638 lines
29 KiB
Python
638 lines
29 KiB
Python
#!/usr/bin/env python3
|
|
import importlib.machinery
|
|
import importlib.util
|
|
import hashlib
|
|
import inspect
|
|
import json
|
|
import os
|
|
import subprocess
|
|
import tarfile
|
|
import tempfile
|
|
import unittest
|
|
from pathlib import Path
|
|
from unittest import mock
|
|
|
|
|
|
SCRIPT_DIR = Path(__file__).resolve().parent
|
|
PLATFORM_ROOT = SCRIPT_DIR.parent.parent
|
|
ENGINE_ROOT = PLATFORM_ROOT.parent / "NODEDC_ENGINE_INFRA"
|
|
RUNNER_PATH = Path(
|
|
os.environ.get("NODEDC_DEPLOY_RUNNER_UNDER_TEST", SCRIPT_DIR / "nodedc-deploy")
|
|
).resolve()
|
|
BUILDER_PATH = SCRIPT_DIR / "build-engine-n8n-private-extension-artifact.mjs"
|
|
STAGE_ARTIFACT = (
|
|
PLATFORM_ROOT
|
|
/ "infra/deploy-artifacts"
|
|
/ "nodedc-n8n-private-extension-n8n-nodes-ndc-replace-replay-v1-20260721-009.tgz"
|
|
)
|
|
PREDECESSOR_ARTIFACT = (
|
|
PLATFORM_ROOT
|
|
/ "infra/deploy-artifacts"
|
|
/ "nodedc-engine-n8n-private-extension-20260721-005.tgz"
|
|
)
|
|
TRANSITION_ID = "20260721-010"
|
|
SEALED_RELEASE_ID = "0.1.6-25cc2d7a52a0d0ee"
|
|
SEALED_PACKAGE_SHA256 = "25cc2d7a52a0d0ee288b7a4b3de9f436489c010f234498a94bcccd114d7355af"
|
|
PREDECESSOR_RELEASE_ID = "0.1.5-3c8ae53f010d7c88"
|
|
BUILDER_ENGINE_PATHS = (
|
|
"nodedc-source/server/assets/n8n/schema/v2.3.2/nodes.catalog.json",
|
|
"nodedc-source/server/assets/n8n/schema/v2.3.2/credentials.catalog.json",
|
|
"nodedc-source/server/assets/n8n/schema/v2.3.2/meta.json",
|
|
"nodedc-source/server/assets/n8n/icons/ndc.svg",
|
|
"nodedc-source/server/assets/n8n/icons/ndc.dark.svg",
|
|
"nodedc-source/services/n8n/private-extensions/ndc-activation.json",
|
|
"nodedc-source/services/n8n/private-extensions/docker-compose.ndc-private-extension.yml",
|
|
)
|
|
EXPECTED_NODES = [
|
|
"n8n-nodes-ndc.ndcDataProductPublish",
|
|
"n8n-nodes-ndc.ndcDataProductRead",
|
|
"n8n-nodes-ndc.ndcFoundryBinding",
|
|
]
|
|
EXPECTED_CREDENTIALS = [
|
|
"ndcDataProductWriterApi",
|
|
"ndcDataProductReaderApi",
|
|
"ndcFoundryBindingApi",
|
|
"ndcProviderRotatingAccessApi",
|
|
]
|
|
PREDECESSOR_CREDENTIALS = EXPECTED_CREDENTIALS
|
|
PRIVATE_EXTENSION_CANON_FUNCTION_SHA256 = {
|
|
"expected_engine_n8n_compose_override": "8ee93f3e7c407f5557c711119236449a440d73a7fcac1bbfa50a09e6a13c1cff",
|
|
"engine_n8n_package_loader_probe_script": "2b3b3c96fad6e5e48ebea74426b21bc7eea6b6fe0e786b537da3366d18aedd9b",
|
|
"engine_n8n_private_loader_catalog": "a2ae389b4ef215900cf967b863d01056bd2a8eec55554566d0f6005e4e0bcbac",
|
|
"validate_engine_n8n_base_compose_source": "adacc5b20e52684cbc427362ddba5a6d2e13ef2091a89859e2b8f7bbf2e20458",
|
|
"preflight_engine_n8n_transition": "25bf33b3be0916a9dd82f064a710060eaf6bd7d87b3614ee0065af07ddbb446e",
|
|
"accept_engine_n8n_runtime": "bc49275adb2d5ab4fd98abd07b9059a197d023e03b40145b6fc910b70b2f738b",
|
|
}
|
|
|
|
|
|
def load_runner():
|
|
loader = importlib.machinery.SourceFileLoader("nodedc_engine_deploy_under_test", str(RUNNER_PATH))
|
|
spec = importlib.util.spec_from_loader(loader.name, loader)
|
|
module = importlib.util.module_from_spec(spec)
|
|
loader.exec_module(module)
|
|
return module
|
|
|
|
|
|
def snapshot_engine_builder_paths():
|
|
snapshot = {}
|
|
for relative in BUILDER_ENGINE_PATHS:
|
|
path = ENGINE_ROOT / relative
|
|
try:
|
|
path_stat = path.lstat()
|
|
except FileNotFoundError:
|
|
snapshot[relative] = None
|
|
continue
|
|
if path.is_symlink():
|
|
content = ("symlink", os.readlink(path))
|
|
elif path.is_file():
|
|
content = ("file", path.read_bytes())
|
|
else:
|
|
content = ("other", None)
|
|
snapshot[relative] = (
|
|
path_stat.st_mode,
|
|
path_stat.st_uid,
|
|
path_stat.st_gid,
|
|
path_stat.st_ino,
|
|
path_stat.st_mtime_ns,
|
|
content,
|
|
)
|
|
return snapshot
|
|
|
|
|
|
RUNNER = load_runner()
|
|
|
|
|
|
class EngineN8nPrivateExtensionTest(unittest.TestCase):
|
|
@classmethod
|
|
def setUpClass(cls):
|
|
cls.temporary = tempfile.TemporaryDirectory(prefix="nodedc-engine-n8n-policy-")
|
|
cls.root = Path(cls.temporary.name)
|
|
cls.results = []
|
|
cls.engine_snapshot_before = snapshot_engine_builder_paths()
|
|
for index in range(2):
|
|
output = cls.root / f"build-{index}"
|
|
output.mkdir()
|
|
env = os.environ.copy()
|
|
env.pop("NODEDC_N8N_TRANSITION_ID", None)
|
|
env["NODEDC_DEPLOY_ARTIFACT_DIR"] = str(output)
|
|
env["NODEDC_N8N_EXTENSION_STAGE_ARTIFACT"] = str(STAGE_ARTIFACT)
|
|
env["NODEDC_N8N_EXTENSION_PREDECESSOR_ARTIFACT"] = str(PREDECESSOR_ARTIFACT)
|
|
command = ["node", str(BUILDER_PATH)]
|
|
if index == 0:
|
|
command.append(TRANSITION_ID)
|
|
else:
|
|
env["NODEDC_N8N_TRANSITION_ID"] = TRANSITION_ID
|
|
result = subprocess.run(
|
|
command,
|
|
cwd=PLATFORM_ROOT,
|
|
env=env,
|
|
check=True,
|
|
capture_output=True,
|
|
text=True,
|
|
)
|
|
cls.results.append(json.loads(result.stdout))
|
|
cls.engine_snapshot_after = snapshot_engine_builder_paths()
|
|
|
|
@classmethod
|
|
def tearDownClass(cls):
|
|
cls.temporary.cleanup()
|
|
|
|
def artifact(self, build_index, kind):
|
|
return Path(self.results[build_index][kind]["artifact"])
|
|
|
|
def test_engine_artifacts_are_byte_reproducible(self):
|
|
for kind in ("activation", "rollback"):
|
|
first = self.artifact(0, kind).read_bytes()
|
|
second = self.artifact(1, kind).read_bytes()
|
|
self.assertEqual(first, second)
|
|
self.assertEqual(self.results[0][kind]["sha256"], self.results[1][kind]["sha256"])
|
|
self.assertEqual(first[4:8], b"\0\0\0\0")
|
|
self.assertEqual(first[3] & 0x08, 0)
|
|
|
|
def test_state_aware_upgrade_runner_functions_are_frozen(self):
|
|
actual = {
|
|
name: hashlib.sha256(inspect.getsource(getattr(RUNNER, name)).encode("utf-8")).hexdigest()
|
|
for name in PRIVATE_EXTENSION_CANON_FUNCTION_SHA256
|
|
}
|
|
self.assertEqual(actual, PRIVATE_EXTENSION_CANON_FUNCTION_SHA256)
|
|
|
|
def test_explicit_transition_id_does_not_mutate_sealed_release_identity(self):
|
|
expected_ids = {
|
|
"activation": f"engine-n8n-private-extension-{TRANSITION_ID}",
|
|
"rollback": f"engine-n8n-private-extension-rollback-{TRANSITION_ID}",
|
|
}
|
|
for result in self.results:
|
|
self.assertEqual(result["transitionId"], TRANSITION_ID)
|
|
self.assertEqual(result["releaseId"], SEALED_RELEASE_ID)
|
|
self.assertEqual(result["packageSha256"], SEALED_PACKAGE_SHA256)
|
|
for kind, expected_id in expected_ids.items():
|
|
self.assertEqual(result[kind]["id"], expected_id)
|
|
self.assertEqual(Path(result[kind]["artifact"]).name, f"nodedc-{expected_id}.tgz")
|
|
|
|
def test_builder_does_not_mutate_engine_source(self):
|
|
self.assertEqual(self.engine_snapshot_after, self.engine_snapshot_before)
|
|
|
|
def test_transition_id_rejects_missing_invalid_and_previously_issued_values(self):
|
|
cases = (
|
|
([], "transition_id_required"),
|
|
(["20260718-007"], "transition_id_already_issued"),
|
|
(["20260718-008"], "transition_id_already_issued"),
|
|
(["20260721-005"], "transition_id_already_issued"),
|
|
(["20260721-008"], "transition_id_already_issued"),
|
|
(["engine-n8n-private-extension-20260721-010"], "transition_id_invalid"),
|
|
(["20260230-004"], "transition_id_invalid"),
|
|
(["20260717-000"], "transition_id_invalid"),
|
|
([TRANSITION_ID, "unexpected-second-id"], "transition_id_argument_count_invalid"),
|
|
)
|
|
for arguments, expected_error in cases:
|
|
with self.subTest(arguments=arguments):
|
|
env = os.environ.copy()
|
|
env.pop("NODEDC_N8N_TRANSITION_ID", None)
|
|
result = subprocess.run(
|
|
["node", str(BUILDER_PATH), *arguments],
|
|
cwd=PLATFORM_ROOT,
|
|
env=env,
|
|
check=False,
|
|
capture_output=True,
|
|
text=True,
|
|
)
|
|
self.assertNotEqual(result.returncode, 0)
|
|
self.assertIn(expected_error, result.stderr)
|
|
|
|
def test_existing_transition_artifact_is_never_overwritten(self):
|
|
env = os.environ.copy()
|
|
env.pop("NODEDC_N8N_TRANSITION_ID", None)
|
|
env["NODEDC_DEPLOY_ARTIFACT_DIR"] = str(self.artifact(0, "activation").parent)
|
|
env["NODEDC_N8N_EXTENSION_STAGE_ARTIFACT"] = str(STAGE_ARTIFACT)
|
|
env["NODEDC_N8N_EXTENSION_PREDECESSOR_ARTIFACT"] = str(PREDECESSOR_ARTIFACT)
|
|
result = subprocess.run(
|
|
["node", str(BUILDER_PATH), TRANSITION_ID],
|
|
cwd=PLATFORM_ROOT,
|
|
env=env,
|
|
check=False,
|
|
capture_output=True,
|
|
text=True,
|
|
)
|
|
self.assertNotEqual(result.returncode, 0)
|
|
self.assertIn("transition_artifact_already_exists", result.stderr)
|
|
|
|
def test_activation_and_rollback_pass_strict_runner_policy(self):
|
|
expected = {"activation": ("activate", 7), "rollback": ("activate", 7)}
|
|
for kind, (action, entry_count) in expected.items():
|
|
with self.subTest(kind=kind), tempfile.TemporaryDirectory() as directory:
|
|
manifest, entries, payload = RUNNER.load_artifact(
|
|
self.artifact(0, kind),
|
|
Path(directory),
|
|
)
|
|
descriptor = RUNNER.read_engine_n8n_transition_descriptor(
|
|
payload / RUNNER.ENGINE_N8N_TRANSITION_DESCRIPTOR_REL
|
|
)
|
|
self.assertEqual(manifest["component"], "engine")
|
|
self.assertEqual(descriptor["action"], action)
|
|
self.assertEqual(len(entries), entry_count)
|
|
self.assertEqual(RUNNER.component_services("engine", entries), ("n8n",))
|
|
self.assertEqual(RUNNER.component_builds("engine", entries), ())
|
|
self.assertFalse(RUNNER.component_publish_dist("engine", entries))
|
|
|
|
def test_activation_catalog_is_exact_three_without_tool_variants(self):
|
|
with tempfile.TemporaryDirectory() as directory:
|
|
_manifest, _entries, payload = RUNNER.load_artifact(
|
|
self.artifact(0, "activation"),
|
|
Path(directory),
|
|
)
|
|
nodes = json.loads((payload / RUNNER.ENGINE_N8N_NODES_CATALOG_REL).read_text())
|
|
credentials = json.loads((payload / RUNNER.ENGINE_N8N_CREDENTIALS_CATALOG_REL).read_text())
|
|
private_nodes = [item for item in nodes if item.get("name", "").startswith("n8n-nodes-ndc.")]
|
|
private_credentials = [item for item in credentials if item.get("name") in EXPECTED_CREDENTIALS]
|
|
self.assertEqual([item["name"] for item in private_nodes], EXPECTED_NODES)
|
|
self.assertEqual([item["name"] for item in private_credentials], EXPECTED_CREDENTIALS)
|
|
self.assertTrue(all("usableAsTool" not in item for item in private_nodes))
|
|
self.assertEqual((len(nodes), len(credentials)), (437, 389))
|
|
publisher = next(item for item in private_nodes if item["name"].endswith(".ndcDataProductPublish"))
|
|
self.assertEqual(publisher["version"], [1, 2])
|
|
publish_mode = next(item for item in publisher["properties"] if item["name"] == "publishMode")
|
|
self.assertEqual([item["value"] for item in publish_mode["options"]], ["upsert", "replace"])
|
|
self.assertEqual(publish_mode["displayOptions"]["show"]["@version"], [2])
|
|
|
|
def test_rollback_catalog_restores_verified_predecessor_release(self):
|
|
with tempfile.TemporaryDirectory() as directory:
|
|
_manifest, _entries, payload = RUNNER.load_artifact(
|
|
self.artifact(0, "rollback"),
|
|
Path(directory),
|
|
)
|
|
nodes = json.loads((payload / RUNNER.ENGINE_N8N_NODES_CATALOG_REL).read_text())
|
|
credentials = json.loads((payload / RUNNER.ENGINE_N8N_CREDENTIALS_CATALOG_REL).read_text())
|
|
descriptor = RUNNER.read_engine_n8n_transition_descriptor(
|
|
payload / RUNNER.ENGINE_N8N_TRANSITION_DESCRIPTOR_REL
|
|
)
|
|
self.assertEqual(descriptor["releaseId"], PREDECESSOR_RELEASE_ID)
|
|
self.assertEqual(descriptor["expectedCurrent"], SEALED_RELEASE_ID)
|
|
self.assertEqual(
|
|
[item.get("name") for item in nodes if item.get("name", "").startswith("n8n-nodes-ndc.")],
|
|
EXPECTED_NODES,
|
|
)
|
|
self.assertEqual(
|
|
[item.get("name") for item in credentials if item.get("name") in PREDECESSOR_CREDENTIALS],
|
|
PREDECESSOR_CREDENTIALS,
|
|
)
|
|
self.assertEqual((len(nodes), len(credentials)), (437, 389))
|
|
|
|
def test_compose_override_is_runner_derived_and_offline(self):
|
|
with tempfile.TemporaryDirectory() as directory:
|
|
_manifest, _entries, payload = RUNNER.load_artifact(
|
|
self.artifact(0, "activation"),
|
|
Path(directory),
|
|
)
|
|
descriptor = RUNNER.read_engine_n8n_transition_descriptor(
|
|
payload / RUNNER.ENGINE_N8N_TRANSITION_DESCRIPTOR_REL
|
|
)
|
|
override = (payload / RUNNER.ENGINE_N8N_COMPOSE_OVERRIDE_REL).read_text()
|
|
self.assertEqual(override, RUNNER.expected_engine_n8n_compose_override(descriptor))
|
|
self.assertEqual(
|
|
hashlib.sha256(override.encode("utf-8")).hexdigest(),
|
|
"7fc118de152b7f5b76a7a502aea0dfc8d7dd191f6bfd304d6de9a4bf06f8fe1e",
|
|
)
|
|
self.assertIn("pull_policy: never", override)
|
|
self.assertIn("N8N_USER_FOLDER: /home/node", override)
|
|
self.assertNotIn("NODE_PATH", override)
|
|
self.assertIn(":/home/node/.n8n/nodes/node_modules/n8n-nodes-ndc:ro", override)
|
|
self.assertNotIn("N8N_CUSTOM_EXTENSIONS", override)
|
|
self.assertNotIn("build:", override)
|
|
|
|
def test_upgrade_override_is_accepted_as_installed_canon(self):
|
|
original_root = RUNNER.COMPONENTS["engine"]["payload_root"]
|
|
original_compose = RUNNER.COMPONENTS["engine"]["compose_root"]
|
|
try:
|
|
with tempfile.TemporaryDirectory() as directory:
|
|
work = Path(directory)
|
|
extracted = work / "artifact"
|
|
extracted.mkdir()
|
|
_manifest, _entries, payload = RUNNER.load_artifact(
|
|
self.artifact(0, "activation"),
|
|
extracted,
|
|
)
|
|
engine_root = work / "engine"
|
|
engine_root.mkdir()
|
|
(engine_root / "docker-compose.yml").write_text("services:\n", encoding="utf-8")
|
|
for relative in (
|
|
RUNNER.ENGINE_N8N_TRANSITION_DESCRIPTOR_REL,
|
|
RUNNER.ENGINE_N8N_COMPOSE_OVERRIDE_REL,
|
|
):
|
|
target = engine_root / relative
|
|
target.parent.mkdir(parents=True, exist_ok=True)
|
|
target.write_bytes((payload / relative).read_bytes())
|
|
RUNNER.COMPONENTS["engine"]["payload_root"] = engine_root
|
|
RUNNER.COMPONENTS["engine"]["compose_root"] = engine_root
|
|
compose_files = RUNNER.component_compose_files("engine")
|
|
self.assertEqual(compose_files, (
|
|
engine_root / "docker-compose.yml",
|
|
engine_root / RUNNER.ENGINE_N8N_COMPOSE_OVERRIDE_REL,
|
|
))
|
|
finally:
|
|
RUNNER.COMPONENTS["engine"]["payload_root"] = original_root
|
|
RUNNER.COMPONENTS["engine"]["compose_root"] = original_compose
|
|
|
|
def test_loader_probe_pins_n8n_node_path(self):
|
|
container = {
|
|
"Mounts": [{
|
|
"Destination": RUNNER.ENGINE_N8N_RUNTIME_PACKAGE_PATH,
|
|
"RW": False,
|
|
}],
|
|
}
|
|
completed = subprocess.CompletedProcess(
|
|
args=[],
|
|
returncode=0,
|
|
stdout=json.dumps({
|
|
"packageName": "n8n-nodes-ndc",
|
|
"nodes": ["ndcDataProductPublish", "ndcDataProductRead", "ndcFoundryBinding"],
|
|
"credentials": EXPECTED_CREDENTIALS,
|
|
}),
|
|
stderr="",
|
|
)
|
|
with (
|
|
mock.patch.object(RUNNER, "inspect_container", return_value=container),
|
|
mock.patch.object(RUNNER.subprocess, "run", return_value=completed) as run,
|
|
):
|
|
catalog = RUNNER.engine_n8n_private_loader_catalog("n8n-container")
|
|
|
|
command = run.call_args.args[0]
|
|
self.assertEqual(command[:-1], [
|
|
str(RUNNER.DOCKER),
|
|
"exec",
|
|
"n8n-container",
|
|
"node",
|
|
"-e",
|
|
])
|
|
probe_script = command[-1]
|
|
self.assertIn(
|
|
f"process.env.NODE_PATH='{RUNNER.ENGINE_N8N_NODE_MODULES_PATH}'",
|
|
probe_script,
|
|
)
|
|
self.assertIn("Module._initPaths()", probe_script)
|
|
self.assertIn("PackageDirectoryLoader", probe_script)
|
|
self.assertEqual(catalog, {
|
|
"node_types": EXPECTED_NODES,
|
|
"credential_types": EXPECTED_CREDENTIALS,
|
|
})
|
|
|
|
def test_loader_probe_failure_emits_only_allowlisted_diagnostic(self):
|
|
container = {
|
|
"Mounts": [{
|
|
"Destination": RUNNER.ENGINE_N8N_RUNTIME_PACKAGE_PATH,
|
|
"RW": False,
|
|
}],
|
|
}
|
|
cases = (
|
|
("MODULE_NOT_FOUND", "MODULE_NOT_FOUND"),
|
|
("Bearer secret-that-must-not-be-logged", "PROBE_ERROR"),
|
|
)
|
|
for probe_stderr, expected_category in cases:
|
|
with (
|
|
self.subTest(stderr=probe_stderr),
|
|
mock.patch.object(RUNNER, "inspect_container", return_value=container),
|
|
mock.patch.object(
|
|
RUNNER.subprocess,
|
|
"run",
|
|
return_value=subprocess.CompletedProcess(
|
|
args=[],
|
|
returncode=1,
|
|
stdout="",
|
|
stderr=probe_stderr,
|
|
),
|
|
),
|
|
):
|
|
with self.assertRaises(RUNNER.DeployError) as raised:
|
|
RUNNER.engine_n8n_private_loader_catalog("n8n-container")
|
|
message = str(raised.exception)
|
|
self.assertIn(f"category={expected_category}", message)
|
|
self.assertNotIn("secret-that-must-not-be-logged", message)
|
|
|
|
def test_active_runtime_acceptance_does_not_require_node_path(self):
|
|
with tempfile.TemporaryDirectory() as directory:
|
|
_manifest, _entries, payload = RUNNER.load_artifact(
|
|
self.artifact(0, "activation"),
|
|
Path(directory),
|
|
)
|
|
descriptor = RUNNER.read_engine_n8n_transition_descriptor(
|
|
payload / RUNNER.ENGINE_N8N_TRANSITION_DESCRIPTOR_REL
|
|
)
|
|
container = {
|
|
"State": {"Status": "running", "StartedAt": "2026-07-16T00:00:00Z"},
|
|
"Image": "sha256:base-image",
|
|
"Config": {
|
|
"Env": [
|
|
"N8N_USER_FOLDER=/home/node",
|
|
"N8N_COMMUNITY_PACKAGES_ENABLED=true",
|
|
"N8N_COMMUNITY_PACKAGES_PREVENT_LOADING=false",
|
|
"N8N_REINSTALL_MISSING_PACKAGES=false",
|
|
],
|
|
"Labels": {
|
|
"nodedc.n8n-private-extension.release": descriptor["releaseId"],
|
|
"nodedc.n8n-private-extension.package-sha256": descriptor["packageSha256"],
|
|
},
|
|
},
|
|
"Mounts": [{
|
|
"Destination": RUNNER.ENGINE_N8N_RUNTIME_PACKAGE_PATH,
|
|
"Source": f"/volume2/nodedc-demo/{descriptor['sealedReleaseRelativePath']}",
|
|
"RW": False,
|
|
}],
|
|
"RestartCount": 0,
|
|
}
|
|
log_result = subprocess.CompletedProcess(args=[], returncode=0, stdout="", stderr="")
|
|
with (
|
|
mock.patch.object(
|
|
RUNNER,
|
|
"inspect_engine_n8n_base_image",
|
|
return_value={"id": "sha256:base-image"},
|
|
),
|
|
mock.patch.object(RUNNER, "engine_n8n_container_ids", return_value=("n8n-container",)),
|
|
mock.patch.object(RUNNER, "inspect_container", return_value=container),
|
|
mock.patch.object(RUNNER, "wait_engine_n8n_readiness"),
|
|
mock.patch.object(RUNNER, "engine_n8n_version", return_value=RUNNER.ENGINE_N8N_VERSION),
|
|
mock.patch.object(RUNNER.subprocess, "run", return_value=log_result),
|
|
mock.patch.object(
|
|
RUNNER,
|
|
"engine_n8n_private_loader_catalog",
|
|
return_value={
|
|
"node_types": EXPECTED_NODES,
|
|
"credential_types": EXPECTED_CREDENTIALS,
|
|
},
|
|
),
|
|
mock.patch.object(RUNNER, "validate_engine_n8n_catalog_payload"),
|
|
mock.patch.object(RUNNER.time, "sleep"),
|
|
):
|
|
accepted = RUNNER.accept_engine_n8n_runtime(descriptor)
|
|
self.assertEqual(accepted["node_types"], EXPECTED_NODES)
|
|
|
|
def test_private_extension_transition_does_not_enter_publish_grant_domain(self):
|
|
entries = (RUNNER.ENGINE_N8N_TRANSITION_DESCRIPTOR_REL,)
|
|
descriptor = {"action": "rollback-inactive"}
|
|
self.assertFalse(RUNNER.touches_engine_data_product_publish_grant(entries))
|
|
self.assertEqual(RUNNER.component_services("engine", entries), ("n8n",))
|
|
with (
|
|
mock.patch.object(RUNNER, "current_engine_n8n_transition_descriptor", return_value=descriptor),
|
|
mock.patch.object(RUNNER, "ensure_engine_edp_managed_provisioner_keypair") as keypair,
|
|
mock.patch.object(RUNNER, "ensure_engine_publish_grant_private_state") as private_state,
|
|
):
|
|
RUNNER.prepare_component_runtime("engine", entries)
|
|
keypair.assert_not_called()
|
|
private_state.assert_not_called()
|
|
|
|
def test_generic_engine_compose_artifact_keeps_legacy_service_selection(self):
|
|
self.assertEqual(
|
|
RUNNER.component_services("engine", ("docker-compose.yml",)),
|
|
RUNNER.COMPONENTS["engine"]["services"],
|
|
)
|
|
self.assertEqual(
|
|
RUNNER.component_services(
|
|
"engine",
|
|
("docker-compose.yml", "nodedc-source/server/dataProductPublishGrant/store.js"),
|
|
),
|
|
RUNNER.COMPONENTS["engine"]["services"],
|
|
)
|
|
self.assertFalse(RUNNER.is_engine_data_product_publish_grant_slice(
|
|
"engine",
|
|
("docker-compose.yml", "nodedc-source/server/dataProductPublishGrant/store.js"),
|
|
))
|
|
|
|
def test_unknown_descriptor_key_is_rejected(self):
|
|
with tempfile.TemporaryDirectory() as directory:
|
|
work = Path(directory)
|
|
RUNNER.safe_extract(self.artifact(0, "activation"), work)
|
|
descriptor_path = work / "payload" / RUNNER.ENGINE_N8N_TRANSITION_DESCRIPTOR_REL
|
|
descriptor = json.loads(descriptor_path.read_text())
|
|
descriptor["unexpected"] = True
|
|
descriptor_path.write_text(json.dumps(descriptor))
|
|
with self.assertRaisesRegex(RUNNER.DeployError, "keys mismatch"):
|
|
RUNNER.validate_engine_n8n_transition(
|
|
work / "payload",
|
|
RUNNER.parse_files_list(work / "files.txt"),
|
|
)
|
|
|
|
def test_core_catalog_substitution_is_rejected_even_when_counts_match(self):
|
|
cases = (
|
|
("activation", RUNNER.ENGINE_N8N_NODES_CATALOG_REL, "node"),
|
|
("activation", RUNNER.ENGINE_N8N_CREDENTIALS_CATALOG_REL, "credential"),
|
|
("rollback", RUNNER.ENGINE_N8N_NODES_CATALOG_REL, "node"),
|
|
("rollback", RUNNER.ENGINE_N8N_CREDENTIALS_CATALOG_REL, "credential"),
|
|
)
|
|
for kind, relative_path, label in cases:
|
|
with self.subTest(kind=kind, catalog=label), tempfile.TemporaryDirectory() as directory:
|
|
work = Path(directory)
|
|
RUNNER.safe_extract(self.artifact(0, kind), work)
|
|
catalog_path = work / "payload" / relative_path
|
|
catalog = json.loads(catalog_path.read_text())
|
|
if label == "node":
|
|
candidate = next(
|
|
item for item in catalog
|
|
if not item.get("name", "").startswith("n8n-nodes-ndc.")
|
|
)
|
|
candidate["name"] = "n8n-nodes-unreviewed.hiddenNode"
|
|
else:
|
|
candidate = next(
|
|
item for item in catalog
|
|
if item.get("name") not in EXPECTED_CREDENTIALS
|
|
)
|
|
candidate["name"] = "unreviewedCredential"
|
|
catalog_path.write_text(json.dumps(catalog, indent=2) + "\n")
|
|
with self.assertRaisesRegex(RUNNER.DeployError, "catalog sha256 mismatch"):
|
|
RUNNER.validate_engine_n8n_transition(
|
|
work / "payload",
|
|
RUNNER.parse_files_list(work / "files.txt"),
|
|
)
|
|
|
|
def test_old_engine_artifact_is_rejected_by_descriptor_gate(self):
|
|
old = PLATFORM_ROOT / "infra/deploy-artifacts/nodedc-engine-n8n-private-extension-20260715-002.tgz"
|
|
if not old.is_file():
|
|
self.skipTest("rejected historical artifact not present")
|
|
with tempfile.TemporaryDirectory() as directory:
|
|
with self.assertRaisesRegex(RUNNER.DeployError, "canonical transition descriptor"):
|
|
RUNNER.load_artifact(old, Path(directory))
|
|
|
|
def test_engine_source_keeps_base_compose_and_separate_override(self):
|
|
original_root = RUNNER.COMPONENTS["engine"]["payload_root"]
|
|
original_compose = RUNNER.COMPONENTS["engine"]["compose_root"]
|
|
try:
|
|
RUNNER.COMPONENTS["engine"]["payload_root"] = ENGINE_ROOT
|
|
RUNNER.COMPONENTS["engine"]["compose_root"] = ENGINE_ROOT
|
|
RUNNER.validate_engine_n8n_base_compose_source()
|
|
finally:
|
|
RUNNER.COMPONENTS["engine"]["payload_root"] = original_root
|
|
RUNNER.COMPONENTS["engine"]["compose_root"] = original_compose
|
|
|
|
def test_additional_n8n_runtime_service_is_rejected(self):
|
|
original_root = RUNNER.COMPONENTS["engine"]["payload_root"]
|
|
original_compose = RUNNER.COMPONENTS["engine"]["compose_root"]
|
|
try:
|
|
with tempfile.TemporaryDirectory() as directory:
|
|
engine_root = Path(directory)
|
|
compose = (ENGINE_ROOT / "docker-compose.yml").read_text()
|
|
compose += (
|
|
"\n n8n-worker-2:\n"
|
|
" image: docker.n8n.io/n8nio/n8n:${N8N_IMAGE_TAG:-2.3.2}\n"
|
|
)
|
|
(engine_root / "docker-compose.yml").write_text(compose)
|
|
RUNNER.COMPONENTS["engine"]["payload_root"] = engine_root
|
|
RUNNER.COMPONENTS["engine"]["compose_root"] = engine_root
|
|
with self.assertRaisesRegex(RUNNER.DeployError, "exact service topology mismatch"):
|
|
RUNNER.validate_engine_n8n_base_compose_source()
|
|
finally:
|
|
RUNNER.COMPONENTS["engine"]["payload_root"] = original_root
|
|
RUNNER.COMPONENTS["engine"]["compose_root"] = original_compose
|
|
|
|
def test_sealed_release_exact_set_includes_implicit_directories(self):
|
|
release_relative = Path(
|
|
"payload/releases/n8n-nodes-ndc/0.1.6-25cc2d7a52a0d0ee"
|
|
)
|
|
with tempfile.TemporaryDirectory() as directory:
|
|
work = Path(directory)
|
|
outer = work / "outer"
|
|
RUNNER.safe_extract(STAGE_ARTIFACT, outer)
|
|
staged_release = outer / release_relative
|
|
sealed_release = work / "sealed"
|
|
sealed_release.mkdir()
|
|
for filename in ("package.tgz", "release.json", "rollback.json"):
|
|
(sealed_release / filename).write_bytes(
|
|
(staged_release / filename).read_bytes()
|
|
)
|
|
|
|
expected_paths = {
|
|
"package",
|
|
"package.tgz",
|
|
"release.json",
|
|
"rollback.json",
|
|
}
|
|
with tarfile.open(staged_release / "package.tgz", "r:gz") as archive:
|
|
for member in archive:
|
|
RUNNER.add_engine_n8n_sealed_member_paths(
|
|
expected_paths,
|
|
member.name,
|
|
)
|
|
target = sealed_release.joinpath(*Path(member.name).parts)
|
|
if member.isdir():
|
|
target.mkdir(parents=True, exist_ok=True)
|
|
continue
|
|
target.parent.mkdir(parents=True, exist_ok=True)
|
|
source = archive.extractfile(member)
|
|
self.assertIsNotNone(source)
|
|
target.write_bytes(source.read())
|
|
|
|
actual_paths = {
|
|
path.relative_to(sealed_release).as_posix()
|
|
for path in sealed_release.rglob("*")
|
|
}
|
|
self.assertEqual(actual_paths, expected_paths)
|
|
self.assertIn("package/dist/nodes", expected_paths)
|
|
self.assertIn("package/dist/credentials", expected_paths)
|
|
|
|
def test_tar_members_have_no_appledouble_or_special_types(self):
|
|
for kind in ("activation", "rollback"):
|
|
with tarfile.open(self.artifact(0, kind), "r:gz") as archive:
|
|
for member in archive:
|
|
self.assertFalse(Path(member.name).name.startswith("._"))
|
|
self.assertTrue(member.isfile() or member.isdir())
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main(verbosity=2)
|