b6ae6225f6
The acceptance harness pinned a forge client that has never existed in any
commit or pod (/opt/coordinator/gitea_api.py, digest f0943db4..., GIT/POST
grammar, an askpass helper). Every Gitea-backed check was therefore
unrunnable as merged. Point the harness at the credential-isolated SCM
broker client that actually ships in the agent pod.
- policy: GITEA_CLIENT=/opt/scm/gitea_api.py; trust /opt/scm/ instead of
the phantom /opt/coordinator/; admit the client's real grammar
(`read <api-path>`, exactly one path) with the same atlas/titan-iac pin
and dot-segment rejection; bare HTTP methods are refused in every mode.
The armed POST/PATCH/DELETE windows remain but are documented as
deferred: the deployed client cannot execute them.
- exec: pin the client digest to the sha256 of
services/hermes/scm-common/scripts/gitea_api.py — the exact file the
hermes-scm-boundary-v2 ConfigMap mounts at /opt/scm/gitea_api.py — so
the pin is derivable from merged source and equal to the deployed
client. gitea_api.py gains a narrow /api/v1/user identity read in
_authorize_read (see below), so the pin is the NEW source hash
76efd16dedbeb74425b12fbbdbfaa391854771292077e0463bf22706855ae6dc.
Drop the dangling GIT_ASKPASS (no helper exists; broker git needs
none) and swap /opt/coordinator for /opt/scm in SAFE_PATH.
- checks: all forge/baseline/lineage probes use (client, "read", path).
The SELF-vantage identity checks now truthfully assert the *broker's*
forge identity (the only one the platform can exercise) is not an
administrator and holds push-scoped, non-administrative repository
authority; the administrative-route check asserts the broker read
allowlist's live refusal of branch_protections. The remote-main step
keeps `origin` (the broker remote exists only in pool workspaces and
the broker origin is cluster-local); its rationale now tells the
operator to ensure origin fetchability.
- gitea_api.py/_authorize_read: allow exactly `/api/v1/user` (no query,
no sibling routes) as operation "identity" so the harness can prove
the broker identity is not an administrator. The broker imports the
same module, so one reviewed edit covers both sides of the boundary.
- rules: DENIAL_MARKERS now match the client's real refusal lines
("SCM broker request failed with HTTP 400/403" and the no-credential
rejection) and drop "gitea api returned http 403", which the client
never emits; a broker 404 is deliberately not denial evidence.
- ephemeral: index/verification reads use the real grammar; manual
cleanup guidance now says close/delete require operator forge
credentials (the client exposes no mutation besides create-draft);
armed mode is documented as deferred until the probes are rebuilt on
the broker's bounded mutation surface.
- docs: broker vantage/evidence section, operator prerequisites (broker
healthy, no /vault/secrets/gitea-token anywhere on the harness path,
current ConfigMap mount, operator-side client + origin fetchability),
armed-mode deferral.
- tests: read-grammar accepted / GET refused in every mode, /opt/scm
attestation pin proven equal to the merged source digest, real
denial-marker matching, /api/v1/user identity route bounds; the
repository-pin mutant probe speaks the new grammar. Full handoff +
gitea + broker families pass (952 tests), mutation gate 13/13, per-file
line+branch coverage >=95%, all touched sources within the 500-line cap.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
318 lines
9.8 KiB
Python
318 lines
9.8 KiB
Python
"""Route and request-boundary contracts for the Atlas Gitea client."""
|
||
|
||
from __future__ import annotations
|
||
|
||
import urllib.error
|
||
import urllib.request
|
||
|
||
import pytest
|
||
|
||
from testing.tests.test_hermes_gitea_support import HEAD_SHA, Response, _load
|
||
|
||
def test_default_opener_rejects_redirects_under_an_absolute_deadline(monkeypatch):
|
||
client = _load()
|
||
source = urllib.request.Request(
|
||
"https://scm.bstein.dev/api/v1/repos/atlas/cassandra",
|
||
headers={"Authorization": "token redirect-sentinel"},
|
||
)
|
||
|
||
with pytest.raises(urllib.error.URLError) as exc:
|
||
client.deadline_http._RejectRedirect().redirect_request(
|
||
source,
|
||
None,
|
||
302,
|
||
"Found",
|
||
{},
|
||
"https://evil.example/collect",
|
||
)
|
||
|
||
assert "redirect-sentinel" not in str(exc.value)
|
||
seen = []
|
||
monkeypatch.setattr(
|
||
client.deadline_http,
|
||
"open_bounded",
|
||
lambda request, *, maximum, timeout: seen.append(
|
||
(request, maximum, timeout)
|
||
),
|
||
)
|
||
client._safe_urlopen(source, 30)
|
||
assert seen == [(source, client.MAX_RESPONSE_BYTES, 30)]
|
||
|
||
|
||
@pytest.mark.parametrize(
|
||
("base_url", "path"),
|
||
[
|
||
("https://evil.example", "/api/v1/repos/atlas/cassandra"),
|
||
("http://scm.bstein.dev", "/api/v1/repos/atlas/cassandra"),
|
||
("https://scm.bstein.dev:443", "/api/v1/repos/atlas/cassandra"),
|
||
("https://scm.bstein.dev/", "/api/v1/repos/atlas/cassandra"),
|
||
("HTTPS://scm.bstein.dev", "/api/v1/repos/atlas/cassandra"),
|
||
("https://SCM.bstein.dev", "/api/v1/repos/atlas/cassandra"),
|
||
("https://user@scm.bstein.dev", "/api/v1/repos/atlas/cassandra"),
|
||
("https://scm.bstein.dev", "https://evil.example/api/v1/repos/atlas/cassandra"),
|
||
("https://scm.bstein.dev", "/api/v1/repos/evil/cassandra"),
|
||
("https://scm.bstein.dev", "/api/v1/repos/%61tlas/cassandra"),
|
||
("https://scm.bstein.dev", "/api/v1/repos/atlas/../admin"),
|
||
],
|
||
)
|
||
def test_host_owner_and_path_escape_attempts_are_rejected(base_url: str, path: str):
|
||
client = _load()
|
||
|
||
with pytest.raises(client.PolicyError):
|
||
client.build_request("GET", path, base_url=base_url, token="secret")
|
||
|
||
|
||
@pytest.mark.parametrize(
|
||
"path",
|
||
[
|
||
"/api/v1/repos/atlas/cassandra/pulls/1\nHost: evil.example",
|
||
"/api/v1/repos/atlas/cassandra/pulls/1\r\nX-Test: value",
|
||
"/api/v1/repos/atlas/cassandra/pulls/1\tignored",
|
||
"/api/v1/repos/atlas/cassandra/pulls/1\x00ignored",
|
||
"/api/v1/repos/atlas/cassandra/pulls/1\x1fignored",
|
||
"/api/v1/repos/atlas/cassandra/pulls/1\x7fignored",
|
||
"/api/v1/repos/atlas/cassandra\\pulls\\1",
|
||
"/api/v1/repos/atlas/cassandra/pulls/%31",
|
||
"/api/v1/repos/atlas/cassandra/pulls/１",
|
||
" https://scm.bstein.dev/api/v1/repos/atlas/cassandra",
|
||
"https://scm.bstein.dev/api/v1/repos/atlas/cassandra",
|
||
],
|
||
)
|
||
def test_raw_noncanonical_target_is_rejected_before_urlsplit_and_opener(
|
||
path: str, monkeypatch
|
||
):
|
||
client = _load()
|
||
split_called = False
|
||
opener_called = False
|
||
original_urlsplit = client.urllib.parse.urlsplit
|
||
|
||
def urlsplit(*args, **kwargs):
|
||
nonlocal split_called
|
||
split_called = True
|
||
return original_urlsplit(*args, **kwargs)
|
||
|
||
def opener(*_args, **_kwargs):
|
||
nonlocal opener_called
|
||
opener_called = True
|
||
return Response(b"{}")
|
||
|
||
monkeypatch.setattr(client.urllib.parse, "urlsplit", urlsplit)
|
||
with pytest.raises(client.PolicyError):
|
||
client.read(path, token="runtime", opener=opener)
|
||
assert split_called is False
|
||
assert opener_called is False
|
||
|
||
|
||
@pytest.mark.parametrize(
|
||
"path",
|
||
[
|
||
"/api/v1/repos/atlas/cassandra/pulls/1?",
|
||
"//scm.bstein.dev/api/v1/repos/atlas/cassandra",
|
||
"/api/v1/repos/atlas/cassandra/./pulls/1",
|
||
"/api/v1/repos/atlas/cassandra/../admin",
|
||
"/api/v1/repos/atlas/cassandra//pulls/1",
|
||
"/api/v1/repos/atlas/cassandra/pulls/1?limit=01",
|
||
],
|
||
)
|
||
def test_noncanonical_round_trip_or_segments_never_reach_opener(path: str):
|
||
client = _load()
|
||
opener_called = False
|
||
|
||
def opener(*_args, **_kwargs):
|
||
nonlocal opener_called
|
||
opener_called = True
|
||
return Response(b"{}")
|
||
|
||
with pytest.raises(client.PolicyError):
|
||
client.read(path, token="runtime", opener=opener)
|
||
assert opener_called is False
|
||
|
||
|
||
@pytest.mark.parametrize(
|
||
"path",
|
||
[
|
||
"/api/v1/user",
|
||
"/api/v1/repos/atlas/cassandra",
|
||
"/api/v1/repos/atlas/cassandra/pulls?state=open&limit=20&page=1",
|
||
"/api/v1/repos/atlas/cassandra/pulls/7",
|
||
"/api/v1/repos/atlas/cassandra/pulls/7/commits?limit=20",
|
||
"/api/v1/repos/atlas/cassandra/pulls/7/files?page=1",
|
||
"/api/v1/repos/atlas/cassandra/branches",
|
||
"/api/v1/repos/atlas/cassandra/branches/main",
|
||
"/api/v1/repos/atlas/cassandra/commits?limit=10",
|
||
f"/api/v1/repos/atlas/cassandra/git/commits/{HEAD_SHA}",
|
||
f"/api/v1/repos/atlas/cassandra/commits/{HEAD_SHA}/status",
|
||
f"/api/v1/repos/atlas/cassandra/commits/{HEAD_SHA}/statuses?limit=10",
|
||
f"/api/v1/repos/atlas/cassandra/statuses/{HEAD_SHA}?page=1",
|
||
],
|
||
)
|
||
def test_explicit_read_allowlist_accepts_only_engineering_metadata(path: str):
|
||
client = _load()
|
||
|
||
request = client.build_request(
|
||
"GET", path, base_url=client.CANONICAL_BASE_URL, token="runtime"
|
||
)
|
||
assert request.method == "GET"
|
||
|
||
|
||
def test_the_identity_route_reads_only_the_bare_user_document():
|
||
"""`/api/v1/user` answers with the broker identity's own metadata.
|
||
|
||
Acceptance tooling uses it to prove the platform's forge identity is not
|
||
an administrator; every sibling or sub-route stays refused.
|
||
"""
|
||
client = _load()
|
||
|
||
assert client.authorize_request("GET", "/api/v1/user", None) == "identity"
|
||
for path in (
|
||
"/api/v1/user?full=true",
|
||
"/api/v1/user/tokens",
|
||
"/api/v1/user/emails",
|
||
"/api/v1/users/atlas",
|
||
"/api/v1/userx",
|
||
):
|
||
with pytest.raises(client.PolicyError):
|
||
client.authorize_request("GET", path, None)
|
||
|
||
|
||
@pytest.mark.parametrize(
|
||
"path",
|
||
[
|
||
"/api/v1/repos/atlas/cassandra/hooks",
|
||
"/api/v1/repos/atlas/cassandra/actions/secrets",
|
||
"/api/v1/repos/atlas/cassandra/actions/variables",
|
||
"/api/v1/repos/atlas/cassandra/collaborators",
|
||
"/api/v1/repos/atlas/cassandra/branch_protections",
|
||
"/api/v1/repos/atlas/cassandra/keys",
|
||
"/api/v1/repos/atlas/cassandra/pulls/7/reviews",
|
||
"/api/v1/repos/atlas/cassandra/pulls/7/merge",
|
||
"/api/v1/repos/atlas/cassandra/pulls/7.diff",
|
||
"/api/v1/repos/atlas/cassandra/releases",
|
||
],
|
||
)
|
||
def test_privileged_or_content_routes_are_denied_even_for_get(path: str):
|
||
client = _load()
|
||
|
||
with pytest.raises(client.PolicyError, match="outside the metadata read allowlist"):
|
||
client.authorize_request("GET", path, None)
|
||
|
||
|
||
@pytest.mark.parametrize(
|
||
"path",
|
||
[
|
||
"/api/v1/repos/atlas/cassandra/pulls?limit=51",
|
||
"/api/v1/repos/atlas/cassandra/pulls?state=merged",
|
||
"/api/v1/repos/atlas/cassandra/pulls?private=true",
|
||
"/api/v1/repos/atlas/cassandra/pulls?limit=1&limit=2",
|
||
"/api/v1/repos/atlas/cassandra?p=1",
|
||
],
|
||
)
|
||
def test_read_query_is_bounded(path: str):
|
||
client = _load()
|
||
|
||
with pytest.raises(client.PolicyError):
|
||
client.authorize_request("GET", path, None)
|
||
|
||
|
||
@pytest.mark.parametrize(
|
||
"query",
|
||
[
|
||
"page=0",
|
||
"page=10001",
|
||
"page=01",
|
||
"limit=0",
|
||
"limit=51",
|
||
"limit=01",
|
||
"page=" + "9" * 4000,
|
||
"page=０",
|
||
"page=%EF%BC%90",
|
||
"state=%6fpen",
|
||
"p%61ge=1",
|
||
"page=1&page=2",
|
||
"page=1&" + "x" * 17 + "=1",
|
||
"state=" + "x" * 17,
|
||
"page=1&limit=2&state=open&extra=3",
|
||
],
|
||
)
|
||
def test_read_query_requires_canonical_bounded_ascii(query: str):
|
||
client = _load()
|
||
|
||
with pytest.raises(client.PolicyError):
|
||
client.authorize_request(
|
||
"GET", f"/api/v1/repos/atlas/cassandra/pulls?{query}", None
|
||
)
|
||
|
||
|
||
@pytest.mark.parametrize(
|
||
"suffix",
|
||
[
|
||
"pulls/{number}",
|
||
"pulls/{number}.patch",
|
||
"pulls/{number}.diff",
|
||
"pulls/{number}/commits",
|
||
"pulls/{number}/files",
|
||
"commits/{number}/status",
|
||
"commits/{number}/statuses",
|
||
"statuses/{number}",
|
||
"branches/{number}",
|
||
],
|
||
)
|
||
def test_oversized_numeric_or_captured_path_never_reaches_opener(suffix: str):
|
||
client = _load()
|
||
called = False
|
||
|
||
def opener(*_args, **_kwargs):
|
||
nonlocal called
|
||
called = True
|
||
return Response(b"{}")
|
||
|
||
path = "/api/v1/repos/atlas/cassandra/" + suffix.format(number="9" * 4000)
|
||
with pytest.raises(client.PolicyError):
|
||
client.read(path, token="runtime", opener=opener)
|
||
assert called is False
|
||
|
||
|
||
@pytest.mark.parametrize(
|
||
"number",
|
||
["0", "01", "2147483648", "１２", "%31", "12345678901"],
|
||
)
|
||
@pytest.mark.parametrize("tail", ["", ".patch", ".diff", "/commits", "/files"])
|
||
def test_noncanonical_or_out_of_range_pr_number_never_reaches_opener(
|
||
number: str, tail: str
|
||
):
|
||
client = _load()
|
||
called = False
|
||
|
||
def opener(*_args, **_kwargs):
|
||
nonlocal called
|
||
called = True
|
||
return Response(b"{}")
|
||
|
||
with pytest.raises(client.PolicyError):
|
||
client.read(
|
||
f"/api/v1/repos/atlas/cassandra/pulls/{number}{tail}",
|
||
token="runtime",
|
||
opener=opener,
|
||
)
|
||
assert called is False
|
||
|
||
|
||
def test_maximum_bounded_pr_number_is_readable():
|
||
client = _load()
|
||
called = False
|
||
|
||
def opener(*_args, **_kwargs):
|
||
nonlocal called
|
||
called = True
|
||
return Response(b"{}")
|
||
|
||
assert (
|
||
client.read(
|
||
"/api/v1/repos/atlas/cassandra/pulls/2147483647",
|
||
token="runtime",
|
||
opener=opener,
|
||
)
|
||
== b"{}"
|
||
)
|
||
assert called is True
|