144 lines
5.7 KiB
Python
144 lines
5.7 KiB
Python
"""End-to-end boundary tests for the V2R1 authenticated ingress runtime."""
|
|
from __future__ import annotations
|
|
|
|
import hashlib
|
|
import hmac
|
|
import sys
|
|
from datetime import datetime, timezone
|
|
from tempfile import TemporaryDirectory
|
|
|
|
from aios_v2r1.runtime import RuntimeWiring
|
|
from aios_v2r1.message_ledger import MessageLedger
|
|
from aios_v2r1.tenant_context import canonical_json
|
|
|
|
|
|
class FixedClock:
|
|
def __init__(self) -> None:
|
|
self.now = datetime(2026, 7, 13, tzinfo=timezone.utc)
|
|
|
|
def __call__(self) -> datetime:
|
|
return self.now
|
|
|
|
|
|
class TestRuntimeIngressFlow:
|
|
"""Use the public ingress boundary; do not reach into router internals."""
|
|
|
|
internal_key = b"runtime-integration-internal-key-32bytes"
|
|
ingress_key = b"runtime-integration-ingress-key-32bytes!"
|
|
|
|
def setup_method(self) -> None:
|
|
self.directory = TemporaryDirectory()
|
|
self.clock = FixedClock()
|
|
self.runtime = RuntimeWiring.create(
|
|
self.directory.name,
|
|
signing_key=self.internal_key,
|
|
ingress_hmac_key=self.ingress_key,
|
|
clock=self.clock,
|
|
)
|
|
self.runtime.router.register_tenant("tenant-a", "cell-a")
|
|
self.runtime.router.register_tenant("tenant-b", "cell-b")
|
|
self.runtime.router.bind_channel(
|
|
tenant_id="tenant-a", channel="weixin", channel_account_id="account-a"
|
|
)
|
|
self.runtime.router.bind_channel(
|
|
tenant_id="tenant-b", channel="weixin", channel_account_id="account-b"
|
|
)
|
|
self.runtime.router.bind_principal(
|
|
tenant_id="tenant-a",
|
|
channel="weixin",
|
|
channel_account_id="account-a",
|
|
principal_id="user-a",
|
|
)
|
|
self.runtime.router.bind_session(
|
|
tenant_id="tenant-a",
|
|
session_id="session-a",
|
|
cell_id="cell-a",
|
|
principal_id="user-a",
|
|
ttl_seconds=60,
|
|
)
|
|
|
|
def teardown_method(self) -> None:
|
|
self.directory.cleanup()
|
|
|
|
def _message(self, *, event_id: str = "event-a", message_id: str = "message-a",
|
|
body: str = "hello", **changes: object) -> dict[str, object]:
|
|
values: dict[str, object] = {
|
|
"tenant_id": "tenant-a", "cell_id": "cell-a", "principal_id": "user-a",
|
|
"principal_type": "authenticated_user", "origin_type": "channel_user",
|
|
"channel": "weixin", "channel_account_id": "account-a", "peer_id": "peer-a",
|
|
"conversation_id": "conversation-a", "session_id": "session-a", "task_id": None,
|
|
"event_id": event_id, "message_id": message_id, "reply_to_message_id": None,
|
|
"direction": "inbound", "command_capable": True,
|
|
"occurred_at": "2026-07-13T00:00:00+00:00",
|
|
"received_at": "2026-07-13T00:00:01+00:00",
|
|
"content": {"body": body, "quoted_body": None},
|
|
"adapter": {"name": "weixin", "version": "v2"},
|
|
}
|
|
values.update(changes)
|
|
return values
|
|
|
|
def _request(self, **changes: object) -> dict[str, object]:
|
|
values: dict[str, object] = {
|
|
"principal_id": "user-a", "tenant_id": "tenant-a", "cell_id": "cell-a",
|
|
"channel": "weixin", "channel_account_id": "account-a", "session_id": "session-a",
|
|
"message": self._message(),
|
|
}
|
|
values.update(changes)
|
|
values["signature"] = hmac.new(
|
|
self.ingress_key, canonical_json(values), hashlib.sha256
|
|
).hexdigest()
|
|
return values
|
|
|
|
def test_authenticated_ingress_uses_direct_append_and_acquires_session(self) -> None:
|
|
# Observe the real MessageLedger object while preserving every method
|
|
# implementation. This proves the public ingress path never calls
|
|
# the legacy compatibility entrypoint; it is not a mock or bypass.
|
|
remember_code = MessageLedger.remember.__code__
|
|
remember_calls = 0
|
|
previous_profile = sys.getprofile()
|
|
|
|
def observe(frame: object, event: str, arg: object) -> None:
|
|
nonlocal remember_calls
|
|
if event == "call" and getattr(frame, "f_code", None) is remember_code:
|
|
remember_calls += 1
|
|
|
|
sys.setprofile(observe)
|
|
try:
|
|
response = self.runtime.ingest(request=self._request())
|
|
finally:
|
|
sys.setprofile(previous_profile)
|
|
|
|
assert response.status == "ACCEPTED"
|
|
assert response.result is not None
|
|
assert response.result.record.message_id == "message-a"
|
|
assert response.result.session.session_id == "session-a"
|
|
assert self.runtime.ledger.count() == 1
|
|
assert self.runtime.session_pool.active_count() == 1
|
|
assert remember_calls == 0
|
|
|
|
def test_forged_tenant_claim_is_rejected_before_ledger_or_session_mutation(self) -> None:
|
|
response = self.runtime.ingest(request=self._request(
|
|
tenant_id="tenant-b",
|
|
cell_id="cell-b",
|
|
message=self._message(tenant_id="tenant-b", cell_id="cell-b"),
|
|
))
|
|
|
|
assert response.status == "AUTH_FAILED"
|
|
assert response.result is None
|
|
assert self.runtime.ledger.count() == 0
|
|
assert self.runtime.session_pool.active_count() == 0
|
|
|
|
def test_conflicting_duplicate_message_is_mapped_at_the_ingress_boundary(self) -> None:
|
|
assert self.runtime.ingest(request=self._request(
|
|
message=self._message(body="first")
|
|
)).status == "ACCEPTED"
|
|
|
|
response = self.runtime.ingest(request=self._request(
|
|
message=self._message(event_id="event-b", body="second")
|
|
))
|
|
|
|
assert response.status == "CONFLICT"
|
|
assert response.result is None
|
|
assert self.runtime.ledger.count() == 1
|
|
assert self.runtime.session_pool.active_count() == 1
|