bot-bottle/tests/unit/test_macos_rootless_podman.py

"""Unit coverage for the fail-closed macOS rootless-podman spike."""

from __future__ import annotations

import unittest
from dataclasses import dataclass
from pathlib import Path
from types import SimpleNamespace
from typing import cast
from unittest.mock import patch

from bot_bottle.backend.macos_container import rootless_podman
from bot_bottle.backend.macos_container import launch as launch_mod
from bot_bottle.backend.macos_container.bottle_plan import MacosContainerBottlePlan


class _Bottle:
    def __init__(self, results: list[SimpleNamespace]) -> None:
        self.results = results
        self.commands: list[str] = []

    def exec(self, command: str) -> SimpleNamespace:
        self.commands.append(command)
        return self.results.pop(0)


def _result(returncode: int, *, stdout: str = "", stderr: str = "") -> SimpleNamespace:
    return SimpleNamespace(returncode=returncode, stdout=stdout, stderr=stderr)


@dataclass(frozen=True)
class _AgentProvision:
    image: str


@dataclass(frozen=True)
class _Plan:
    slug: str
    image: str
    dockerfile_path: str
    docker_access: bool
    agent_provision: _AgentProvision


class TestRootlessPodmanStart(unittest.TestCase):
    def test_bootstraps_then_waits_for_guest_local_service(self) -> None:
        bottle = _Bottle([_result(0), _result(1), _result(0)])
        with patch.object(rootless_podman.time, "sleep"):
            rootless_podman.start(bottle)
        self.assertIn("rootless-podman-init", bottle.commands[0])
        self.assertEqual(2, bottle.commands.count("docker info >/dev/null 2>&1"))

    def test_bootstrap_failure_is_fatal_without_privilege_fallback(self) -> None:
        bottle = _Bottle([_result(1, stderr="slirp4netns missing")])
        with patch.object(rootless_podman, "die", side_effect=RuntimeError) as die:
            with self.assertRaises(RuntimeError):
                rootless_podman.start(bottle)
        self.assertIn("slirp4netns missing", die.call_args.args[0])
        self.assertEqual(1, len(bottle.commands))

    def test_timeout_reports_guest_log(self) -> None:
        bottle = _Bottle(
            [_result(0)]
            + [_result(1) for _ in range(rootless_podman.READY_RETRIES)]
            + [_result(0, stdout="operation not permitted")]
        )
        with patch.object(rootless_podman.time, "sleep"), \
             patch.object(rootless_podman, "die", side_effect=RuntimeError) as die:
            with self.assertRaises(RuntimeError):
                rootless_podman.start(bottle)
        self.assertIn("operation not permitted", die.call_args.args[0])


class TestRootlessPodmanDevices(unittest.TestCase):
    def test_relaxes_only_the_two_blocked_device_nodes_as_root(self) -> None:
        calls: list[tuple[str, list[str]]] = []
        rootless_podman.prepare_guest_devices(
            "bottle-1", lambda name, argv: calls.append((name, argv)),
        )
        self.assertEqual(1, len(calls))
        name, argv = calls[0]
        self.assertEqual("bottle-1", name)
        self.assertIn("chmod 0666 /dev/fuse /dev/net/tun", argv[-1])


class TestRootlessPodmanImage(unittest.TestCase):
    def test_layers_tooling_without_changing_base_image(self) -> None:
        calls: list[tuple[str, str, str]] = []

        def build(image: str, context: str, *, dockerfile: str) -> None:
            calls.append((image, context, dockerfile))
            text = Path(dockerfile).read_text(encoding="utf-8")
            self.assertIn("FROM agent:base", text)
            self.assertIn("podman fuse-overlayfs slirp4netns uidmap", text)
            self.assertIn("USER node", text)
            self.assertTrue((Path(context) / "rootless-podman-init.sh").is_file())

        image = rootless_podman.build_image("agent:base", build)
        self.assertEqual("agent:base-rootless-podman", image)
        self.assertEqual("agent:base-rootless-podman", calls[0][0])

    def test_strips_subordinate_ranges_so_podman_avoids_newuidmap(self) -> None:
        """The single-UID fallback is the entire reason podman works here.

        A subordinate range would send podman down the newuidmap path, which
        cannot write a multi-range uid_map without CAP_SYS_ADMIN in an Apple
        Container guest — the failure that killed the rootless-Docker spike.
        """
        seen: list[str] = []

        def build(image: str, context: str, *, dockerfile: str) -> None:
            seen.append(Path(dockerfile).read_text(encoding="utf-8"))

        rootless_podman.build_image("agent:base", build)
        text = seen[0]
        self.assertIn("sed -i '/^node:/d' /etc/subuid /etc/subgid", text)
        self.assertNotIn("subuid", text.replace(
            "sed -i '/^node:/d' /etc/subuid /etc/subgid", "",
        ))

    def test_launch_builds_base_then_rootless_variant(self) -> None:
        plan = cast(MacosContainerBottlePlan, cast(object, _Plan(
            slug="dev-abc",
            image="agent:base",
            dockerfile_path="/repo/Dockerfile",
            docker_access=True,
            agent_provision=_AgentProvision(image="agent:base"),
        )))
        with patch.object(launch_mod, "read_committed_image", return_value=None), \
             patch.object(launch_mod.container_mod, "build_image") as build, \
             patch.object(
                 launch_mod.rootless_podman,
                 "build_image",
                 return_value="agent:base-rootless-podman",
             ) as build_rootless:
            result = launch_mod._build_images(plan)  # pylint: disable=protected-access

        build.assert_called_once_with(
            "agent:base", launch_mod._REPO_DIR,  # pylint: disable=protected-access
            dockerfile="/repo/Dockerfile",
        )
        build_rootless.assert_called_once_with("agent:base", build)
        self.assertEqual("agent:base-rootless-podman", result.agent_provision.image)


if __name__ == "__main__":
    unittest.main()