Release v0.1.9: enforce Photos API boundary and finalize Server migration

2026-10-17 01:39:23 +08:00
parent 46a0429d5e
commit b87bf6f77e
35 changed files with 724 additions and 155 deletions
@@ -0,0 +1,55 @@
+"""Production release preflight must reject unsafe inherited container settings."""
+
+import importlib.util
+from pathlib import Path
+
+import pytest
+
+
+@pytest.fixture
+def release_tool():
+    spec = importlib.util.spec_from_file_location(
+        "server_release", Path(__file__).parents[1] / "scripts/server-release.py"
+    )
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+@pytest.mark.parametrize(
+    "unsafe", ["mock", "writes", "photos", "system_disk", "root", "caps"]
+)
+def test_release_rejects_unsafe_runtime(release_tool, monkeypatch, unsafe):
+    container = {
+        "Config": {
+            "User": "10333:10333",
+            "Env": [
+                "KOKONNA_MOCK=false",
+                "KOKONNA_WRITE_ENABLED=true",
+                "BUILD_COMMIT=test",
+            ],
+        },
+        "State": {"Running": True},
+        "HostConfig": {"ReadonlyRootfs": True, "CapDrop": ["ALL"]},
+        "Mounts": [
+            {"Destination": "/data", "Source": str(release_tool.APP / "data")},
+            {"Destination": "/config", "Source": str(release_tool.APP / "config")},
+        ],
+    }
+    if unsafe == "mock":
+        container["Config"]["Env"][0] = "KOKONNA_MOCK=true"
+    elif unsafe == "writes":
+        container["Config"]["Env"][1] = "KOKONNA_WRITE_ENABLED=false"
+    elif unsafe == "photos":
+        container["Mounts"].append(
+            {"Destination": "/photos", "Source": "/volume1/photo"}
+        )
+    elif unsafe == "system_disk":
+        container["Mounts"][0]["Source"] = "/var/lib/frame-flow"
+    elif unsafe == "root":
+        container["Config"]["User"] = "root"
+    else:
+        container["HostConfig"]["CapDrop"] = []
+    monkeypatch.setattr(release_tool, "inspect", lambda: container)
+    with pytest.raises(AssertionError):
+        release_tool.verify_runtime("test")