51 lines
3.1 KiB
Python
51 lines
3.1 KiB
Python
import os
|
|
import tempfile
|
|
import unittest
|
|
from pathlib import Path
|
|
from unittest.mock import patch
|
|
from auth import CredentialStore
|
|
from server import Server
|
|
from deploy import install as installer
|
|
from network.client import NetworkClient
|
|
|
|
class InstallTests(unittest.TestCase):
|
|
def test_refuses_foreign_container(self):
|
|
with patch.object(installer,'inspect',return_value={'Config':{'Labels':{}}}):
|
|
with self.assertRaises(RuntimeError):installer.owned('athena-deck-test',Path('/opt/test'))
|
|
def test_launch_is_loopback_and_unprivileged(self):
|
|
config=dict(base='/opt/athena-deck-test',name='athena-deck-test',port=8119,image='test:only',gpu_telemetry=False)
|
|
with patch.object(installer,'run') as run:
|
|
installer.launch(config)
|
|
args=run.call_args.args
|
|
self.assertIn('127.0.0.1:8119:8108',args)
|
|
self.assertIn('--read-only',args)
|
|
self.assertEqual(args[args.index('--cap-drop')+1],'ALL')
|
|
for forbidden in ('--privileged','--gpus','--cap-add','host','/var/run/docker.sock'):
|
|
self.assertNotIn(forbidden,args)
|
|
def test_failed_update_restores_only_owned_container(self):
|
|
with tempfile.TemporaryDirectory() as directory:
|
|
base=Path(directory);(base/'state').mkdir();(base/'backups').mkdir()
|
|
config=dict(base=str(base),owner=installer.LABEL,name='athena-deck-test',port=8110,image='old:build',previous_image=None,gpu_telemetry=False)
|
|
installer.write_manifest(base,config)
|
|
with patch.object(installer,'owned',return_value={'State':{'Running':True}}),patch.object(installer,'inspect',return_value=None),patch.object(installer,'build',return_value='new:build'),patch.object(installer,'launch',side_effect=RuntimeError('failed')),patch.object(installer,'run') as run:
|
|
with self.assertRaises(RuntimeError):installer.update(base)
|
|
self.assertEqual(installer.load_manifest(base)['image'],'old:build')
|
|
calls=[c.args for c in run.call_args_list]
|
|
self.assertIn(('docker','rename','athena-deck-test-previous','athena-deck-test'),calls)
|
|
self.assertIn(('docker','start','athena-deck-test'),calls)
|
|
self.assertTrue(all('mike-ai' not in ' '.join(c) for c in calls))
|
|
def test_standalone_never_attempts_ssh(self):
|
|
with patch.dict(os.environ,{'DECK_NETWORK_MODE':'disabled'}):client=NetworkClient()
|
|
with patch('network.client.subprocess.run') as remote:
|
|
self.assertFalse(client.status()['install_supported'])
|
|
with self.assertRaises(ValueError):client.call('connect')
|
|
with self.assertRaises(ValueError):client.install('x'*16,'y'*32)
|
|
remote.assert_not_called()
|
|
def test_requires_preprovisioned_credentials(self):
|
|
with tempfile.TemporaryDirectory() as directory,patch.dict(os.environ,{'DECK_REQUIRE_SETUP':'1'}):
|
|
with self.assertRaises(RuntimeError):Server(0,state_dir=directory)
|
|
def test_source_allowlist_exists(self):
|
|
for name in installer.FILES:self.assertTrue((installer.ROOT/name).is_file())
|
|
|
|
if __name__=='__main__':unittest.main()
|