q792602257
efeb3eb926
Tests / Test passed: 581
Host Agent: - One-time local operator account bootstrap (PBKDF2-HMAC-SHA256, atomic 0600-permission write) gating the daemon's first unattended start via a new `setup` CLI subcommand. - Default control-plane URL now https://amcp.home.jerryyan.top (env var override unchanged). - Enrollment no longer requires a pre-issued token; falls back to zero-token self-service enrollment when none is configured. Cloud control plane: - CLOUD_SELF_SERVICE_ENROLLMENT_ENABLED (default false) opt-in flag. - SelfServiceEnrollmentAuthProvider + ChainedEnrollmentAuthProvider: configured tokens still take priority; self-service only applies when no token matches, preserving edge-host-enrollment's token-bound path. - Fixed a latent bug in sql_repository.py::enroll_host: the token-conflict lookup used `== enrollment_token_digest`, which SQLAlchemy compiles to `IS NULL` when the value is None, so every self-service enrollment after the first would have falsely collided with an existing NULL-digest host. Skipped that lookup entirely when the digest is None. Docs/deploy: .env.example, compose.yaml, compose.deploy.yaml, CLOUD_DEPLOYMENT.md, MACOS_IPHONE_SETUP.md updated for the new flag, URL default, and required `device-host-agent setup` step. Verification: 494 non-integration tests pass; openspec validate --strict passes. PostgreSQL-backed contract tests and full manual end-to-end verification were not run (no Postgres/Docker or reachable cloud-api in this environment); noted as unchecked in tasks.md 7.2/7.4.
94 lines
2.9 KiB
Python
94 lines
2.9 KiB
Python
from __future__ import annotations
|
|
|
|
from host_agent.client import HostAgentAPIError
|
|
from host_agent.config import HostAgentConfig
|
|
from host_agent.enrollment import resolve_host_identity
|
|
from host_agent.identity import HostIdentityStore
|
|
|
|
|
|
def _config(**overrides) -> HostAgentConfig:
|
|
values = {
|
|
"control_plane_url": "https://control.example",
|
|
}
|
|
values.update(overrides)
|
|
return HostAgentConfig(**values)
|
|
|
|
|
|
class _RecordingEnrollmentClient:
|
|
def __init__(self, *, host_id: str = "host-cloud-a") -> None:
|
|
self.host_id = host_id
|
|
self.calls: list[dict] = []
|
|
|
|
def enroll_host(self, **payload):
|
|
from cloud.internal_api.models import HostEnrollmentResponse
|
|
|
|
self.calls.append(payload)
|
|
return HostEnrollmentResponse(host_id=self.host_id)
|
|
|
|
|
|
class _RejectingEnrollmentClient:
|
|
def enroll_host(self, **payload):
|
|
raise HostAgentAPIError(401, "unauthorized")
|
|
|
|
|
|
def test_fresh_install_with_no_token_self_enrolls(tmp_path) -> None:
|
|
identity_store = HostIdentityStore(tmp_path / "identity.json")
|
|
client = _RecordingEnrollmentClient()
|
|
|
|
resolved = resolve_host_identity(
|
|
_config(enrollment_token=""),
|
|
identity_store=identity_store,
|
|
client=client,
|
|
)
|
|
|
|
assert resolved.host_id == "host-cloud-a"
|
|
assert len(client.calls) == 1
|
|
assert identity_store.load().host_id == "host-cloud-a"
|
|
|
|
|
|
def test_self_service_rejection_propagates_as_api_error(tmp_path) -> None:
|
|
identity_store = HostIdentityStore(tmp_path / "identity.json")
|
|
client = _RejectingEnrollmentClient()
|
|
|
|
try:
|
|
resolve_host_identity(
|
|
_config(enrollment_token=""),
|
|
identity_store=identity_store,
|
|
client=client,
|
|
)
|
|
except HostAgentAPIError as exc:
|
|
assert exc.status_code == 401
|
|
else:
|
|
raise AssertionError("expected HostAgentAPIError to propagate")
|
|
assert identity_store.load().host_id is None
|
|
|
|
|
|
def test_configured_enrollment_token_still_used_when_present(tmp_path) -> None:
|
|
identity_store = HostIdentityStore(tmp_path / "identity.json")
|
|
client = _RecordingEnrollmentClient()
|
|
|
|
resolve_host_identity(
|
|
_config(enrollment_token="one-time-token"),
|
|
identity_store=identity_store,
|
|
client=client,
|
|
)
|
|
|
|
assert client.calls[0]["agent_instance_id"]
|
|
|
|
|
|
def test_existing_cached_identity_skips_enrollment(tmp_path) -> None:
|
|
identity_store = HostIdentityStore(tmp_path / "identity.json")
|
|
identity_store.complete(identity_store.load_or_create(), "host-cloud-a")
|
|
|
|
class ExplodingClient:
|
|
def enroll_host(self, **payload):
|
|
raise AssertionError("cached identity must skip enrollment")
|
|
|
|
resolved = resolve_host_identity(
|
|
_config(enrollment_token=""),
|
|
identity_store=identity_store,
|
|
client=ExplodingClient(), # type: ignore[arg-type]
|
|
)
|
|
|
|
assert resolved.host_id == "host-cloud-a"
|