merge: testing → main (reconcile 2-week divergence)

tests/canary/test_worker_http.py

@@ -0,0 +1,124 @@
+"""HTTP surface coverage for the canary worker.
+
+We exercise the FastAPI app via Starlette's TestClient so the test
+doesn't need a real socket. Asserts:
+
+* ``GET /c/{slug}`` for a known slug returns 200 + image/gif, persists
+  a trigger row, bumps the token's counters, and publishes
+  ``canary.<token_id>.triggered`` on the bus.
+* ``GET /c/{slug}`` for an unknown slug returns the same 200 (stealth)
+  but persists nothing.
+* The Server header is rewritten to a generic value (``nginx``).
+* Bare root returns 404.
+* X-Forwarded-For is honored.
+"""
+from __future__ import annotations
+
+import asyncio
+from typing import AsyncIterator
+
+import pytest
+import pytest_asyncio
+from fastapi.testclient import TestClient
+
+from decnet.bus import topics
+from decnet.bus.fake import FakeBus
+from decnet.canary.worker import _build_app
+from decnet.web.db.sqlite.repository import SQLiteRepository
+import decnet.web.db.models  # noqa: F401
+
+
+@pytest_asyncio.fixture
+async def repo(tmp_path) -> AsyncIterator[SQLiteRepository]:
+    r = SQLiteRepository(str(tmp_path / "w.db"))
+    await r.initialize()
+    yield r
+
+
+@pytest_asyncio.fixture
+async def bus() -> AsyncIterator[FakeBus]:
+    b = FakeBus()
+    await b.connect()
+    yield b
+    await b.close()
+
+
+@pytest.mark.asyncio
+async def test_known_slug_records_trigger_and_publishes(
+    repo: SQLiteRepository, bus: FakeBus,
+) -> None:
+    await repo.create_canary_token({
+        "uuid": "tok-w1", "kind": "http", "decky_name": "web1",
+        "generator": "env_file", "placement_path": "/x",
+        "callback_token": "slug-W1", "secret_seed": "s", "created_by": "u1",
+    })
+    sub = bus.subscribe("canary.>")
+    app = _build_app(repo, bus)
+    with TestClient(app) as client:
+        resp = client.get("/c/slug-W1", headers={"User-Agent": "curl/8.0"})
+    assert resp.status_code == 200
+    assert resp.headers["content-type"].startswith("image/gif")
+    assert resp.headers.get("server") == "nginx"
+
+    event = await asyncio.wait_for(sub.__anext__(), timeout=2.0)
+    assert event.topic == topics.canary("tok-w1", topics.CANARY_TRIGGERED)
+    assert event.payload["src_ip"]
+    assert event.payload["user_agent"] == "curl/8.0"
+
+    triggers = await repo.list_canary_triggers("tok-w1")
+    assert len(triggers) == 1
+    assert triggers[0]["request_path"] == "/c/slug-W1"
+
+    tok = await repo.get_canary_token("tok-w1")
+    assert tok["trigger_count"] == 1
+
+
+@pytest.mark.asyncio
+async def test_unknown_slug_returns_same_response_but_persists_nothing(
+    repo: SQLiteRepository, bus: FakeBus,
+) -> None:
+    app = _build_app(repo, bus)
+    with TestClient(app) as client:
+        resp = client.get("/c/unknown-slug")
+    assert resp.status_code == 200
+    assert resp.headers["content-type"].startswith("image/gif")
+    # No tokens, no triggers, no nothing.
+    assert await repo.list_canary_tokens() == []
+
+
+@pytest.mark.asyncio
+async def test_root_returns_404(repo: SQLiteRepository, bus: FakeBus) -> None:
+    app = _build_app(repo, bus)
+    with TestClient(app) as client:
+        resp = client.get("/")
+    assert resp.status_code == 404
+
+
+@pytest.mark.asyncio
+async def test_xff_is_honored(repo: SQLiteRepository, bus: FakeBus) -> None:
+    await repo.create_canary_token({
+        "uuid": "tok-xff", "kind": "http", "decky_name": "web1",
+        "generator": "env_file", "placement_path": "/x",
+        "callback_token": "slug-xff", "secret_seed": "s", "created_by": "u1",
+    })
+    app = _build_app(repo, bus)
+    with TestClient(app) as client:
+        client.get("/c/slug-xff", headers={"X-Forwarded-For": "9.9.9.9, 10.0.0.1"})
+    triggers = await repo.list_canary_triggers("tok-xff")
+    assert triggers[0]["src_ip"] == "9.9.9.9"
+
+
+@pytest.mark.asyncio
+async def test_no_decnet_strings_in_response(repo: SQLiteRepository, bus: FakeBus) -> None:
+    """Stealth posture: nothing in the HTTP surface mentions DECNET."""
+    app = _build_app(repo, bus)
+    with TestClient(app) as client:
+        resp = client.get("/c/anything")
+        body = resp.content.lower()
+        for v in resp.headers.values():
+            assert b"decnet" not in v.lower().encode()
+        assert b"decnet" not in body
+        # Docs / openapi / redoc are disabled.
+        assert client.get("/docs").status_code == 404
+        assert client.get("/openapi.json").status_code == 404
+        assert client.get("/redoc").status_code == 404