feat(api): validate harbor registry recovery receipts

apps/api/tests/test_harbor_registry_controlled_recovery_receipt.py

@@ -0,0 +1,128 @@
+from __future__ import annotations
+
+from fastapi import FastAPI
+from fastapi.testclient import TestClient
+
+from src.api.v1.agents import router
+from src.services.harbor_registry_controlled_recovery_receipt import (
+    validate_harbor_registry_controlled_recovery_receipt,
+)
+
+
+def test_harbor_recovery_receipt_accepts_verified_repair() -> None:
+    payload = validate_harbor_registry_controlled_recovery_receipt(
+        {
+            "ssh_local_repair_output": _ssh_local_apply_output(),
+            "watchdog_check_output": _watchdog_check_output(ready=False, status=502),
+            "watchdog_repair_output": _watchdog_check_output(ready=True, status=401),
+            "public_registry_v2_http_status": 401,
+            "internal_registry_v2_http_status": 401,
+        }
+    )
+
+    assert payload["schema_version"] == (
+        "harbor_registry_controlled_recovery_receipt_v1"
+    )
+    assert payload["status"] == "harbor_registry_recovery_receipt_verified"
+    assert payload["accepted"] is True
+    assert payload["active_blockers"] == []
+    assert payload["readback"]["ssh_local_repair"][
+        "control_channel_metadata_ready"
+    ] is True
+    assert payload["readback"]["watchdog_repair"]["harbor_ready"] is True
+    assert payload["readback"]["post_apply_verifier"]["registry_v2_ready"] is True
+    assert payload["input_redaction"]["raw_output_returned"] is False
+    assert payload["operation_boundaries"]["ssh_used"] is False
+    assert payload["operation_boundaries"]["docker_command_performed"] is False
+    assert payload["operation_boundaries"]["host_reboot_performed"] is False
+    assert payload["operation_boundaries"]["workflow_trigger_performed"] is False
+    assert payload["learning_writeback_contracts"][0]["raw_log_allowed"] is False
+
+
+def test_harbor_recovery_receipt_routes_unhealthy_check_to_repair_once() -> None:
+    payload = validate_harbor_registry_controlled_recovery_receipt(
+        {
+            "watchdog_check_output": _watchdog_check_output(
+                ready=False,
+                status=502,
+            ),
+            "public_registry_v2_http_status": 502,
+            "internal_registry_v2_http_status": 502,
+        }
+    )
+
+    assert payload["status"] == (
+        "harbor_watchdog_check_unhealthy_waiting_repair_once_receipt"
+    )
+    assert "harbor_watchdog_repair_once_receipt_missing" in payload[
+        "active_blockers"
+    ]
+    assert payload["safe_next_step"] == (
+        "run_harbor_watchdog_repair_once_then_submit_receipt_with_verifier"
+    )
+    assert payload["controlled_apply_policy"]["manual_end_state"] is False
+
+
+def test_harbor_recovery_receipt_endpoint_redacts_raw_output() -> None:
+    app = FastAPI()
+    app.include_router(router, prefix="/api/v1")
+    client = TestClient(app)
+
+    response = client.post(
+        "/api/v1/agents/harbor-registry-controlled-recovery-receipt",
+        json={
+            "watchdog_check_output": _watchdog_check_output(
+                ready=True,
+                status=401,
+            ),
+            "public_registry_v2_http_status": 401,
+            "internal_registry_v2_http_status": 401,
+        },
+    )
+
+    assert response.status_code == 200
+    data = response.json()
+    assert data["status"] == "harbor_registry_recovery_receipt_verified"
+    assert data["accepted"] is True
+    assert "watchdog_check_output" not in str(data["readback"])
+    assert data["input_redaction"]["watchdog_check_output"]["line_count"] > 0
+
+
+def _ssh_local_apply_output() -> str:
+    return """
+AWOOOI_110_SSH_PUBLICKEY_AUTH_LOCAL_REPAIR mode=apply target_user=wooo
+SSH_SERVICE_ACTIVE=active
+SSHD_CONFIG_SYNTAX=ok
+USER_STATUS user=wooo exists=1 home=/home/wooo
+PATH_STATUS path=/home/wooo mode=755 owner=wooo group=wooo type=directory
+PATH_STATUS path=/home/wooo/.ssh mode=700 owner=wooo group=wooo type=directory
+AUTHORIZED_KEYS_STATUS path=/home/wooo/.ssh/authorized_keys exists=1 bytes=380 lines=1
+APPLIED permissions target_user=wooo home=/home/wooo
+SSHD_CONFIG_SYNTAX_AFTER_APPLY=ok
+SSH_RELOAD=skipped
+"""
+
+
+def _watchdog_check_output(*, ready: bool, status: int) -> str:
+    ready_text = "true" if ready else "false"
+    return f"""
+AWOOOI_HARBOR_WATCHDOG_CHECK
+mode=check
+target=127.0.0.1:5000/v2/
+expected_host_ip=192.168.0.110
+expected_host_ip_present=true
+harbor_dir=/home/wooo/harbor/harbor
+harbor_dir_exists=true
+harbor_compose_exists=true
+docker_cli_available=true
+docker_service_state=active
+lockfile=/var/lock/harbor-repair.lock
+lockfile_exists=false
+harbor_local_v2_http_status={status}
+harbor_ready={ready_text}
+check_only=true
+docker_compose_action_performed=false
+container_remove_performed=false
+service_restart_performed=false
+host_reboot_performed=false
+"""