didericis-claude
0e2af7de62
Chunk 2 of the host-control-server stack: close the PRD's **durable secret** gap and replace chunk 1's BOT_BOTTLE_BROKER_SECRET stopgap. - trust_domain.py: two new domains. LAUNCH_BROKER holds the durable HS256 key both the orchestrator (signer) and the host control server (verifier) share for the broker's launch JWT — a host-canonical key file minted 0600 on first use, so a restarted orchestrator re-verifies against the same key. HOST_CONTROLLER is the separate domain for the controller's own lifecycle endpoints, keyed by a key the orchestrator never holds (its role is `host`, deliberately outside control-plane ROLES). LaunchBrokerProvisioning is the fail-closed seam. - orchestrator_auth.py: ROLE_HOST, outside ROLES. - paths.py: key-file + env-var constants for both domains. Key resolution is split by owner (addresses codex review on #497): broker_secret(allow_host_file=...) — the host controller / dev-harness (True) may mint/read the durable host key file it owns; the GUEST orchestrator (--broker http, default False) must be *injected* the key and fails closed if it isn't. A guest that fell back to the host file would mint a process-local key unrelated to the host controller's, so startup would succeed but every launch would 401 — this prevents that silent divergence. Tested: domain boundary + separation, provisioning fail-closed, and broker_secret env-only (guest) vs host-file (host) resolution. pyright clean; pylint 9.86. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
68 lines
2.5 KiB
Python
68 lines
2.5 KiB
Python
"""Unit: the orchestrator dev-harness entrypoint (`python -m bot_bottle.orchestrator`).
|
|
|
|
Exercises broker selection (stub / docker / http) and the fail-closed http path,
|
|
patching `make_server` so the serve loop returns instead of blocking.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import os
|
|
import secrets
|
|
import tempfile
|
|
import unittest
|
|
from pathlib import Path
|
|
from unittest.mock import MagicMock, patch
|
|
|
|
from bot_bottle.orchestrator.__main__ import main
|
|
from bot_bottle.paths import LAUNCH_BROKER_KEY_ENV
|
|
|
|
|
|
def _fake_server() -> MagicMock:
|
|
fake = MagicMock()
|
|
fake.server_address = ("127.0.0.1", 0)
|
|
# Break out of serve_forever immediately, exercising the try/finally.
|
|
fake.serve_forever.side_effect = KeyboardInterrupt
|
|
return fake
|
|
|
|
|
|
class TestMain(unittest.TestCase):
|
|
def _run(self, broker: str, env: dict[str, str] | None = None) -> tuple[int, MagicMock]:
|
|
fake = _fake_server()
|
|
with tempfile.TemporaryDirectory() as d:
|
|
argv = ["--db", str(Path(d) / "r.db"), "--port", "0", "--broker", broker]
|
|
with patch("bot_bottle.orchestrator.__main__.make_server", return_value=fake), \
|
|
patch.dict("os.environ", env or {}, clear=False):
|
|
if env is None:
|
|
os.environ.pop(LAUNCH_BROKER_KEY_ENV, None)
|
|
rc = main(argv)
|
|
return rc, fake
|
|
|
|
def test_stub_broker_serves_and_closes(self) -> None:
|
|
rc, fake = self._run("stub")
|
|
self.assertEqual(0, rc)
|
|
fake.serve_forever.assert_called_once()
|
|
fake.server_close.assert_called_once()
|
|
|
|
def test_docker_broker_serves(self) -> None:
|
|
rc, _ = self._run("docker")
|
|
self.assertEqual(0, rc)
|
|
|
|
def test_http_broker_with_injected_key_serves(self) -> None:
|
|
# The guest orchestrator takes the launch-broker key by injection.
|
|
rc, _ = self._run(
|
|
"http", env={LAUNCH_BROKER_KEY_ENV: secrets.token_urlsafe(16)})
|
|
self.assertEqual(0, rc)
|
|
|
|
def test_http_broker_without_injected_key_exits(self) -> None:
|
|
# Fail-closed: no host-file fallback for the guest, so a missing injected
|
|
# key is a usage error rather than a silently-minted divergent key.
|
|
with tempfile.TemporaryDirectory() as d:
|
|
with patch.dict("os.environ", {}, clear=False):
|
|
os.environ.pop(LAUNCH_BROKER_KEY_ENV, None)
|
|
with self.assertRaises(SystemExit):
|
|
main(["--db", str(Path(d) / "r.db"), "--broker", "http"])
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|