diff --git a/scripts/custody-describe.py b/scripts/custody-describe.py index 9274771..ae59e80 100755 --- a/scripts/custody-describe.py +++ b/scripts/custody-describe.py @@ -127,22 +127,45 @@ REAL_HOME = pwd.getpwuid(os.getuid()).pw_dir RECEIPT = os.path.join(REAL_HOME, ".local/state/railiance/receipts/custody-describe.json") +def _bao(args: list[str], env: dict) -> tuple[int, str, str]: + """Run bao; return (rc, stdout, http_code). stderr is reduced to its HTTP code.""" + r = subprocess.run(["bao", *args], capture_output=True, text=True, env=env) + m = re.search(r"Code: (\d{3})", r.stderr or "") + return r.returncode, r.stdout, (m.group(1) if m else ("" if r.returncode == 0 else "no-code")) + + +def _write(mount: str, rest: str, fields: dict, env: dict) -> str: + flags = [f"-custom-metadata={k}={_clip(v)}" for k, v in fields.items()] + rc, _, code = _bao(["kv", "metadata", "patch", f"-mount={mount}", *flags, rest], env) + if rc == 0: + return "patched" + if code not in ("403", "405"): + return f"failed patch http={code}" + # No patch capability: read metadata (never data), merge, write it back whole, + # so custom_metadata set by earlier CCRs survives. + import json + rc, out, code = _bao(["kv", "metadata", "get", "-format=json", f"-mount={mount}", rest], env) + if rc != 0: + return f"failed metadata-get http={code}" + current = ((json.loads(out or "{}").get("data") or {}).get("custom_metadata")) or {} + merged = {**current, **{k: _clip(v) for k, v in fields.items()}} + flags = [f"-custom-metadata={k}={v}" for k, v in merged.items()] + rc, _, code = _bao(["kv", "metadata", "put", f"-mount={mount}", *flags, rest], env) + return "merged" if rc == 0 else f"failed put http={code}" + + def apply(doc: dict, receipt: str = RECEIPT) -> int: """Silent: the warden wrapper refuses any output, so results go to a 0600 receipt.""" import json + env = dict(os.environ) + env.setdefault("BAO_ADDR", "http://127.0.0.1:18200") results = {} for path, e in doc.items(): if e.get("review") != "accepted" or any(not e.get(k) for k in REQUIRED): results[path] = "skipped" continue mount, rest = path.split("/", 1) - args = ["bao", "kv", "metadata", "patch", f"-mount={mount}"] - args += [f"-custom-metadata={k}={_clip(e[k])}" for k in REQUIRED] - args.append(rest) - env = dict(os.environ) - env.setdefault("BAO_ADDR", "http://127.0.0.1:18200") - rc = subprocess.run(args, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, env=env).returncode - results[path] = "patched" if rc == 0 else f"failed rc={rc}" + results[path] = _write(mount, rest, {k: e[k] for k in REQUIRED}, env) os.makedirs(os.path.dirname(receipt), mode=0o700, exist_ok=True) old_umask = os.umask(0o077) try: diff --git a/tests/test_custody_describe.py b/tests/test_custody_describe.py index d7a9cc9..d357afb 100644 --- a/tests/test_custody_describe.py +++ b/tests/test_custody_describe.py @@ -1,4 +1,8 @@ import importlib.util +import json +import os +import pwd +import stat from pathlib import Path from unittest.mock import patch, MagicMock @@ -9,32 +13,47 @@ _spec.loader.exec_module(cd) FULL = dict(description="d", owner="o", used_by="u", rotation="r", on_loss="l") -def test_apply_patches_only_accepted_complete_entries_and_only_metadata(tmp_path, capsys): +def _r(rc=0, out="", err=""): + return MagicMock(returncode=rc, stdout=out, stderr=err) + + +def test_apply_patches_only_accepted_complete_entries_silently(tmp_path, capsys): doc = { "platform/workloads/a/b": {"review": "accepted", **FULL}, "platform/workloads/c/d": {"review": "draft", **FULL}, "operators/e": {"review": "accepted", **dict(FULL, used_by="")}, } - with patch.object(cd.subprocess, "run", return_value=MagicMock(returncode=0)) as run: - assert cd.apply(doc, receipt=str(tmp_path / 'r.json')) == 0 - assert capsys.readouterr() == ('', '') - import json, os, stat - r = tmp_path / 'r.json' - assert json.load(open(r)) == {'platform/workloads/a/b': 'patched', 'platform/workloads/c/d': 'skipped', 'operators/e': 'skipped'} - assert stat.S_IMODE(os.stat(r).st_mode) == 0o600 + with patch.object(cd.subprocess, "run", return_value=_r()) as run: + assert cd.apply(doc, receipt=str(tmp_path / "r.json")) == 0 + assert capsys.readouterr() == ("", "") assert run.call_count == 1 args = run.call_args.args[0] - assert args[:5] == ["bao", "kv", "metadata", "patch", "-mount=platform"] - assert args[-1] == "workloads/a/b" - assert not any(a in ("get", "put", "patch-data") or "/data/" in a for a in args) - assert run.call_args.kwargs["stdout"] is cd.subprocess.DEVNULL and run.call_args.kwargs["stderr"] is cd.subprocess.DEVNULL + assert args[:5] == ["bao", "kv", "metadata", "patch", "-mount=platform"] and args[-1] == "workloads/a/b" + assert not any(a in ("get", "put") or "/data/" in a for a in args) + r = tmp_path / "r.json" + assert json.load(open(r)) == {"platform/workloads/a/b": "patched", "platform/workloads/c/d": "skipped", "operators/e": "skipped"} + assert stat.S_IMODE(os.stat(r).st_mode) == 0o600 -def test_apply_reports_failure_without_output(tmp_path, capsys): +def test_patch_refused_falls_back_to_merge_keeping_existing_metadata(tmp_path): + existing = json.dumps({"data": {"custom_metadata": {"ccr": "CCR-2026-0033", "owner": "old"}}}) + calls = [_r(2, err="Error ... Code: 403. Errors: permission denied"), _r(0, out=existing), _r(0)] doc = {"platform/workloads/a/b": {"review": "accepted", **FULL}} - with patch.object(cd.subprocess, "run", return_value=MagicMock(returncode=2)): - assert cd.apply(doc, receipt=str(tmp_path / 'r.json')) == 1 - assert capsys.readouterr() == ('', '') + with patch.object(cd.subprocess, "run", side_effect=calls) as run: + assert cd.apply(doc, receipt=str(tmp_path / "r.json")) == 0 + get_args, put_args = run.call_args_list[1].args[0], run.call_args_list[2].args[0] + assert get_args[1:4] == ["kv", "metadata", "get"] + assert put_args[1:4] == ["kv", "metadata", "put"] + assert "-custom-metadata=ccr=CCR-2026-0033" in put_args and "-custom-metadata=owner=o" in put_args + assert json.load(open(tmp_path / "r.json")) == {"platform/workloads/a/b": "merged"} + + +def test_failure_records_only_http_code(tmp_path, capsys): + doc = {"platform/workloads/a/b": {"review": "accepted", **FULL}} + with patch.object(cd.subprocess, "run", return_value=_r(2, err="Code: 500. secret-ish detail")): + assert cd.apply(doc, receipt=str(tmp_path / "r.json")) == 1 + assert capsys.readouterr() == ("", "") + assert json.load(open(tmp_path / "r.json")) == {"platform/workloads/a/b": "failed patch http=500"} def test_check_refuses_drafts_missing_and_overlong_fields(): @@ -52,10 +71,9 @@ def test_clip_respects_openbao_value_limit(): def test_receipt_ignores_temporary_home_and_bao_addr_defaults(tmp_path, monkeypatch): - import pwd, os assert cd.RECEIPT.startswith(pwd.getpwuid(os.getuid()).pw_dir) monkeypatch.delenv("BAO_ADDR", raising=False) doc = {"platform/workloads/a/b": {"review": "accepted", **FULL}} - with patch.object(cd.subprocess, "run", return_value=MagicMock(returncode=0)) as run: + with patch.object(cd.subprocess, "run", return_value=_r()) as run: cd.apply(doc, receipt=str(tmp_path / "r.json")) assert run.call_args.kwargs["env"]["BAO_ADDR"] == "http://127.0.0.1:18200"