feat(ops): automate metrics edge controlled apply

tests/test_metrics_edge_controlled_apply_service.py

@@ -0,0 +1,103 @@
+from pathlib import Path
+
+import pytest
+
+
+NGINX_CONFIG = """server {
+    listen 80;
+    server_name mo.wooo.work;
+    return 301 https://$server_name$request_uri;
+}
+
+server {
+    listen 443 ssl http2;
+    server_name mo.wooo.work;
+
+    location / {
+        proxy_pass http://127.0.0.1:5003;
+    }
+}
+"""
+
+NGINX_FRAGMENT = """location = /metrics {
+    allow 127.0.0.1;
+    allow 172.16.0.0/12;
+    deny all;
+    proxy_pass http://127.0.0.1:5003/metrics;
+}
+"""
+
+PROMETHEUS_CONFIG = """global:
+  scrape_interval: 60s
+
+scrape_configs:
+  - job_name: existing
+    static_configs:
+      - targets: ['127.0.0.1:9090']
+"""
+
+PROMETHEUS_SNIPPET = """  - job_name: 'ewoooc-app'
+    metrics_path: /metrics
+    static_configs:
+      - targets: ['mo.wooo.work']
+"""
+
+
+def test_render_nginx_config_targets_only_tls_server_and_is_idempotent():
+    from services.metrics_edge_controlled_apply_service import render_nginx_config
+
+    rendered = render_nginx_config(NGINX_CONFIG, NGINX_FRAGMENT)
+    second = render_nginx_config(rendered, NGINX_FRAGMENT)
+
+    assert rendered == second
+    assert rendered.count("location = /metrics") == 1
+    assert rendered.index("listen 443") < rendered.index("location = /metrics")
+    assert rendered.index("location = /metrics") < rendered.index("location / {")
+
+
+def test_render_prometheus_config_is_idempotent():
+    from services.metrics_edge_controlled_apply_service import render_prometheus_config
+
+    rendered = render_prometheus_config(PROMETHEUS_CONFIG, PROMETHEUS_SNIPPET)
+    second = render_prometheus_config(rendered, PROMETHEUS_SNIPPET)
+
+    assert rendered == second
+    assert rendered.count("job_name: 'ewoooc-app'") == 1
+
+
+def test_build_plan_is_no_write_and_commit_safe(tmp_path: Path):
+    from services.metrics_edge_controlled_apply_service import build_metrics_edge_plan
+
+    paths = {
+        "nginx_config": tmp_path / "nginx.conf",
+        "prometheus_config": tmp_path / "prometheus.yml",
+        "nginx_fragment": tmp_path / "location.conf",
+        "prometheus_snippet": tmp_path / "scrape.yml",
+    }
+    paths["nginx_config"].write_text(NGINX_CONFIG, encoding="utf-8")
+    paths["prometheus_config"].write_text(PROMETHEUS_CONFIG, encoding="utf-8")
+    paths["nginx_fragment"].write_text(NGINX_FRAGMENT, encoding="utf-8")
+    paths["prometheus_snippet"].write_text(PROMETHEUS_SNIPPET, encoding="utf-8")
+
+    plan = build_metrics_edge_plan(
+        **paths,
+        run_id="sec-p0-001-test",
+        work_item_id="SEC-P0-001",
+    )
+
+    assert plan["mode"] == "check"
+    assert plan["nginx"]["changed"] is True
+    assert plan["prometheus"]["changed"] is True
+    assert paths["nginx_config"].read_text(encoding="utf-8") == NGINX_CONFIG
+
+
+def test_render_rejects_incomplete_templates():
+    from services.metrics_edge_controlled_apply_service import (
+        render_nginx_config,
+        render_prometheus_config,
+    )
+
+    with pytest.raises(ValueError, match="incomplete"):
+        render_nginx_config(NGINX_CONFIG, "location = /metrics {}")
+    with pytest.raises(ValueError, match="incomplete"):
+        render_prometheus_config(PROMETHEUS_CONFIG, "job_name: other")