2480513061
Some checks failed
CD Pipeline / workflow-shape (push) Successful in 1s
CD Pipeline / cancel-stale-cd (push) Has been skipped
CD Pipeline / build-and-deploy (push) Has been cancelled
CD Pipeline / post-deploy-checks (push) Has been cancelled
CD Pipeline / tests (push) Has been cancelled
117 lines
4.6 KiB
Python
117 lines
4.6 KiB
Python
from __future__ import annotations
|
|
|
|
# ruff: noqa: E402
|
|
import json
|
|
import os
|
|
from pathlib import Path
|
|
|
|
from fastapi import FastAPI
|
|
from fastapi.testclient import TestClient
|
|
|
|
os.environ.setdefault("DATABASE_URL", "postgresql+asyncpg://test:test@localhost/test")
|
|
|
|
from src.api.v1.mcp_control_plane import router
|
|
from src.services.mcp_control_plane_service import (
|
|
build_mcp_control_plane_overview,
|
|
load_mcp_control_plane_catalog,
|
|
)
|
|
from src.services.product_governance_matrix_readback import (
|
|
load_latest_product_governance_matrix_readback,
|
|
)
|
|
|
|
_REPO_ROOT = Path(__file__).resolve().parents[3]
|
|
_OPERATIONS_DIR = _REPO_ROOT / "docs" / "operations"
|
|
|
|
|
|
def test_catalog_contains_exact_12_products_and_explicit_missing_rows() -> None:
|
|
catalog = load_mcp_control_plane_catalog(_OPERATIONS_DIR)
|
|
|
|
product_ids = {row["product_id"] for row in catalog["products"]}
|
|
assert len(product_ids) == 12
|
|
assert {"ewoooc", "momo-pro-system"}.issubset(product_ids)
|
|
assert catalog["architecture"]["separate_gateway_allowed"] is False
|
|
assert catalog["architecture"]["separate_rag_database_allowed"] is False
|
|
assert catalog["source_policy"]["github_allowed"] is False
|
|
assert catalog["security_policy"]["external_rag_auto_write_allowed"] is False
|
|
|
|
capabilities = {
|
|
row["capability_id"]: row for row in catalog["capabilities"]
|
|
}
|
|
assert capabilities["rejected.github"]["decision"] == "rejected"
|
|
assert capabilities["quarantine.agent-bounty-mcp"]["decision"] == "quarantine"
|
|
assert capabilities["external.smithery-site-audit-shadow"]["decision"] == "evaluation_shadow_candidate"
|
|
assert capabilities["external.smithery-site-audit-shadow"]["deployment_allowed"] is False
|
|
assert capabilities["rejected.smithery-technical-analysis"]["decision"] == "rejected"
|
|
assert "tool_output_contains_cross_tool_prompt_injection" in capabilities[
|
|
"quarantine.agent-bounty-mcp"
|
|
]["blockers"]
|
|
assert not any(
|
|
row["deployment_allowed"]
|
|
for row in catalog["capabilities"]
|
|
if row["source_type"] == "external"
|
|
)
|
|
|
|
|
|
def test_overview_joins_committed_product_matrix_without_runtime_claims() -> None:
|
|
catalog = load_mcp_control_plane_catalog(_OPERATIONS_DIR)
|
|
matrix = load_latest_product_governance_matrix_readback(_OPERATIONS_DIR)
|
|
|
|
payload = build_mcp_control_plane_overview(
|
|
catalog=catalog,
|
|
product_matrix=matrix,
|
|
generated_at="2026-07-15T19:00:00+08:00",
|
|
)
|
|
|
|
assert payload["schema_version"] == "mcp_control_plane_overview_v1"
|
|
assert payload["status"] == "partial_degraded_with_safe_next_action"
|
|
assert payload["summary"]["product_count"] == 12
|
|
assert payload["summary"]["mcp_source_detected_product_count"] == 7
|
|
assert payload["summary"]["external_promotion_ready_count"] == 0
|
|
assert payload["summary"]["github_in_scope_count"] == 0
|
|
assert payload["runtime"]["status"] == "not_requested"
|
|
|
|
products = {row["product_id"]: row for row in payload["products"]}
|
|
assert products["ewoooc"]["canonical_repo"] == "wooo/ewoooc"
|
|
assert products["momo-pro-system"]["canonical_repo"] == "wooo/momo-pro-system"
|
|
assert products["agent-bounty-protocol"]["inventory_state"] == "source_detected_quarantined"
|
|
|
|
|
|
def test_catalog_rejects_external_deployment_without_immutable_receipts(
|
|
tmp_path: Path,
|
|
) -> None:
|
|
catalog = load_mcp_control_plane_catalog(_OPERATIONS_DIR)
|
|
external = next(
|
|
row for row in catalog["capabilities"] if row["source_type"] == "external"
|
|
)
|
|
external["deployment_allowed"] = True
|
|
(tmp_path / "mcp-control-plane-catalog.snapshot.json").write_text(
|
|
json.dumps(catalog),
|
|
encoding="utf-8",
|
|
)
|
|
|
|
try:
|
|
load_mcp_control_plane_catalog(tmp_path)
|
|
except ValueError as exc:
|
|
assert "cannot deploy without immutable receipts" in str(exc)
|
|
else:
|
|
raise AssertionError("unsafe external deployment must be rejected")
|
|
|
|
|
|
def test_overview_endpoint_returns_real_committed_catalog_without_runtime() -> None:
|
|
app = FastAPI()
|
|
app.include_router(router, prefix="/api/v1")
|
|
client = TestClient(app)
|
|
|
|
response = client.get(
|
|
"/api/v1/mcp-control-plane/overview?include_runtime=false"
|
|
)
|
|
|
|
assert response.status_code == 200
|
|
data = response.json()
|
|
assert data["summary"]["product_count"] == 12
|
|
assert data["runtime"]["status"] == "not_requested"
|
|
assert data["operation_boundaries"]["github_allowed"] is False
|
|
assert data["operation_boundaries"]["public_response_redacted_aggregate_only"] is True
|
|
assert data["operation_boundaries"]["mutation_endpoint_exposed"] is False
|
|
assert data["operation_boundaries"]["operator_auth_required_for_future_mutation"] is True
|