didericis
f77023db1d
test / integration-docker (pull_request) Successful in 11s
test / unit (pull_request) Successful in 43s
lint / lint (push) Successful in 56s
test / integration-firecracker (pull_request) Successful in 3m19s
test / coverage (pull_request) Successful in 19s
test / publish-infra (pull_request) Has been skipped
tracker-policy-pr / check-pr (pull_request) Successful in 7s
Separate the gateway (data plane) from the orchestrator (control plane) at the
module level. The gateway runtime files move out of the package root — and the
backend-neutral Gateway lifecycle ABC + GATEWAY_* constants move out of
orchestrator/ — into a new bot_bottle/gateway/ package:
gateway/__init__.py (was orchestrator/gateway.py: Gateway ABC + consts
+ rotate_gateway_ca)
gateway/gateway_init.py (the PID-1 daemon supervisor)
gateway/egress_addon.py, egress_addon_core.py, egress_dlp_config.py,
dlp_detectors.py (the egress mitmproxy daemon)
gateway/git_http_backend.py (the git-http daemon)
gateway/git_gate_render.py (the git-gate pre-receive rendering)
gateway/supervise_server.py (the supervise MCP daemon)
gateway/policy_resolver.py (the data-plane control-plane RPC client)
orchestrator/ now holds only control-plane files. The shared plan/types/auth
layer (egress.py=EgressPlan, git_gate.py=GitGatePlan, supervise.py,
supervise_types.py, control_auth.py) and the launch-time git-gate provisioning
helpers stay at root, so orchestrator/ and backend/ still own them.
Because these daemons are invoked as `python3 -m bot_bottle.<name>`, loaded flat
by mitmproxy, and referenced in Dockerfile.gateway, the move updates more than
Python imports: the `-m` invocations (firecracker/macOS infra scripts), the
Dockerfile.gateway addon shim + ENTRYPOINT, gateway_init's _DAEMONS module
paths, and the git-gate CGI heredocs all now point at bot_bottle.gateway.*.
No behavior change; full unit suite green (2251).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
57 lines
2.1 KiB
Python
57 lines
2.1 KiB
Python
"""Unit: consolidated registration inputs — egress policy round-trip (PRD 0070)."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import json
|
|
import unittest
|
|
from pathlib import Path
|
|
|
|
from bot_bottle.egress import EgressPlan, EgressRoute
|
|
from bot_bottle.gateway.egress_addon_core import LOG_BLOCKS, load_config
|
|
from bot_bottle.orchestrator.registration import (
|
|
RegistrationInputs,
|
|
egress_policy,
|
|
registration_inputs,
|
|
)
|
|
|
|
|
|
def _plan(routes: tuple[EgressRoute, ...], *, slug: str = "demo", log: int = 0) -> EgressPlan:
|
|
return EgressPlan(
|
|
slug=slug,
|
|
routes_path=Path("/unused/routes.yaml"),
|
|
routes=routes,
|
|
token_env_map={},
|
|
log=log,
|
|
)
|
|
|
|
|
|
class TestEgressPolicy(unittest.TestCase):
|
|
def test_policy_round_trips_through_load_config(self) -> None:
|
|
# The policy the gateway serves must parse back to the same allow-list
|
|
# the per-bottle gateway applied — moving onto the shared gateway must
|
|
# not change a bottle's egress.
|
|
routes = (EgressRoute(host="api.example.com"), EgressRoute(host="pypi.org"))
|
|
cfg = load_config(egress_policy(_plan(routes)))
|
|
self.assertEqual(("api.example.com", "pypi.org"), tuple(r.host for r in cfg.routes))
|
|
|
|
def test_policy_preserves_log_level(self) -> None:
|
|
plan = _plan((EgressRoute(host="x.example.com"),), log=LOG_BLOCKS)
|
|
self.assertEqual(LOG_BLOCKS, load_config(egress_policy(plan)).log)
|
|
|
|
def test_empty_routes_yield_deny_all(self) -> None:
|
|
cfg = load_config(egress_policy(_plan(())))
|
|
self.assertEqual((), cfg.routes) # no routes → default-deny
|
|
|
|
|
|
class TestRegistrationInputs(unittest.TestCase):
|
|
def test_bundles_policy_and_slug_metadata(self) -> None:
|
|
plan = _plan((EgressRoute(host="api.example.com"),), slug="my-bot")
|
|
inputs = registration_inputs(plan)
|
|
self.assertIsInstance(inputs, RegistrationInputs)
|
|
self.assertEqual("my-bot", json.loads(inputs.metadata)["slug"])
|
|
self.assertEqual(egress_policy(plan), inputs.policy) # same blob egress_policy renders
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|