feat(deploy): extend canon for managed EDP and Engine grants

2026-07-17 18:09:39 +03:00
parent a0a4d36fa2
commit 2dd6e33a54
19 changed files with 5336 additions and 106 deletions
@@ -0,0 +1,88 @@
+#!/usr/bin/env python3
+import hashlib
+import json
+import os
+import subprocess
+import tarfile
+import tempfile
+import unittest
+from pathlib import Path
+
+
+SCRIPT_DIR = Path(__file__).resolve().parent
+BUILDER = SCRIPT_DIR / "build-external-data-plane-artifact.mjs"
+EXPECTED_ENTRIES = [
+    "platform/docker-compose.external-data-plane.yml",
+    "platform/services/external-data-plane",
+    "platform/packages/external-provider-contract/package.json",
+    "platform/packages/external-provider-contract/src/contract-version.mjs",
+    "platform/packages/external-provider-contract/src/data-plane.mjs",
+    "platform/packages/external-provider-contract/src/data-product.mjs",
+    "platform/packages/external-provider-contract/src/intake-batch.mjs",
+    "platform/packages/external-provider-contract/src/sensitive-field-policy.mjs",
+]
+
+
+class ExternalDataPlaneArtifactTest(unittest.TestCase):
+    def build(self, artifact_dir, patch_id):
+        environment = os.environ.copy()
+        environment["NODEDC_DEPLOY_ARTIFACT_DIR"] = str(artifact_dir)
+        result = subprocess.run(
+            ["node", str(BUILDER), patch_id],
+            check=True,
+            capture_output=True,
+            text=True,
+            env=environment,
+        )
+        return json.loads(result.stdout)
+
+    def test_artifact_is_runtime_only_public_trust_and_deterministic(self):
+        with tempfile.TemporaryDirectory(prefix="nodedc-edp-artifact-") as directory:
+            artifact_dir = Path(directory)
+            first = self.build(artifact_dir, "edp-managed-publish-unit-001")
+            artifact = Path(first["artifact"])
+            first_bytes = artifact.read_bytes()
+            second = self.build(artifact_dir, "edp-managed-publish-unit-001")
+            second_bytes = Path(second["artifact"]).read_bytes()
+
+            self.assertEqual(first["entries"], EXPECTED_ENTRIES)
+            self.assertEqual(first["sha256"], hashlib.sha256(first_bytes).hexdigest())
+            self.assertEqual(first["sha256"], second["sha256"])
+            self.assertEqual(first_bytes, second_bytes)
+
+            with tarfile.open(artifact, "r:gz") as archive:
+                members = archive.getmembers()
+                names = {member.name for member in members}
+                files = archive.extractfile("files.txt").read().decode("utf-8").splitlines()
+                manifest = archive.extractfile("manifest.env").read().decode("utf-8")
+                compose = archive.extractfile(
+                    "payload/platform/docker-compose.external-data-plane.yml"
+                ).read().decode("utf-8")
+                regular_payloads = [
+                    archive.extractfile(member).read()
+                    for member in members
+                    if member.isfile()
+                ]
+
+            self.assertEqual(files, EXPECTED_ENTRIES)
+            self.assertEqual(
+                manifest,
+                "id=edp-managed-publish-unit-001\ncomponent=platform\ntype=app-overlay\n",
+            )
+            self.assertFalse(any(
+                name.startswith("payload/platform/services/external-data-plane/test/")
+                or "/node_modules/" in name
+                or Path(name).name.startswith(".env")
+                or Path(name).name == "private-key.pem"
+                for name in names
+            ))
+            self.assertIn(
+                "source: /volume1/docker/nodedc-platform/trust/engine-managed-provisioner",
+                compose,
+            )
+            self.assertNotIn("private-key.pem", compose)
+            self.assertNotIn(b"-----BEGIN PRIVATE KEY-----", b"\n".join(regular_payloads))
+
+
+if __name__ == "__main__":
+    unittest.main(verbosity=2)