feat(cloud): remove static credentials and add host console

tests/test_deployment_config.py

@@ -1,12 +1,21 @@
 from __future__ import annotations
 
-import json
 from pathlib import Path
 
 import yaml
 
 
 ROOT = Path(__file__).resolve().parents[1]
+REMOVED_CREDENTIAL_SETTINGS = {
+    "CLOUD_PUBLIC_CREDENTIALS_JSON",
+    "CLOUD_HOST_CREDENTIALS_JSON",
+    "CLOUD_ENROLLMENT_TOKENS_JSON",
+    "CLOUD_SELF_SERVICE_ENROLLMENT_ENABLED",
+    "CLOUD_CONSOLE_STATIC_DIR",
+    "HOST_AGENT_HOST_ID",
+    "HOST_AGENT_TOKEN",
+    "HOST_AGENT_ENROLLMENT_TOKEN",
+}
 
 
 def test_compose_defines_database_control_plane_and_outbound_host_agent() -> None:
@@ -29,45 +38,57 @@ def test_compose_defines_database_control_plane_and_outbound_host_agent() -> Non
         services["host-agent"]["environment"]["HOST_AGENT_CONTROL_PLANE_URL"]
         == "http://cloud-api:8001"
     )
-    assert services["host-agent"]["environment"]["AI_PLANNER_ENABLED"] == (
-        "${AI_PLANNER_ENABLED:-false}"
+    assert services["host-agent"]["environment"]["HOST_AGENT_IDENTITY_PATH"] == (
+        "${HOST_AGENT_IDENTITY_PATH:-/app/tasks/host_identity.json}"
     )
-    assert (
-        services["cloud-api"]["environment"]["CLOUD_ENROLLMENT_TOKENS_JSON"]
-        == "${CLOUD_ENROLLMENT_TOKENS_JSON:-[]}"
-    )
-    assert (
-        services["host-agent"]["environment"]["HOST_AGENT_IDENTITY_PATH"]
-        == "${HOST_AGENT_IDENTITY_PATH:-/app/tasks/host_identity.json}"
-    )
-    assert "ports" not in services["host-agent"]
+    assert not (
+        set(services["cloud-api"]["environment"])
+        | set(services["host-agent"]["environment"])
+    ) & REMOVED_CREDENTIAL_SETTINGS
 
 
-def test_container_uses_locked_workspace_install_and_migrations() -> None:
+def test_deploy_compose_has_only_cloud_services_and_minimal_environment() -> None:
+    compose = yaml.safe_load(
+        (ROOT / "compose.deploy.yaml").read_text(encoding="utf-8")
+    )
+    services = compose["services"]
+
+    assert set(services) == {"postgres", "cloud-api"}
+    assert services["cloud-api"]["image"].endswith(":${IMAGE_TAG:-latest}")
+    assert services["cloud-api"]["environment"] == {
+        "CLOUD_ENVIRONMENT": "production",
+        "CLOUD_DATABASE_URL": (
+            "postgresql+psycopg://${POSTGRES_USER}:${POSTGRES_PASSWORD}"
+            "@postgres:5432/${POSTGRES_DB}"
+        ),
+        "CLOUD_TRUST_PROXY_HEADERS": "${CLOUD_TRUST_PROXY_HEADERS:-false}",
+    }
+
+
+def test_container_uses_locked_workspace_install_migrations_and_static_console() -> None:
     dockerfile = (ROOT / "Dockerfile").read_text(encoding="utf-8")
     compose = yaml.safe_load((ROOT / "compose.yaml").read_text(encoding="utf-8"))
     cloud_command = compose["services"]["cloud-api"]["command"][-1]
 
     assert "uv sync --locked --all-packages --no-dev" in dockerfile
+    assert "CLOUD_CONSOLE_STATIC_DIR=/app/console-static" in dockerfile
     assert "alembic" in cloud_command
     assert "upgrade head" in cloud_command
     assert "device-cloud-api --host 0.0.0.0" in cloud_command
 
 
-def test_example_environment_contains_only_placeholder_credentials() -> None:
+def test_example_environment_contains_no_static_credentials() -> None:
     values = {}
     for line in (ROOT / ".env.example").read_text(encoding="utf-8").splitlines():
         if line and not line.startswith("#"):
             name, value = line.split("=", 1)
             values[name] = value
 
-    public_credentials = json.loads(values["CLOUD_PUBLIC_CREDENTIALS_JSON"])
-    host_credentials = json.loads(values["CLOUD_HOST_CREDENTIALS_JSON"])
-    enrollment_credentials = json.loads(values["CLOUD_ENROLLMENT_TOKENS_JSON"])
-
-    assert public_credentials[0]["token"].startswith("change-me-")
-    assert host_credentials[0]["token"] == values["HOST_AGENT_TOKEN"]
-    assert host_credentials[0]["token"].startswith("change-me-")
-    assert host_credentials[0]["host_id"] == values["HOST_AGENT_HOST_ID"]
-    assert enrollment_credentials[0]["token"].startswith("change-me-")
-    assert values["HOST_AGENT_IDENTITY_PATH"] == "/app/tasks/host_identity.json"
+    assert set(values) == {
+        "IMAGE_TAG",
+        "POSTGRES_DB",
+        "POSTGRES_USER",
+        "POSTGRES_PASSWORD",
+        "CLOUD_API_PORT",
+    }
+    assert not set(values) & REMOVED_CREDENTIAL_SETTINGS