fix(#664): remediate break-glass restart workflow blockers B1, B6/B11, B9, B10, B8, and B12
This commit is contained in:
@@ -23,14 +23,12 @@ class TestBreakGlassRestart(unittest.TestCase):
|
||||
def test_role_authorization_matrix_with_real_resolver(self) -> None:
|
||||
"""AC1: Explicit allowlist enforcement using production _profile_role_kind resolver.
|
||||
|
||||
Privileged roles (controller, operator, admin, sysadmin) pass role check.
|
||||
Ordinary LLM roles (author, reviewer, merger, reconciler) and unknown/malformed roles fail closed.
|
||||
Privileged controller role passes role check.
|
||||
Synthetic roles (operator, admin, sysadmin), ordinary LLM roles (author, reviewer, merger, reconciler), and unknown/malformed roles fail closed.
|
||||
"""
|
||||
allowed_profiles = [
|
||||
{"role": "controller", "allowed_operations": ["gitea.read", "gitea.issue.create"]},
|
||||
{"role": "operator", "allowed_operations": ["gitea.read", "gitea.issue.create"]},
|
||||
{"role": "admin", "allowed_operations": ["gitea.read", "gitea.issue.create"]},
|
||||
{"role": "sysadmin", "allowed_operations": ["gitea.read", "gitea.issue.create"]},
|
||||
{"role": "controller", "allowed_operations": ["gitea.read", "gitea.issue.create", "runtime.break_glass_restart"]},
|
||||
{"profile_name": "prgs-controller", "allowed_operations": ["gitea.read", "gitea.issue.create", "runtime.break_glass_restart"]},
|
||||
]
|
||||
|
||||
for prof in allowed_profiles:
|
||||
@@ -48,10 +46,13 @@ class TestBreakGlassRestart(unittest.TestCase):
|
||||
)
|
||||
self.assertTrue(
|
||||
res["success"],
|
||||
f"Profile with role '{prof.get('role')}' should pass role check",
|
||||
f"Profile {prof} should pass role check",
|
||||
)
|
||||
|
||||
denied_profiles = [
|
||||
{"role": "operator", "allowed_operations": ["gitea.read", "gitea.issue.create"]},
|
||||
{"role": "admin", "allowed_operations": ["gitea.read", "gitea.issue.create"]},
|
||||
{"role": "sysadmin", "allowed_operations": ["gitea.read", "gitea.issue.create"]},
|
||||
{"role": "author", "allowed_operations": ["gitea.read", "gitea.issue.create"]},
|
||||
{"role": "reviewer", "allowed_operations": ["gitea.read"]},
|
||||
{"role": "merger", "allowed_operations": ["gitea.read"]},
|
||||
@@ -174,7 +175,8 @@ class TestBreakGlassRestart(unittest.TestCase):
|
||||
raw_reason = "Emergency restart: token ghp_secretToken12345 and url https://user:[email protected]/api"
|
||||
|
||||
mock_api_request = MagicMock(return_value={"number": 101, "title": "[INCIDENT]"})
|
||||
mock_restart_exec = {"success": True, "apply_authorized": True}
|
||||
mock_restart_exec = {"success": True, "apply_supported": True, "apply_authorized": True, "restart_performed": True}
|
||||
mock_recon = {"success": True}
|
||||
|
||||
with patch.object(gitea_mcp_server, "get_profile", return_value=controller_prof), patch.object(
|
||||
gitea_mcp_server, "_profile_operation_gate", return_value=None
|
||||
@@ -186,6 +188,10 @@ class TestBreakGlassRestart(unittest.TestCase):
|
||||
gitea_mcp_server, "api_request", mock_api_request
|
||||
), patch.object(
|
||||
gitea_mcp_server, "gitea_request_mcp_restart", return_value=mock_restart_exec
|
||||
), patch.object(
|
||||
gitea_mcp_server, "gitea_reconcile_after_restart", return_value=mock_recon
|
||||
), patch.object(
|
||||
gitea_audit, "audit_enabled", return_value=True
|
||||
), patch.object(
|
||||
gitea_audit, "write_event", return_value=True
|
||||
):
|
||||
@@ -253,6 +259,8 @@ class TestBreakGlassRestart(unittest.TestCase):
|
||||
gitea_mcp_server, "_authenticated_username", return_value="sysadmin"
|
||||
), patch.object(
|
||||
gitea_mcp_server, "gitea_request_mcp_restart", side_effect=[{"affected_sessions": []}, mock_restart_exec]
|
||||
), patch.object(
|
||||
gitea_audit, "audit_enabled", return_value=True
|
||||
), patch.object(
|
||||
gitea_audit, "write_event", return_value=True
|
||||
), patch.object(
|
||||
@@ -326,9 +334,10 @@ class TestBreakGlassRestart(unittest.TestCase):
|
||||
|
||||
def test_successful_real_execution(self) -> None:
|
||||
"""Requirement 4: Real execution calls canonical restart path and reports execution truthfully."""
|
||||
controller_prof = {"role": "controller", "allowed_operations": ["gitea.read", "gitea.issue.create"]}
|
||||
controller_prof = {"profile_name": "prgs-controller", "allowed_operations": ["gitea.read", "gitea.issue.create", "runtime.break_glass_restart"]}
|
||||
mock_api_request = MagicMock(return_value={"number": 555, "title": "[INCIDENT]"})
|
||||
mock_restart_exec = {"success": True, "apply_authorized": True, "affected_sessions": []}
|
||||
mock_restart_exec = {"success": True, "apply_supported": True, "apply_authorized": True, "restart_performed": True, "affected_sessions": []}
|
||||
mock_recon = {"success": True, "reconciled": True}
|
||||
|
||||
with patch.object(gitea_mcp_server, "get_profile", return_value=controller_prof), patch.object(
|
||||
gitea_mcp_server, "_profile_operation_gate", return_value=None
|
||||
@@ -338,6 +347,10 @@ class TestBreakGlassRestart(unittest.TestCase):
|
||||
gitea_mcp_server, "_authenticated_username", return_value="sysadmin"
|
||||
), patch.object(
|
||||
gitea_mcp_server, "gitea_request_mcp_restart", return_value=mock_restart_exec
|
||||
), patch.object(
|
||||
gitea_mcp_server, "gitea_reconcile_after_restart", return_value=mock_recon
|
||||
), patch.object(
|
||||
gitea_audit, "audit_enabled", return_value=True
|
||||
), patch.object(
|
||||
gitea_audit, "write_event", return_value=True
|
||||
), patch.object(
|
||||
@@ -357,12 +370,150 @@ class TestBreakGlassRestart(unittest.TestCase):
|
||||
self.assertTrue(res["break_glass_executed"])
|
||||
self.assertEqual(res["incident_issue"]["number"], 555)
|
||||
|
||||
def test_unsupported_apply_returns_truthful_unsupported_result(self) -> None:
|
||||
"""B6/B11: apply_supported=False returns apply_unsupported blocker and break_glass_executed=False."""
|
||||
controller_prof = {"profile_name": "prgs-controller", "allowed_operations": ["gitea.read", "gitea.issue.create", "runtime.break_glass_restart"]}
|
||||
mock_api_request = MagicMock(return_value={"number": 555, "title": "[INCIDENT]"})
|
||||
mock_restart_unsupported = {"success": True, "apply_supported": False, "apply_authorized": True, "restart_performed": False}
|
||||
|
||||
with patch.object(gitea_mcp_server, "get_profile", return_value=controller_prof), patch.object(
|
||||
gitea_mcp_server, "_profile_operation_gate", return_value=None
|
||||
), patch.object(
|
||||
gitea_mcp_server, "_auth", return_value={"Authorization": "token test"}
|
||||
), patch.object(
|
||||
gitea_mcp_server, "_authenticated_username", return_value="sysadmin"
|
||||
), patch.object(
|
||||
gitea_mcp_server, "gitea_request_mcp_restart", side_effect=[{"affected_sessions": []}, mock_restart_unsupported]
|
||||
), patch.object(
|
||||
gitea_audit, "audit_enabled", return_value=True
|
||||
), patch.object(
|
||||
gitea_audit, "write_event", return_value=True
|
||||
), patch.object(
|
||||
gitea_mcp_server, "api_request", mock_api_request
|
||||
):
|
||||
res = gitea_mcp_server.gitea_break_glass_restart(
|
||||
reason="Privileged restart request with unsupported coordinator apply",
|
||||
confirmation="I_ACKNOWLEDGE_BREAK_GLASS_MCP_RESTART_DISRUPTION",
|
||||
impact_ack=True,
|
||||
dry_run=False,
|
||||
create_incident_issue=True,
|
||||
remote="prgs",
|
||||
)
|
||||
self.assertFalse(res["success"])
|
||||
self.assertFalse(res["performed"])
|
||||
self.assertFalse(res["break_glass_executed"])
|
||||
self.assertEqual(res["blocker_kind"], "apply_unsupported")
|
||||
|
||||
def test_reconciliation_failure_after_execution(self) -> None:
|
||||
"""B10: Post-restart reconciliation failure reports break_glass_executed=True but success=False."""
|
||||
controller_prof = {"profile_name": "prgs-controller", "allowed_operations": ["gitea.read", "gitea.issue.create", "runtime.break_glass_restart"]}
|
||||
mock_api_request = MagicMock(return_value={"number": 555, "title": "[INCIDENT]"})
|
||||
mock_restart_exec = {"success": True, "apply_supported": True, "apply_authorized": True, "restart_performed": True}
|
||||
mock_recon = {"success": False, "error": "lease cleanup failed"}
|
||||
|
||||
with patch.object(gitea_mcp_server, "get_profile", return_value=controller_prof), patch.object(
|
||||
gitea_mcp_server, "_profile_operation_gate", return_value=None
|
||||
), patch.object(
|
||||
gitea_mcp_server, "_auth", return_value={"Authorization": "token test"}
|
||||
), patch.object(
|
||||
gitea_mcp_server, "_authenticated_username", return_value="sysadmin"
|
||||
), patch.object(
|
||||
gitea_mcp_server, "gitea_request_mcp_restart", return_value=mock_restart_exec
|
||||
), patch.object(
|
||||
gitea_mcp_server, "gitea_reconcile_after_restart", return_value=mock_recon
|
||||
), patch.object(
|
||||
gitea_audit, "audit_enabled", return_value=True
|
||||
), patch.object(
|
||||
gitea_audit, "write_event", return_value=True
|
||||
), patch.object(
|
||||
gitea_mcp_server, "api_request", mock_api_request
|
||||
):
|
||||
res = gitea_mcp_server.gitea_break_glass_restart(
|
||||
reason="Privileged restart request with failing reconciliation",
|
||||
confirmation="I_ACKNOWLEDGE_BREAK_GLASS_MCP_RESTART_DISRUPTION",
|
||||
impact_ack=True,
|
||||
dry_run=False,
|
||||
create_incident_issue=True,
|
||||
remote="prgs",
|
||||
)
|
||||
self.assertFalse(res["success"])
|
||||
self.assertTrue(res["performed"])
|
||||
self.assertTrue(res["break_glass_executed"])
|
||||
self.assertEqual(res["blocker_kind"], "reconciliation_failed")
|
||||
|
||||
def test_bare_secret_redaction(self) -> None:
|
||||
"""B8: Bare token shapes like ghp_... and sk-live-... are redacted on all surfaces."""
|
||||
controller_prof = {"profile_name": "prgs-controller", "allowed_operations": ["gitea.read", "gitea.issue.create", "runtime.break_glass_restart"]}
|
||||
raw_reason = "Emergency restart reason containing bare tokens ghp_1234567890abcdef12345678 and sk-live-abcdef1234567890abcdef"
|
||||
mock_api_request = MagicMock(return_value={"number": 101, "title": "[INCIDENT]"})
|
||||
mock_restart_exec = {"success": True, "apply_supported": True, "apply_authorized": True, "restart_performed": True}
|
||||
mock_recon = {"success": True}
|
||||
|
||||
with patch.object(gitea_mcp_server, "get_profile", return_value=controller_prof), patch.object(
|
||||
gitea_mcp_server, "_profile_operation_gate", return_value=None
|
||||
), patch.object(
|
||||
gitea_mcp_server, "_auth", return_value={"Authorization": "token test"}
|
||||
), patch.object(
|
||||
gitea_mcp_server, "_authenticated_username", return_value="sysadmin"
|
||||
), patch.object(
|
||||
gitea_mcp_server, "api_request", mock_api_request
|
||||
), patch.object(
|
||||
gitea_mcp_server, "gitea_request_mcp_restart", return_value=mock_restart_exec
|
||||
), patch.object(
|
||||
gitea_mcp_server, "gitea_reconcile_after_restart", return_value=mock_recon
|
||||
), patch.object(
|
||||
gitea_audit, "audit_enabled", return_value=True
|
||||
), patch.object(
|
||||
gitea_audit, "write_event", return_value=True
|
||||
):
|
||||
res = gitea_mcp_server.gitea_break_glass_restart(
|
||||
reason=raw_reason,
|
||||
confirmation="I_ACKNOWLEDGE_BREAK_GLASS_MCP_RESTART_DISRUPTION",
|
||||
impact_ack=True,
|
||||
dry_run=False,
|
||||
create_incident_issue=True,
|
||||
remote="prgs",
|
||||
)
|
||||
self.assertTrue(res["success"])
|
||||
self.assertNotIn("ghp_1234567890abcdef12345678", res["reason"])
|
||||
self.assertNotIn("sk-live-abcdef1234567890abcdef", res["reason"])
|
||||
self.assertIn("[REDACTED]", res["reason"])
|
||||
|
||||
def test_audit_disabled_fails_closed(self) -> None:
|
||||
"""B9: Disabling audit recording blocks execution fail-closed."""
|
||||
controller_prof = {"profile_name": "prgs-controller", "allowed_operations": ["gitea.read", "gitea.issue.create", "runtime.break_glass_restart"]}
|
||||
|
||||
with patch.object(gitea_mcp_server, "get_profile", return_value=controller_prof), patch.object(
|
||||
gitea_mcp_server, "_profile_operation_gate", return_value=None
|
||||
), patch.object(
|
||||
gitea_audit, "audit_enabled", return_value=False
|
||||
):
|
||||
res = gitea_mcp_server.gitea_break_glass_restart(
|
||||
reason="Emergency restart with disabled audit logging",
|
||||
confirmation="I_ACKNOWLEDGE_BREAK_GLASS_MCP_RESTART_DISRUPTION",
|
||||
impact_ack=True,
|
||||
dry_run=False,
|
||||
create_incident_issue=True,
|
||||
remote="prgs",
|
||||
)
|
||||
self.assertFalse(res["success"])
|
||||
self.assertFalse(res["break_glass_executed"])
|
||||
self.assertEqual(res["blocker_kind"], "audit_recording_failed")
|
||||
|
||||
def test_capability_map_registration(self) -> None:
|
||||
"""B12: Ensure task_capability_map maps gitea_break_glass_restart to runtime.break_glass_restart."""
|
||||
from task_capability_map import TASK_CAPABILITY_MAP
|
||||
entry = TASK_CAPABILITY_MAP.get("gitea_break_glass_restart")
|
||||
self.assertIsNotNone(entry)
|
||||
self.assertEqual(entry["permission"], "runtime.break_glass_restart")
|
||||
self.assertEqual(entry["role"], "controller")
|
||||
|
||||
def test_delegated_execution_failure(self) -> None:
|
||||
"""Requirement 4: Delegated restart execution failure produces distinct terminal state."""
|
||||
controller_prof = {"role": "controller", "allowed_operations": ["gitea.read", "gitea.issue.create"]}
|
||||
controller_prof = {"profile_name": "prgs-controller", "allowed_operations": ["gitea.read", "gitea.issue.create", "runtime.break_glass_restart"]}
|
||||
mock_api_request = MagicMock(return_value={"number": 555, "title": "[INCIDENT]"})
|
||||
mock_impact_eval = {"affected_sessions": []}
|
||||
mock_restart_denied = {"success": False, "apply_authorized": False, "reasons": ["restart class denied"]}
|
||||
mock_restart_denied = {"success": False, "apply_supported": True, "apply_authorized": False, "reasons": ["restart class denied"]}
|
||||
|
||||
with patch.object(gitea_mcp_server, "get_profile", return_value=controller_prof), patch.object(
|
||||
gitea_mcp_server, "_profile_operation_gate", return_value=None
|
||||
@@ -372,6 +523,8 @@ class TestBreakGlassRestart(unittest.TestCase):
|
||||
gitea_mcp_server, "_authenticated_username", return_value="sysadmin"
|
||||
), patch.object(
|
||||
gitea_mcp_server, "gitea_request_mcp_restart", side_effect=[mock_impact_eval, mock_restart_denied]
|
||||
), patch.object(
|
||||
gitea_audit, "audit_enabled", return_value=True
|
||||
), patch.object(
|
||||
gitea_audit, "write_event", return_value=True
|
||||
), patch.object(
|
||||
|
||||
Reference in New Issue
Block a user