awoooi/apps/api/tests/test_cloud_transport_receipt.py

from __future__ import annotations

import json
from datetime import UTC, datetime, timedelta
from typing import Any

import pytest

from src.services.cloud_transport_receipt import (
    CLOUD_TRANSPORT_RECEIPT_PREFIX,
    issue_cloud_transport_receipt,
    verify_cloud_transport_receipt,
)


class _Redis:
    def __init__(self) -> None:
        self.values: dict[str, str] = {}
        self.set_calls: list[tuple[str, int | None]] = []

    async def set(self, key: str, value: str, ex: int | None = None) -> bool:
        self.values[key] = value
        self.set_calls.append((key, ex))
        return True

    async def get(self, key: str) -> str | None:
        return self.values.get(key)


async def _reachable_probe(provider: str, endpoint_url: str) -> bool:
    assert provider in {"ollama_gcp_a", "ollama_gcp_b"}
    assert endpoint_url.startswith("http://")
    return True


def _context(receipt: dict[str, Any]) -> dict[str, Any]:
    return {
        "data_classification": "sanitized",
        "trace_id": receipt["trace_id"],
        "run_id": receipt["run_id"],
        "work_item_id": receipt["work_item_id"],
        "cloud_transport_receipts": [receipt],
    }


@pytest.mark.asyncio
async def test_issue_and_verify_receipt_uses_network_probe_and_durable_readback() -> None:
    store = _Redis()
    now = datetime(2026, 7, 16, 5, 0, tzinfo=UTC)
    endpoint = "http://gcp-a.internal.invalid:11434"

    receipt = await issue_cloud_transport_receipt(
        trace_id="trace-1",
        run_id="run-1",
        work_item_id="AIA-SRE-013",
        provider="ollama_gcp_a",
        endpoint_url=endpoint,
        redis_client=store,
        network_probe=_reachable_probe,
        now=now,
    )

    assert receipt["transport_security_status"] == "degraded_public_http"
    assert receipt["transport_boundary"] == "public_http_sanitized_candidate_only"
    assert receipt["durable_write_ack"] is True
    assert receipt["verifier_status"] == "verified"
    assert receipt["endpoint_value_persisted"] is False
    assert endpoint not in json.dumps(receipt)
    assert store.set_calls == [
        (f"{CLOUD_TRANSPORT_RECEIPT_PREFIX}{receipt['receipt_id']}", 90)
    ]
    assert (
        await verify_cloud_transport_receipt(
            context=_context(receipt),
            provider="ollama_gcp_a",
            endpoint_url=endpoint,
            redis_client=store,
            now=now + timedelta(seconds=5),
        )
        is None
    )


@pytest.mark.asyncio
async def test_caller_only_self_signed_receipt_is_not_executable() -> None:
    store = _Redis()
    now = datetime(2026, 7, 16, 5, 0, tzinfo=UTC)
    receipt = await issue_cloud_transport_receipt(
        trace_id="trace-1",
        run_id="run-1",
        work_item_id="AIA-SRE-013",
        provider="ollama_gcp_a",
        endpoint_url="http://gcp-a.invalid:11434",
        redis_client=store,
        network_probe=_reachable_probe,
        now=now,
    )
    store.values.clear()

    reason = await verify_cloud_transport_receipt(
        context=_context(receipt),
        provider="ollama_gcp_a",
        endpoint_url="http://gcp-a.invalid:11434",
        redis_client=store,
        now=now + timedelta(seconds=5),
    )

    assert reason == "gcp_cloud_transport_receipt_not_durable"


@pytest.mark.asyncio
async def test_receipt_fails_closed_on_same_run_endpoint_or_ttl_mismatch() -> None:
    store = _Redis()
    now = datetime(2026, 7, 16, 5, 0, tzinfo=UTC)
    receipt = await issue_cloud_transport_receipt(
        trace_id="trace-1",
        run_id="run-1",
        work_item_id="AIA-SRE-013",
        provider="ollama_gcp_b",
        endpoint_url="http://gcp-b.invalid:11434",
        redis_client=store,
        network_probe=_reachable_probe,
        now=now,
    )

    wrong_run = _context(receipt)
    wrong_run["run_id"] = "run-2"
    assert (
        await verify_cloud_transport_receipt(
            context=wrong_run,
            provider="ollama_gcp_b",
            endpoint_url="http://gcp-b.invalid:11434",
            redis_client=store,
            now=now + timedelta(seconds=5),
        )
        == "gcp_cloud_transport_receipt_binding_invalid"
    )
    assert (
        await verify_cloud_transport_receipt(
            context=_context(receipt),
            provider="ollama_gcp_b",
            endpoint_url="http://different.invalid:11434",
            redis_client=store,
            now=now + timedelta(seconds=5),
        )
        == "gcp_cloud_transport_receipt_binding_invalid"
    )
    assert (
        await verify_cloud_transport_receipt(
            context=_context(receipt),
            provider="ollama_gcp_b",
            endpoint_url="http://gcp-b.invalid:11434",
            redis_client=store,
            now=now + timedelta(seconds=91),
        )
        == "gcp_cloud_transport_receipt_expired"
    )


@pytest.mark.asyncio
async def test_failed_network_preflight_writes_no_false_green_receipt() -> None:
    store = _Redis()

    async def _unreachable(_provider: str, _endpoint: str) -> bool:
        return False

    with pytest.raises(RuntimeError, match="cloud_transport_endpoint_preflight_failed"):
        await issue_cloud_transport_receipt(
            trace_id="trace-1",
            run_id="run-1",
            work_item_id="AIA-SRE-013",
            provider="ollama_gcp_a",
            endpoint_url="http://gcp-a.invalid:11434",
            redis_client=store,
            network_probe=_unreachable,
        )

    assert store.values == {}
    assert store.set_calls == []