a separate derivation. Refuse lazy-disabled bootstrap before installing tools or dependencies. Move first-party YAML readers and writers to ruamel. Keep the application lock's transitive PyYAML requirements for third-party packages. Verification: - Focused canonical Python suite: 177 passed, 1 host-gated skip. - Electron backend probes: 12 passed. Electron typecheck passed. - Both uv locks, scoped lint, Bash syntax, and whitespace checks passed. - Cold activation, corrupt-app repair, offline staging, and relocation ran. - Built and exercised the Nix PM runtime and standalone YAML merge script. Six broader caller test files retain the same 24 failing test IDs as an archive of HEAD. The existing real-home guard blocks those tests before they can exercise the affected paths. No full-suite pass is claimed. Native Windows signing and full Bionic package execution remain unverified.
97 lines
3.0 KiB
Python
97 lines
3.0 KiB
Python
"""Regression tests for dashboard basic-auth plugin enablement (#54489).
|
|
|
|
When ``dashboard.basic_auth`` is configured but the bundled ``basic``
|
|
provider plugin is listed in ``plugins.disabled``, plugin discovery skips
|
|
it and the dashboard auth gate sees zero providers — even after the
|
|
interactive username/password setup path writes credentials to config.yaml.
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
from unittest.mock import patch
|
|
|
|
import pytest
|
|
import hermes_yaml as yaml
|
|
|
|
from hermes_cli.dashboard_auth import clear_providers, list_providers
|
|
from hermes_cli.plugins import PluginManager, discover_plugins
|
|
from hermes_cli.plugins_cmd import ensure_basic_auth_plugin_enabled_in_config
|
|
import plugins.dashboard_auth.basic as basic_plugin
|
|
|
|
|
|
@pytest.fixture(autouse=True)
|
|
def _reset_auth_registry():
|
|
clear_providers()
|
|
yield
|
|
clear_providers()
|
|
|
|
|
|
@pytest.fixture
|
|
def hermes_home(tmp_path, monkeypatch):
|
|
home = tmp_path / "hermes"
|
|
home.mkdir()
|
|
monkeypatch.setenv("HERMES_HOME", str(home))
|
|
return home
|
|
|
|
|
|
def _write_config(home, cfg: dict) -> None:
|
|
(home / "config.yaml").write_text(yaml.safe_dump(cfg), encoding="utf-8")
|
|
|
|
|
|
class TestEnsureBasicAuthPluginEnabled:
|
|
def test_noop_when_not_disabled(self):
|
|
cfg = {"plugins": {"disabled": ["other-plugin"]}}
|
|
assert ensure_basic_auth_plugin_enabled_in_config(cfg) is False
|
|
|
|
|
|
class TestBasicProviderLoadsAfterUnblock:
|
|
def test_disabled_basic_blocks_registration(self, hermes_home, monkeypatch):
|
|
password_hash = basic_plugin.hash_password("hunter2")
|
|
_write_config(
|
|
hermes_home,
|
|
{
|
|
"dashboard": {
|
|
"basic_auth": {
|
|
"username": "admin",
|
|
"password_hash": password_hash,
|
|
"secret": "a" * 32,
|
|
}
|
|
},
|
|
"plugins": {"disabled": ["basic"]},
|
|
},
|
|
)
|
|
|
|
import hermes_cli.plugins as plugins_mod
|
|
|
|
with patch.object(plugins_mod, "_plugin_manager", None):
|
|
discover_plugins(force=True)
|
|
|
|
assert list_providers() == []
|
|
|
|
def test_unblock_then_rediscover_registers_provider(
|
|
self, hermes_home, monkeypatch,
|
|
):
|
|
password_hash = basic_plugin.hash_password("hunter2")
|
|
cfg = {
|
|
"dashboard": {
|
|
"basic_auth": {
|
|
"username": "admin",
|
|
"password_hash": password_hash,
|
|
"secret": "a" * 32,
|
|
}
|
|
},
|
|
"plugins": {"disabled": ["basic"]},
|
|
}
|
|
_write_config(hermes_home, cfg)
|
|
|
|
assert ensure_basic_auth_plugin_enabled_in_config(cfg) is True
|
|
_write_config(hermes_home, cfg)
|
|
|
|
import hermes_cli.plugins as plugins_mod
|
|
|
|
with patch.object(plugins_mod, "_plugin_manager", None):
|
|
discover_plugins(force=True)
|
|
|
|
providers = list_providers()
|
|
assert len(providers) == 1
|
|
assert providers[0].name == "basic"
|