Add isolated Debian installer with credential setup and guarded updates

2026-09-28 15:35:17 +02:00
parent e1a54e3485
commit 2ad844ed20
12 changed files with 618 additions and 8 deletions
@@ -0,0 +1,50 @@
+import os
+import tempfile
+import unittest
+from pathlib import Path
+from unittest.mock import patch
+from auth import CredentialStore
+from server import Server
+from deploy import install as installer
+from network.client import NetworkClient
+
+class InstallTests(unittest.TestCase):
+    def test_refuses_foreign_container(self):
+        with patch.object(installer,'inspect',return_value={'Config':{'Labels':{}}}):
+            with self.assertRaises(RuntimeError):installer.owned('athena-deck-test',Path('/opt/test'))
+    def test_launch_is_loopback_and_unprivileged(self):
+        config=dict(base='/opt/athena-deck-test',name='athena-deck-test',port=8119,image='test:only',gpu_telemetry=False)
+        with patch.object(installer,'run') as run:
+            installer.launch(config)
+        args=run.call_args.args
+        self.assertIn('127.0.0.1:8119:8108',args)
+        self.assertIn('--read-only',args)
+        self.assertEqual(args[args.index('--cap-drop')+1],'ALL')
+        for forbidden in ('--privileged','--gpus','--cap-add','host','/var/run/docker.sock'):
+            self.assertNotIn(forbidden,args)
+    def test_failed_update_restores_only_owned_container(self):
+        with tempfile.TemporaryDirectory() as directory:
+            base=Path(directory);(base/'state').mkdir();(base/'backups').mkdir()
+            config=dict(base=str(base),owner=installer.LABEL,name='athena-deck-test',port=8110,image='old:build',previous_image=None,gpu_telemetry=False)
+            installer.write_manifest(base,config)
+            with patch.object(installer,'owned',return_value={'State':{'Running':True}}),patch.object(installer,'inspect',return_value=None),patch.object(installer,'build',return_value='new:build'),patch.object(installer,'launch',side_effect=RuntimeError('failed')),patch.object(installer,'run') as run:
+                with self.assertRaises(RuntimeError):installer.update(base)
+            self.assertEqual(installer.load_manifest(base)['image'],'old:build')
+            calls=[c.args for c in run.call_args_list]
+            self.assertIn(('docker','rename','athena-deck-test-previous','athena-deck-test'),calls)
+            self.assertIn(('docker','start','athena-deck-test'),calls)
+            self.assertTrue(all('mike-ai' not in ' '.join(c) for c in calls))
+    def test_standalone_never_attempts_ssh(self):
+        with patch.dict(os.environ,{'DECK_NETWORK_MODE':'disabled'}):client=NetworkClient()
+        with patch('network.client.subprocess.run') as remote:
+            self.assertFalse(client.status()['install_supported'])
+            with self.assertRaises(ValueError):client.call('connect')
+            with self.assertRaises(ValueError):client.install('x'*16,'y'*32)
+            remote.assert_not_called()
+    def test_requires_preprovisioned_credentials(self):
+        with tempfile.TemporaryDirectory() as directory,patch.dict(os.environ,{'DECK_REQUIRE_SETUP':'1'}):
+            with self.assertRaises(RuntimeError):Server(0,state_dir=directory)
+    def test_source_allowlist_exists(self):
+        for name in installer.FILES:self.assertTrue((installer.ROOT/name).is_file())
+
+if __name__=='__main__':unittest.main()