refactor(gateway): remove the single-tenant data-plane paths (audit #400 finding 3)
All three backends (docker, firecracker, macos-container) now launch through the consolidated orchestrator, and every production gateway sets BOT_BOTTLE_ORCHESTRATOR_URL — so the legacy single-tenant (`resolver is None`) branches in the shared gateway's data plane were unreachable dead code, a second security-relevant path to keep correct in parallel with the live one. Make the orchestrator resolver mandatory and delete the single-tenant paths from the three data-plane modules. egress_addon.py: drop the static routes file entirely — EGRESS_ROUTES, _reload, the SIGHUP handler, self.config, and the SUPERVISE_BOTTLE_SLUG env slug. The per-request /resolve is the only policy source; __init__ fail-closes if BOT_BOTTLE_ORCHESTRATOR_URL is unset. Introspection (`_egress.local/allowlist`) now reports the calling bottle's *resolved* routes. The block/redact log gates and _req_ctx redaction now read the per-flow config/env from the request-time stash, so they use each bottle's log level and token set (they silently used the empty static config before). Nothing sends `docker kill --signal HUP` to the gateway in the consolidated model (the egress applicators fail closed), so removing the SIGHUP reload is safe. git_http_backend.py: resolver mandatory; no flat-root fallback. main() refuses to start without an orchestrator URL; a request whose source resolves to no bottle 404s. supervise_server.py: resolver mandatory; every proposal is attributed to the source-IP-resolved bottle. Remove handle_list_egress_routes (the proxy-fetch introspection that only worked when the proxy carried one bottle's identity) — list-egress-routes is answered from the resolved policy. main() refuses to start without an orchestrator URL. Tests: a host-side fake resolver serves each test's Config through the real parse path (a small YAML-subset emitter round-trips route_to_yaml_dict); the response/websocket hooks stash it as request() would. Deletes the tests for the removed static-config, SIGHUP-reload, and single-tenant-passthrough paths; adds fail-closed-without-orchestrator coverage. Follow-up: gateway_init still forwards SIGHUP to the egress child (now dormant — no one sends it); the README still describes the docker backend's per-bottle topology. Both are outside the data-plane teardown. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UoEZHDjv84ChoZbozQERhJ
This commit is contained in:
@@ -13,8 +13,14 @@ from bot_bottle.git_gate import GIT_GATE_TIMEOUT_SECS
|
||||
from bot_bottle.git_http_backend import GitHttpHandler, MAX_BODY_BYTES
|
||||
|
||||
|
||||
# The git-http backend is resolver-only: every request is attributed to a
|
||||
# bottle namespace by source IP. These tests wire a fixed resolver and nest the
|
||||
# bare repo under `<GIT_PROJECT_ROOT>/<_BID>/`.
|
||||
_BID = "bottletest"
|
||||
|
||||
|
||||
class _FixedResolver:
|
||||
"""Maps every source IP to one bottle id (consolidated-mode stub)."""
|
||||
"""Maps every source IP to one bottle id."""
|
||||
|
||||
def __init__(self, bottle_id: str) -> None:
|
||||
self._bottle_id = bottle_id
|
||||
@@ -30,7 +36,7 @@ class TestGitHttpBackend(unittest.TestCase):
|
||||
|
||||
with tempfile.TemporaryDirectory() as tmp:
|
||||
root = Path(tmp)
|
||||
bare = root / "repo.git"
|
||||
bare = root / _BID / "repo.git"
|
||||
subprocess.run(["git", "init", "--bare", str(bare)],
|
||||
check=True, capture_output=True, text=True)
|
||||
subprocess.run(
|
||||
@@ -49,6 +55,7 @@ class TestGitHttpBackend(unittest.TestCase):
|
||||
self.addCleanup(self._restore_hook, old_hook)
|
||||
|
||||
server = ThreadingHTTPServer(("127.0.0.1", 0), GitHttpHandler)
|
||||
server.policy_resolver = _FixedResolver(_BID) # type: ignore[attr-defined]
|
||||
thread = threading.Thread(target=server.serve_forever, daemon=True)
|
||||
thread.start()
|
||||
self.addCleanup(server.shutdown)
|
||||
@@ -166,13 +173,14 @@ class TestGitHttpBackend(unittest.TestCase):
|
||||
|
||||
with tempfile.TemporaryDirectory() as tmp:
|
||||
root = Path(tmp)
|
||||
(root / "repo.git").mkdir()
|
||||
(root / _BID / "repo.git").mkdir(parents=True)
|
||||
|
||||
old_root = os.environ.get("GIT_PROJECT_ROOT")
|
||||
os.environ["GIT_PROJECT_ROOT"] = str(root)
|
||||
self.addCleanup(self._restore_env, old_root)
|
||||
|
||||
server = ThreadingHTTPServer(("127.0.0.1", 0), GitHttpHandler)
|
||||
server.policy_resolver = _FixedResolver(_BID) # type: ignore[attr-defined]
|
||||
thread = threading.Thread(target=server.serve_forever, daemon=True)
|
||||
thread.start()
|
||||
self.addCleanup(server.shutdown)
|
||||
@@ -225,7 +233,7 @@ class TestGitHttpBackend(unittest.TestCase):
|
||||
|
||||
with tempfile.TemporaryDirectory() as tmp:
|
||||
root = Path(tmp)
|
||||
(root / "repo.git").mkdir()
|
||||
(root / _BID / "repo.git").mkdir(parents=True)
|
||||
|
||||
old_root = os.environ.get("GIT_PROJECT_ROOT")
|
||||
os.environ["GIT_PROJECT_ROOT"] = str(root)
|
||||
@@ -238,6 +246,7 @@ class TestGitHttpBackend(unittest.TestCase):
|
||||
self.addCleanup(self._restore_hook, old_hook)
|
||||
|
||||
server = ThreadingHTTPServer(("127.0.0.1", 0), GitHttpHandler)
|
||||
server.policy_resolver = _FixedResolver(_BID) # type: ignore[attr-defined]
|
||||
thread = threading.Thread(target=server.serve_forever, daemon=True)
|
||||
thread.start()
|
||||
self.addCleanup(server.shutdown)
|
||||
@@ -284,12 +293,13 @@ class TestGitHttpBackend(unittest.TestCase):
|
||||
|
||||
with tempfile.TemporaryDirectory() as tmp:
|
||||
root = Path(tmp)
|
||||
(root / "repo.git").mkdir()
|
||||
(root / _BID / "repo.git").mkdir(parents=True)
|
||||
old_root = os.environ.get("GIT_PROJECT_ROOT")
|
||||
os.environ["GIT_PROJECT_ROOT"] = str(root)
|
||||
self.addCleanup(self._restore_env, old_root)
|
||||
|
||||
server = ThreadingHTTPServer(("127.0.0.1", 0), GitHttpHandler)
|
||||
server.policy_resolver = _FixedResolver(_BID) # type: ignore[attr-defined]
|
||||
thread = threading.Thread(target=server.serve_forever, daemon=True)
|
||||
thread.start()
|
||||
self.addCleanup(server.shutdown)
|
||||
@@ -330,12 +340,13 @@ class TestGitHttpBackend(unittest.TestCase):
|
||||
|
||||
with tempfile.TemporaryDirectory() as tmp:
|
||||
root = Path(tmp)
|
||||
(root / "repo.git").mkdir()
|
||||
(root / _BID / "repo.git").mkdir(parents=True)
|
||||
old_root = os.environ.get("GIT_PROJECT_ROOT")
|
||||
os.environ["GIT_PROJECT_ROOT"] = str(root)
|
||||
self.addCleanup(self._restore_env, old_root)
|
||||
|
||||
server = ThreadingHTTPServer(("127.0.0.1", 0), GitHttpHandler)
|
||||
server.policy_resolver = _FixedResolver(_BID) # type: ignore[attr-defined]
|
||||
thread = threading.Thread(target=server.serve_forever, daemon=True)
|
||||
thread.start()
|
||||
self.addCleanup(server.shutdown)
|
||||
@@ -431,6 +442,7 @@ class TestMalformedStatusHeader(unittest.TestCase):
|
||||
self._tmp = tempfile.mkdtemp()
|
||||
os.environ["GIT_PROJECT_ROOT"] = self._tmp
|
||||
self._server = ThreadingHTTPServer(("127.0.0.1", 0), GitHttpHandler)
|
||||
self._server.policy_resolver = _FixedResolver(_BID) # type: ignore[attr-defined]
|
||||
self._thread = threading.Thread(
|
||||
target=self._server.serve_forever, daemon=True,
|
||||
)
|
||||
@@ -482,6 +494,7 @@ class TestContentLengthBounds(unittest.TestCase):
|
||||
self._tmp = tempfile.mkdtemp()
|
||||
os.environ["GIT_PROJECT_ROOT"] = self._tmp
|
||||
self._server = ThreadingHTTPServer(("127.0.0.1", 0), GitHttpHandler)
|
||||
self._server.policy_resolver = _FixedResolver(_BID) # type: ignore[attr-defined]
|
||||
self._thread = threading.Thread(
|
||||
target=self._server.serve_forever, daemon=True,
|
||||
)
|
||||
|
||||
Reference in New Issue
Block a user