wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/main' into codex/aia-sre-017-callback-closure-20260717

Browse Source
This commit is contained in:
ogt
2026-07-17 11:50:54 +08:00
parent 086c9e337e c5c62673c3
commit 9daa36767d
11 changed files with 710 additions and 181 deletions
Download Patch File Download Diff File Expand all files Collapse all files

146
apps/api/tests/test_iwooos_wazuh_controlled_executor_runtime.py
View File

@@ -22,9 +22,9 @@ from src.services.awooop_ansible_audit_service import get_ansible_catalog_item
from src.services.awooop_ansible_check_mode_service import (
AnsibleCheckModeClaim,
AnsibleRunResult,
_build_wazuh_break_glass_capability_packet,
_wazuh_privileged_convergence_capability_is_missing,
backfill_missing_wazuh_break_glass_capability_packets_once,
_build_wazuh_controlled_capability_packet,
_wazuh_privileged_convergence_failure_class,
backfill_missing_wazuh_controlled_capability_packets_once,
finalize_check_mode_claim,
)
from src.services.awooop_ansible_post_verifier import postconditions_for_catalog
@@ -48,7 +48,7 @@ def _current_wazuh_source_recurrence(observed_at: str) -> dict[str, object]:
def test_wazuh_runtime_sql_reads_schema_safe_packet_fallback() -> None:
assert "ansible_break_glass_capability_work_item_queued" in _LIVE_RUNTIME_SQL
assert "ansible_controlled_capability_repair_queued" in _LIVE_RUNTIME_SQL
assert "remediation_executed" in _LIVE_RUNTIME_SQL
assert "semantic_operation_type" in _LIVE_RUNTIME_SQL
@@ -146,7 +146,7 @@ def test_wazuh_runtime_readback_closes_only_with_complete_same_run_receipts() ->
assert (
payload["schema_version"]
== "iwooos_wazuh_controlled_executor_runtime_readback_v1"
== "iwooos_wazuh_controlled_executor_runtime_readback_v2"
)
assert payload["status"] == "wazuh_manager_posture_same_run_runtime_closed"
assert payload["summary"]["runtime_execution_performed_count"] == 1
@@ -373,8 +373,7 @@ def test_wazuh_runtime_readback_projects_allowlisted_privilege_blocker() -> None
"wazuh_privileged_convergence_capability_missing"
)
assert payload["next_safe_action"] == (
"queue_critical_break_glass_privileged_convergence_capability_"
"then_bounded_retry"
"queue_high_risk_controlled_privilege_capability_repair_then_retry"
)
assert "wazuh_privileged_convergence_capability_missing" in (
payload["active_blockers"]
@@ -382,15 +381,61 @@ def test_wazuh_runtime_readback_projects_allowlisted_privilege_blocker() -> None
assert payload["boundaries"]["host_write_performed"] is False
assert payload["boundaries"]["secret_value_collection_allowed"] is False
assert payload["summary"][
"critical_break_glass_capability_packet_count"
"controlled_capability_repair_packet_count"
] == 0
assert payload["critical_break_glass_capability_packet"] is None
assert "critical_break_glass_capability_packet_missing" in (
assert payload["controlled_capability_repair_packet"] is None
assert "controlled_capability_repair_packet_missing" in (
payload["active_blockers"]
)
def test_wazuh_runtime_readback_projects_durable_break_glass_packet() -> None:
def test_wazuh_runtime_readback_keeps_only_secret_reference_as_critical() -> None:
run_id = "00000000-0000-0000-0000-000000000342"
recurrence = _current_wazuh_source_recurrence(
"2026-07-17T10:00:00+08:00"
)
row = {
"candidate_op_id": run_id,
"automation_run_id": run_id,
"trace_id": run_id,
"run_id": run_id,
"candidate_project_id": "awoooi",
"work_item_id": "P0-03-WAZUH-ALERT-INGRESS",
"proposal_source": "iwooos_wazuh_alert_ingress_scheduler",
"run_namespace": "awoooi:iwooos:wazuh-alert-ingress",
"source_receipt_ref": "wazuh-alert:2026071710",
"candidate_source_recurrence": recurrence,
"candidate_source_recurrence_verified": True,
"catalog_id": "ansible:wazuh-alertmanager-integration",
"check_op_id": "00000000-0000-0000-0000-000000000343",
"check_status": "failed",
"check_returncode": "2",
"check_timed_out": "false",
"check_automation_run_id": run_id,
"check_trace_id": run_id,
"check_run_id": run_id,
"check_work_item_id": "P0-03-WAZUH-ALERT-INGRESS",
"check_source_recurrence": recurrence,
"check_failure_marker": (
"wazuh_privileged_convergence_secret_reference_missing"
),
"stage_ids": [],
}
payload = build_iwooos_wazuh_controlled_executor_runtime_readback(
row,
executor_enabled=True,
)
assert payload["boundaries"]["critical_break_glass_required"] is True
assert payload["boundaries"]["secret_value_collection_allowed"] is False
assert payload["next_safe_action"] == (
"queue_high_risk_capability_repair_with_critical_secret_"
"reference_boundary"
)
def test_wazuh_runtime_readback_projects_controlled_capability_packet() -> None:
run_id = "00000000-0000-0000-0000-000000000314"
recurrence = _current_wazuh_source_recurrence(
"2026-07-15T05:59:58+08:00"
@@ -420,11 +465,11 @@ def test_wazuh_runtime_readback_projects_durable_break_glass_packet() -> None:
"check_failure_marker": (
"wazuh_privileged_convergence_capability_missing"
),
"break_glass_packet_receipt_id": (
"controlled_capability_packet_receipt_id": (
"00000000-0000-0000-0000-000000000315"
),
"break_glass_packet_status": "pending",
"capability_packet_id": "IWZ-BG-0011223344556677",
"controlled_capability_packet_status": "pending",
"capability_packet_id": "IWZ-CC-0011223344556677",
"capability_automation_run_id": run_id,
"capability_trace_id": run_id,
"capability_run_id": run_id,
@@ -436,10 +481,16 @@ def test_wazuh_runtime_readback_projects_durable_break_glass_packet() -> None:
),
"capability_source_recurrence": recurrence,
"capability_type": "bounded_privileged_convergence",
"capability_risk_level": "critical",
"capability_policy_route": "critical_break_glass_queue",
"capability_risk_level": "high",
"capability_policy_route": (
"high_risk_controlled_apply_capability_repair"
),
"capability_queue_status": "queued",
"capability_execution_allowed": False,
"capability_controlled_apply_allowed": True,
"capability_windows99_dispatch_required": True,
"capability_critical_secret_reference_required": False,
"capability_expires_at": "2030-07-17T02:30:00+00:00",
"capability_execution_allowed": True,
"capability_granted": False,
"capability_packet_host_write_performed": False,
"stage_ids": [],
@@ -451,25 +502,39 @@ def test_wazuh_runtime_readback_projects_durable_break_glass_packet() -> None:
)
assert payload["summary"][
"critical_break_glass_capability_packet_count"
"controlled_capability_repair_packet_count"
] == 1
assert payload["next_safe_action"] == (
"critical_break_glass_capability_packet_queued_waiting_"
"bounded_capability_verifier_then_retry"
"windows99_verify_controlled_privilege_capability_then_"
"requeue_same_run"
)
packet = payload["critical_break_glass_capability_packet"]
packet = payload["controlled_capability_repair_packet"]
assert packet["queue_status"] == "queued"
assert packet["execution_allowed"] is False
assert packet["execution_allowed"] is True
assert packet["controlled_apply_allowed"] is True
assert packet["windows99_dispatch_required"] is True
assert packet["capability_granted"] is False
assert packet["host_write_performed"] is False
assert packet["secret_value_exposed"] is False
assert "critical_break_glass_capability_packet_pending" in (
assert "controlled_capability_repair_packet_pending" in (
payload["active_blockers"]
)
assert payload["boundaries"][
"critical_break_glass_capability_packet_persisted"
"controlled_capability_repair_packet_persisted"
] is True
row["capability_expires_at"] = "2020-07-17T02:30:00+00:00"
expired = build_iwooos_wazuh_controlled_executor_runtime_readback(
row,
executor_enabled=True,
)
assert expired["summary"][
"controlled_capability_repair_packet_count"
] == 0
assert "controlled_capability_repair_packet_expired" in (
expired["active_blockers"]
)
def test_wazuh_runtime_readback_rejects_untrusted_failure_marker() -> None:
row = {
@@ -491,7 +556,7 @@ def test_wazuh_runtime_readback_rejects_untrusted_failure_marker() -> None:
assert payload["boundaries"]["host_write_performed"] is False
def test_wazuh_break_glass_packet_is_deterministic_and_public_safe() -> None:
def test_wazuh_controlled_capability_packet_is_deterministic_and_public_safe() -> None:
kwargs = {
"check_op_id": "00000000-0000-0000-0000-000000000316",
"source_candidate_op_id": "00000000-0000-0000-0000-000000000317",
@@ -512,12 +577,14 @@ def test_wazuh_break_glass_packet_is_deterministic_and_public_safe() -> None:
"unexpected_material": "must-not-be-projected",
"command_output": "must-not-be-projected",
},
"failure_class": "wazuh_privileged_convergence_capability_missing",
"observed_now": datetime(2026, 7, 17, 2, 0, tzinfo=UTC),
}
packet_input, packet_output, dry_run = (
_build_wazuh_break_glass_capability_packet(**kwargs)
_build_wazuh_controlled_capability_packet(**kwargs)
)
repeated_input, _, _ = _build_wazuh_break_glass_capability_packet(
repeated_input, _, _ = _build_wazuh_controlled_capability_packet(
**kwargs
)
serialized = json.dumps(
@@ -527,8 +594,14 @@ def test_wazuh_break_glass_packet_is_deterministic_and_public_safe() -> None:
assert packet_input["capability_packet_id"] == repeated_input[
"capability_packet_id"
]
assert packet_input["risk_level"] == "critical"
assert packet_input["execution_allowed"] is False
assert packet_input["risk_level"] == "high"
assert packet_input["execution_allowed"] is True
assert packet_input["controlled_apply_allowed"] is True
assert packet_input["windows99_dispatch_required"] is True
assert packet_input["critical_secret_reference_required"] is False
assert packet_input["gate_lifecycle"]["expires_at"] == (
"2026-07-17T02:30:00+00:00"
)
assert packet_input["host_write_performed"] is False
assert packet_input["project_id"] == "awoooi"
assert packet_input["source_recurrence"]["verified"] is True
@@ -601,25 +674,29 @@ async def test_failed_wazuh_check_atomically_queues_deduplicated_packet(
duration_ms=20,
)
assert _wazuh_privileged_convergence_capability_is_missing(claim, result)
assert _wazuh_privileged_convergence_failure_class(claim, result) == (
"wazuh_privileged_convergence_capability_missing"
)
await finalize_check_mode_claim(claim, result)
assert len(calls) == 2
insert_sql, insert_params = calls[1]
assert "ansible_break_glass_capability_work_item_queued" in insert_sql
assert "ansible_controlled_capability_repair_queued" in insert_sql
assert "remediation_executed" in insert_sql
assert "pg_get_constraintdef" in insert_sql
assert "WHERE NOT EXISTS" in insert_sql
packet_input = json.loads(str(insert_params["input"]))
assert packet_input["work_item_id"] == "P0-03-WAZUH-ALERT-INGRESS"
assert packet_input["semantic_operation_type"] == (
"ansible_break_glass_capability_work_item_queued"
"ansible_controlled_capability_repair_queued"
)
assert packet_input["risk_level"] == "high"
assert packet_input["execution_allowed"] is True
assert packet_input["secret_value_exposed"] is False
@pytest.mark.asyncio
async def test_wazuh_break_glass_packet_backfill_closes_existing_gap(
async def test_wazuh_controlled_capability_packet_backfill_closes_existing_gap(
monkeypatch: pytest.MonkeyPatch,
) -> None:
from src.services import awooop_ansible_check_mode_service as service
@@ -639,6 +716,7 @@ async def test_wazuh_break_glass_packet_backfill_closes_existing_gap(
"source_recurrence": _current_wazuh_source_recurrence(
"2026-07-15T05:59:58+08:00"
),
"failure_class": "wazuh_privileged_convergence_capability_missing",
}]
class _Mappings:
@@ -669,7 +747,7 @@ async def test_wazuh_break_glass_packet_backfill_closes_existing_gap(
monkeypatch.setattr(service, "get_db_context", fake_db_context)
result = await backfill_missing_wazuh_break_glass_capability_packets_once()
result = await backfill_missing_wazuh_controlled_capability_packets_once()
assert result == {"scanned": 1, "written": 1, "error": None}

141
apps/api/tests/test_wazuh_alertmanager_integration.py
View File

@@ -52,6 +52,7 @@ BROKER_DEPLOYMENT = (
ROOT / "k8s" / "awoooi-prod" / "08-deployment-ansible-executor-broker.yaml"
)
WORKER_DEPLOYMENT = ROOT / "k8s" / "awoooi-prod" / "08-deployment-worker.yaml"
CD_WORKFLOW = ROOT / ".gitea" / "workflows" / "cd.yaml"
CATALOG_ID = "ansible:wazuh-alertmanager-integration"
@@ -179,9 +180,19 @@ def test_wazuh_integration_catalog_and_rollback_contract_are_bounded() -> None:
assert self_test_task["ansible.builtin.command"]["argv"][0] == (
"{{ ansible_playbook_python }}"
)
secret_reference_assert = next(
task
for task in playbook[0]["tasks"]
if task.get("ansible.builtin.assert", {}).get("fail_msg")
== "wazuh_privileged_convergence_secret_reference_missing"
)
assert secret_reference_assert.get("no_log") is not True
assert "backup: true" in text
assert "remote_src: true" in text
assert "wazuh_privileged_convergence_capability_missing" in text
assert "wazuh_privileged_convergence_secret_reference_missing" in text
assert "ANSIBLE_BECOME_PASSWORD_FILE" in text
assert "get_checksum: false" in text
assert "/var/lib/awoooi-wazuh-alert-ingress/receipt.env" in text
assert "raw_payload_persisted=0" in text
assert "active_response_enabled=0" in text
@@ -255,6 +266,27 @@ def test_wazuh_become_password_projection_is_path_only_and_optional(
assert "ANSIBLE_BECOME_PASSWORD_FILE" not in unrelated_spec.env
def test_cd_projects_wazuh_privilege_reference_without_readback() -> None:
workflow = CD_WORKFLOW.read_text(encoding="utf-8")
assert (
"HOST112_ANSIBLE_BECOME_PASSWORD: "
"${{ secrets.HOST112_ANSIBLE_BECOME_PASSWORD }}"
) in workflow
assert (
'HOST112_ANSIBLE_BECOME_PASSWORD_B64="$(secret_b64_env '
'HOST112_ANSIBLE_BECOME_PASSWORD)"'
) in workflow
assert '"path":"/data/HOST112_ANSIBLE_BECOME_PASSWORD"' in workflow
assert "host112_become_secret_reference_injected=1" in workflow
assert "host112_become_secret_projection_ready=1" in workflow
assert (
"test -s /run/secrets/host112-become/password && "
"test -r /run/secrets/host112-become/password"
) in workflow
assert "kubectl get secret awoooi-secrets -o json" not in workflow
def test_wazuh_ingress_convergence_uses_only_the_mutating_catalog() -> None:
route = resolve_typed_alert_target(
alertname="WazuhAlertmanagerIntegrationConvergence",
@@ -511,6 +543,115 @@ async def test_wazuh_ingress_scheduler_records_one_high_risk_controlled_candidat
]
@pytest.mark.asyncio
async def test_wazuh_ingress_scheduler_does_not_repeat_failed_check_while_capability_repair_is_open(
monkeypatch: pytest.MonkeyPatch,
) -> None:
from src.jobs import awooop_ansible_candidate_backfill_job as job
run_id = "00000000-0000-0000-0000-000000000572"
class _Mappings:
def first(self):
return {
"op_id": run_id,
"automation_run_id": run_id,
"source_receipt_ref": "wazuh-alert:2026071500",
"latest_check_status": "failed",
"latest_apply_status": None,
"latest_learning_status": None,
"latest_controlled_capability_packet_status": "pending",
"latest_controlled_capability_queue_status": "queued",
"latest_controlled_capability_packet_expires_at": (
"2026-07-15T06:29:59+08:00"
),
"predecision_evidence_ready": True,
}
class _Result:
def mappings(self):
return _Mappings()
class _Db:
async def execute(self, statement, params):
query = str(statement)
assert ":capability_packet_operation_type" in query
assert params["capability_packet_operation_type"] == (
"ansible_controlled_capability_repair_queued"
)
return _Result()
@asynccontextmanager
async def fake_db_context(_project_id: str):
yield _Db()
recorder = AsyncMock(return_value=True)
collector = AsyncMock(return_value=MagicMock(snapshot_id="must-not-run"))
verifier = AsyncMock(return_value=True)
binder = AsyncMock(return_value=True)
monkeypatch.setattr(job, "get_db_context", fake_db_context)
monkeypatch.setattr(
job.settings,
"ENABLE_IWOOOS_WAZUH_MANAGER_POSTURE_EXECUTOR",
True,
)
monkeypatch.setattr(
job,
"now_taipei",
MagicMock(return_value=datetime.fromisoformat("2026-07-15T05:59:59+08:00")),
)
result = await job.enqueue_iwooos_wazuh_alertmanager_integration_candidate_once(
recorder=recorder,
evidence_collector=collector,
evidence_verifier=verifier,
incident_binder=binder,
source_recurrence=_current_wazuh_source_recurrence(
"2026-07-15T05:59:58+08:00"
),
)
assert result["status"] == (
"controlled_privilege_capability_repair_already_queued"
)
assert result["queued"] == 0
assert result["retry_of_failed_check_mode"] is True
assert result["active_blockers"] == [
"wazuh_controlled_privilege_capability_repair_pending"
]
recorder.assert_not_awaited()
collector.assert_not_awaited()
verifier.assert_not_awaited()
binder.assert_not_awaited()
def test_wazuh_controlled_capability_packet_cooldown_expires() -> None:
from src.jobs import awooop_ansible_candidate_backfill_job as job
observed_now = datetime.fromisoformat("2026-07-15T05:59:59+08:00")
row = {
"latest_controlled_capability_packet_status": "pending",
"latest_controlled_capability_queue_status": "queued",
"latest_controlled_capability_packet_expires_at": (
"2026-07-15T06:29:59+08:00"
),
}
assert job._controlled_capability_packet_is_active(
row,
observed_now=observed_now,
) is True
assert job._controlled_capability_packet_is_active(
{
**row,
"latest_controlled_capability_packet_expires_at": (
"2026-07-15T05:59:58+08:00"
),
},
observed_now=observed_now,
) is False
@pytest.mark.asyncio
async def test_wazuh_ingress_scheduler_fails_closed_without_current_recurrence(
monkeypatch: pytest.MonkeyPatch,