396 lines
15 KiB
Python
396 lines
15 KiB
Python
"""Regression coverage for reviewer-lease preflight ordering (#763)."""
|
|
|
|
from __future__ import annotations
|
|
|
|
from datetime import datetime, timezone
|
|
from unittest.mock import patch
|
|
|
|
import pytest
|
|
|
|
import anti_stomp_preflight
|
|
import gitea_mcp_server as server
|
|
import merger_lease_adoption
|
|
import reviewer_pr_lease
|
|
import task_capability_map
|
|
|
|
|
|
def _prime_clean_reviewer_preflight(monkeypatch, resolved_task: str) -> None:
|
|
"""Install a clean reviewer preflight without bypassing task matching."""
|
|
monkeypatch.setenv("GITEA_TEST_PORCELAIN", "")
|
|
monkeypatch.delenv("GITEA_TEST_FORCE_DIRTY", raising=False)
|
|
monkeypatch.setattr(server, "_preflight_in_test_mode", lambda: False)
|
|
monkeypatch.setattr(server, "_process_start_porcelain", "")
|
|
monkeypatch.setattr(server, "_preflight_whoami_called", False)
|
|
monkeypatch.setattr(server, "_preflight_capability_called", False)
|
|
monkeypatch.setattr(server, "_preflight_whoami_violation", False)
|
|
monkeypatch.setattr(server, "_preflight_capability_violation", False)
|
|
monkeypatch.setattr(server, "_preflight_resolved_role", None)
|
|
monkeypatch.setattr(server, "_preflight_resolved_task", None)
|
|
monkeypatch.setattr(server, "_preflight_whoami_baseline_porcelain", None)
|
|
monkeypatch.setattr(server, "_preflight_capability_baseline_porcelain", None)
|
|
monkeypatch.setattr(server, "_preflight_whoami_violation_files", [])
|
|
monkeypatch.setattr(server, "_preflight_capability_violation_files", [])
|
|
monkeypatch.setattr(server, "_preflight_reviewer_violation_files", [])
|
|
monkeypatch.setattr(
|
|
server,
|
|
"_resolve_namespace_mutation_context",
|
|
lambda _worktree=None: {
|
|
"workspace_path": server.PROJECT_ROOT,
|
|
"canonical_repo_root": server.PROJECT_ROOT,
|
|
"process_project_root": server.PROJECT_ROOT,
|
|
"workspace_role_kind": "reviewer",
|
|
"workspace_binding_source": "test reviewer binding",
|
|
"ignored_bindings": [],
|
|
},
|
|
)
|
|
monkeypatch.setattr(server, "_enforce_stable_branch_contamination_gate", lambda *_a: None)
|
|
monkeypatch.setattr(server, "_enforce_canonical_repository_root", lambda *_a, **_k: None)
|
|
monkeypatch.setattr(server, "_enforce_root_checkout_guard", lambda *_a: None)
|
|
monkeypatch.setattr(server, "_enforce_branches_only_author_mutation", lambda *_a, **_k: None)
|
|
monkeypatch.setattr(server, "_enforce_issue_scope_guard", lambda *_a, **_k: None)
|
|
monkeypatch.setattr(server, "_create_issue_bootstrap_assessment", lambda *_a: None)
|
|
monkeypatch.setattr(server, "_run_anti_stomp_preflight", lambda *_a, **_k: None)
|
|
|
|
server.record_preflight_check("whoami")
|
|
server.record_preflight_check(
|
|
"capability", resolved_role="reviewer", resolved_task=resolved_task
|
|
)
|
|
|
|
|
|
def test_documented_review_capability_allows_reviewer_lease_acquire(monkeypatch):
|
|
"""whoami -> resolve(review_pr) -> acquire reviewer lease is canonical."""
|
|
_prime_clean_reviewer_preflight(monkeypatch, "review_pr")
|
|
|
|
server.verify_preflight_purity(task="acquire_reviewer_pr_lease")
|
|
|
|
assert server._preflight_capability_called is False
|
|
|
|
|
|
def test_exact_lease_capability_without_intervening_call_still_succeeds(monkeypatch):
|
|
_prime_clean_reviewer_preflight(monkeypatch, "acquire_reviewer_pr_lease")
|
|
|
|
server.verify_preflight_purity(task="acquire_reviewer_pr_lease")
|
|
|
|
assert server._preflight_capability_called is False
|
|
|
|
|
|
def test_missing_wrong_and_consumed_capability_fail_closed(monkeypatch):
|
|
_prime_clean_reviewer_preflight(monkeypatch, "create_issue")
|
|
with pytest.raises(RuntimeError, match="task mismatch"):
|
|
server.verify_preflight_purity(task="acquire_reviewer_pr_lease")
|
|
|
|
_prime_clean_reviewer_preflight(monkeypatch, "acquire_reviewer_pr_lease")
|
|
server.verify_preflight_purity(task="acquire_reviewer_pr_lease")
|
|
with pytest.raises(RuntimeError, match="has not been resolved"):
|
|
server.verify_preflight_purity(task="acquire_reviewer_pr_lease")
|
|
|
|
|
|
def test_documented_intervening_whoami_read_preserves_capability(monkeypatch):
|
|
_prime_clean_reviewer_preflight(monkeypatch, "review_pr")
|
|
with patch.object(server, "_get_workspace_porcelain", return_value=""):
|
|
server.record_preflight_check("whoami")
|
|
|
|
server.verify_preflight_purity(task="acquire_reviewer_pr_lease")
|
|
|
|
|
|
def test_reviewer_transition_is_narrow_alias_aware_and_one_way():
|
|
assert task_capability_map.preflight_task_matches(
|
|
"review_pr", "gitea_acquire_reviewer_pr_lease"
|
|
)
|
|
assert task_capability_map.preflight_task_matches(
|
|
"gitea_acquire_reviewer_pr_lease", "acquire_reviewer_pr_lease"
|
|
)
|
|
assert not task_capability_map.preflight_task_matches(
|
|
"acquire_reviewer_pr_lease", "review_pr"
|
|
)
|
|
assert not task_capability_map.preflight_task_matches(
|
|
"review_pr", "acquire_merger_pr_lease"
|
|
)
|
|
assert not task_capability_map.preflight_task_matches(
|
|
"merge_pr", "acquire_reviewer_pr_lease"
|
|
)
|
|
|
|
|
|
def test_dirty_reviewer_workspace_still_fails_closed(monkeypatch):
|
|
_prime_clean_reviewer_preflight(monkeypatch, "review_pr")
|
|
monkeypatch.setenv("GITEA_TEST_PORCELAIN", " M gitea_mcp_server.py\n")
|
|
|
|
with pytest.raises(RuntimeError, match="Reviewer role violation"):
|
|
server.verify_preflight_purity(task="acquire_reviewer_pr_lease")
|
|
|
|
|
|
def test_mismatched_reviewer_workspace_still_fails_closed(monkeypatch):
|
|
_prime_clean_reviewer_preflight(monkeypatch, "review_pr")
|
|
monkeypatch.setattr(
|
|
server,
|
|
"_resolve_namespace_mutation_context",
|
|
lambda _worktree=None: {
|
|
"workspace_path": "/outside/review-pr-762",
|
|
"canonical_repo_root": "/repo",
|
|
"process_project_root": "/repo",
|
|
"workspace_role_kind": "reviewer",
|
|
"workspace_binding_source": "test reviewer binding",
|
|
"ignored_bindings": [],
|
|
},
|
|
)
|
|
monkeypatch.setattr(
|
|
server.author_mutation_worktree,
|
|
"assess_workspace_repo_membership",
|
|
lambda **_kwargs: {"block": True, "reasons": ["workspace mismatch"]},
|
|
)
|
|
monkeypatch.setattr(
|
|
server.author_mutation_worktree,
|
|
"format_workspace_repo_membership_error",
|
|
lambda _assessment: "workspace mismatch (fail closed)",
|
|
)
|
|
|
|
with pytest.raises(RuntimeError, match="workspace mismatch"):
|
|
server.verify_preflight_purity(task="acquire_reviewer_pr_lease")
|
|
|
|
|
|
def test_reviewer_lease_acquire_requires_workflow_load_proof(monkeypatch):
|
|
sha = "a" * 40
|
|
monkeypatch.setattr(server, "_anti_stomp_in_test_mode", lambda: False)
|
|
monkeypatch.setattr(
|
|
server,
|
|
"get_profile",
|
|
lambda: {
|
|
"profile_name": "prgs-reviewer",
|
|
"role": "reviewer",
|
|
"allowed_operations": [
|
|
"gitea.read",
|
|
"gitea.pr.comment",
|
|
"gitea.pr.review",
|
|
],
|
|
},
|
|
)
|
|
monkeypatch.setattr(server, "_actual_profile_role", lambda: "reviewer")
|
|
monkeypatch.setattr(
|
|
server,
|
|
"_resolve_namespace_mutation_context",
|
|
lambda _worktree=None: {
|
|
"workspace_path": "/repo/branches/review-pr-762",
|
|
"canonical_repo_root": "/repo",
|
|
"process_project_root": "/repo",
|
|
},
|
|
)
|
|
monkeypatch.setattr(
|
|
server.issue_lock_worktree,
|
|
"read_worktree_git_state",
|
|
lambda _path: {
|
|
"current_branch": "master",
|
|
"head_sha": sha,
|
|
"porcelain_status": "",
|
|
},
|
|
)
|
|
monkeypatch.setattr(
|
|
server.root_checkout_guard,
|
|
"resolve_remote_master_sha",
|
|
lambda _path: sha,
|
|
)
|
|
monkeypatch.setattr(
|
|
server,
|
|
"_current_master_parity",
|
|
lambda: {"startup_head": sha, "current_head": sha},
|
|
)
|
|
monkeypatch.setattr(server, "_local_git_remote_url", lambda _remote: None)
|
|
monkeypatch.setattr(server, "_load_stable_contamination_marker", lambda _remote: None)
|
|
monkeypatch.setattr(
|
|
server,
|
|
"_review_workflow_load_gate_reasons",
|
|
lambda: ["canonical review workflow proof missing"],
|
|
)
|
|
|
|
with pytest.raises(RuntimeError, match="workflow"):
|
|
server._run_anti_stomp_preflight(
|
|
"acquire_reviewer_pr_lease",
|
|
remote="prgs",
|
|
worktree_path="/repo/branches/review-pr-762",
|
|
org="Scaled-Tech-Consulting",
|
|
repo="Gitea-Tools",
|
|
)
|
|
|
|
|
|
def test_whoami_identity_mismatch_invalidates_preflight(monkeypatch):
|
|
monkeypatch.setenv("GITEA_TEST_PORCELAIN", "")
|
|
monkeypatch.setattr(server, "_process_start_porcelain", "")
|
|
monkeypatch.setattr(server, "_preflight_whoami_called", False)
|
|
monkeypatch.setattr(server, "_preflight_capability_called", True)
|
|
monkeypatch.setattr(server, "_auth", lambda _host: "redacted")
|
|
monkeypatch.setattr(
|
|
server,
|
|
"api_request",
|
|
lambda *_args, **_kwargs: {"login": "wrong-reviewer", "id": 7},
|
|
)
|
|
monkeypatch.setattr(
|
|
server,
|
|
"get_profile",
|
|
lambda: {
|
|
"profile_name": "prgs-reviewer",
|
|
"role": "reviewer",
|
|
"username": "sysadmin",
|
|
"allowed_operations": ["gitea.read", "gitea.pr.review"],
|
|
"forbidden_operations": [],
|
|
},
|
|
)
|
|
monkeypatch.setattr(server, "_seed_session_context", lambda **_kwargs: None)
|
|
monkeypatch.setattr(server.session_ctx, "mutation_context_audit_fields", lambda: {})
|
|
monkeypatch.setattr(server, "_reveal_endpoints", lambda: False)
|
|
|
|
result = server.gitea_whoami(remote="prgs")
|
|
|
|
assert result["identity_match"] is False
|
|
assert server._preflight_whoami_called is False
|
|
assert server._preflight_capability_called is False
|
|
|
|
|
|
def test_denied_reviewer_profile_does_not_leave_capability_proof(monkeypatch):
|
|
profile = {
|
|
"profile_name": "prgs-author",
|
|
"role": "author",
|
|
"username": "jcwalker3",
|
|
"allowed_operations": [
|
|
"gitea.read",
|
|
"gitea.pr.comment",
|
|
"gitea.pr.review",
|
|
],
|
|
"forbidden_operations": [],
|
|
}
|
|
monkeypatch.setenv("GITEA_TEST_PORCELAIN", "")
|
|
monkeypatch.setattr(server, "_process_start_porcelain", "")
|
|
monkeypatch.setattr(server, "get_profile", lambda: profile)
|
|
monkeypatch.setattr(
|
|
server.gitea_config,
|
|
"load_config",
|
|
lambda: {"profiles": {"prgs-author": profile}},
|
|
)
|
|
monkeypatch.setattr(server.gitea_config, "is_runtime_switching_enabled", lambda: False)
|
|
monkeypatch.setattr(server, "_authenticated_username", lambda _host: "jcwalker3")
|
|
monkeypatch.setattr(server, "_seed_session_context", lambda **_kwargs: None)
|
|
monkeypatch.setattr(
|
|
server.session_ctx,
|
|
"assess_session_context",
|
|
lambda **_kwargs: {"block": False, "reasons": []},
|
|
)
|
|
monkeypatch.setattr(
|
|
server.session_ctx,
|
|
"assess_identity_match",
|
|
lambda **_kwargs: {"block": False, "reasons": []},
|
|
)
|
|
monkeypatch.setattr(
|
|
server.session_ctx,
|
|
"profile_allowed_for_remote",
|
|
lambda *_args, **_kwargs: {"block": False, "reasons": []},
|
|
)
|
|
monkeypatch.setattr(server.session_ctx, "mutation_context_audit_fields", lambda: {})
|
|
monkeypatch.setattr(
|
|
server.role_session_router,
|
|
"assess_infra_stop",
|
|
lambda _root: {"infra_stop": False, "infra_stop_reasons": []},
|
|
)
|
|
monkeypatch.setattr(server, "_check_mcp_runtimes_diagnostics", lambda *_a: [])
|
|
monkeypatch.setattr(
|
|
server,
|
|
"_assess_stale_active_binding",
|
|
lambda **_kwargs: {"classification": "unbound"},
|
|
)
|
|
monkeypatch.setattr(server, "record_mutation_authority", lambda *_args: None)
|
|
monkeypatch.setattr(server, "init_review_decision_lock", lambda *_a, **_k: None)
|
|
monkeypatch.setattr(server.capability_stop_terminal, "is_active", lambda: False)
|
|
monkeypatch.setattr(
|
|
server.capability_stop_terminal,
|
|
"sync_from_capability_result",
|
|
lambda _result: False,
|
|
)
|
|
|
|
result = server.gitea_resolve_task_capability(task="review_pr", remote="prgs")
|
|
|
|
assert result["allowed_in_current_session"] is False
|
|
assert result["required_role_kind"] == "reviewer"
|
|
assert server._preflight_capability_called is False
|
|
|
|
|
|
def test_head_and_foreign_lease_protections_remain_enforced():
|
|
now = datetime.now(timezone.utc)
|
|
head = "a" * 40
|
|
moved_head = "b" * 40
|
|
body = reviewer_pr_lease.format_lease_body(
|
|
repo="Scaled-Tech-Consulting/Gitea-Tools",
|
|
pr_number=762,
|
|
issue_number=605,
|
|
reviewer_identity="other-reviewer",
|
|
profile="prgs-reviewer",
|
|
session_id="foreign-session",
|
|
worktree="/repo/branches/review-pr-762",
|
|
phase="claimed",
|
|
candidate_head=head,
|
|
target_branch="master",
|
|
target_branch_sha="c" * 40,
|
|
last_activity=now,
|
|
)
|
|
comments = [{"id": 10, "author": "other-reviewer", "body": body}]
|
|
|
|
acquire = reviewer_pr_lease.assess_acquire_lease(
|
|
comments,
|
|
pr_number=762,
|
|
reviewer_identity="sysadmin",
|
|
profile="prgs-reviewer",
|
|
session_id="my-session",
|
|
repo="Scaled-Tech-Consulting/Gitea-Tools",
|
|
issue_number=605,
|
|
worktree="/repo/branches/review-pr-762-mine",
|
|
candidate_head=head,
|
|
target_branch="master",
|
|
target_branch_sha="c" * 40,
|
|
now=now,
|
|
)
|
|
assert acquire["acquire_allowed"] is False
|
|
|
|
reviewer_pr_lease.clear_session_lease()
|
|
reviewer_pr_lease.record_session_lease(
|
|
{
|
|
"pr_number": 762,
|
|
"session_id": "foreign-session",
|
|
"candidate_head": head,
|
|
"comment_id": 10,
|
|
},
|
|
lease_provenance=merger_lease_adoption.build_lease_provenance(
|
|
source=merger_lease_adoption.SOURCE_ACQUIRE,
|
|
comment_id=10,
|
|
),
|
|
)
|
|
try:
|
|
gate = reviewer_pr_lease.assess_mutation_lease_gate(
|
|
pr_number=762,
|
|
comments=comments,
|
|
reviewer_identity="other-reviewer",
|
|
session_id="foreign-session",
|
|
mutation="approve",
|
|
live_head_sha=moved_head,
|
|
pinned_head_sha=head,
|
|
now=now,
|
|
)
|
|
finally:
|
|
reviewer_pr_lease.clear_session_lease()
|
|
|
|
assert gate["block"] is True
|
|
assert any("head changed" in reason for reason in gate["reasons"])
|
|
|
|
|
|
def test_reviewer_lease_role_gate_is_not_weakened():
|
|
result = anti_stomp_preflight.assess_anti_stomp_preflight(
|
|
task="acquire_reviewer_pr_lease",
|
|
profile_name="prgs-author",
|
|
profile_role="author",
|
|
required_role="reviewer",
|
|
required_permission="gitea.pr.comment",
|
|
allowed_operations=["gitea.read"],
|
|
check_repo=False,
|
|
check_root_checkout=False,
|
|
check_worktree=False,
|
|
check_stale_runtime=False,
|
|
)
|
|
|
|
assert result["block"] is True
|
|
assert result["blocker_kind"] == anti_stomp_preflight.BLOCKER_WRONG_ROLE
|