first commit

deploy/test_production_preflight.py

@@ -0,0 +1,98 @@
+import unittest
+
+from .production_preflight import config_errors, source_errors
+
+
+def valid_config():
+    digest = '1' * 64
+    values = {
+        'PRODUCTION_DEPLOY_ENABLED': 'approved',
+        'PRODUCTION_INPUTS_APPROVED': 'approved',
+        'PRODUCTION_SECURITY_REVIEW_APPROVED': 'approved',
+        'PRODUCTION_RESTORE_REHEARSED': 'approved',
+        'API_IMAGE': 'registry.example.com/dropstar/dtf-api',
+        'WEB_IMAGE': 'registry.example.com/dropstar/dtf-web',
+        'IMAGE_TAG': 'latest',
+        'POSTGRES_IMAGE': f'postgres@sha256:{digest}',
+        'CLAMAV_IMAGE': f'clamav/clamav@sha256:{digest}',
+        'PUBLIC_ORIGIN': 'https://dtf.example.com',
+        'PUBLIC_HOST': 'dtf.example.com',
+        'KANBAN_HOST': 'kanban-dtf.example.com',
+        'SITE_PORT': '8080',
+        'KANBAN_PORT': '8081',
+        'R2_ENDPOINT': 'https://account.r2.cloudflarestorage.com',
+        'R2_PUBLIC_ENDPOINT': 'https://account.r2.cloudflarestorage.com',
+        'R2_BUCKET': 'dtf-production-artwork',
+        'POSTGRES_DB': 'dtf',
+        'POSTGRES_USER': 'dtf_admin',
+        'APP_DB_USER': 'dtf_app',
+        'POSTGRES_VOLUME': 'dtf-postgres-data',
+        'OPERATOR_USER': 'dtf-operator',
+        'STORAGE_QUOTA_BYTES': '53687091200',
+        'OWNER_UPLOAD_QUOTA_BYTES': '10737418240',
+        'MAX_UPLOAD_BYTES': '5368709120',
+        'UPLOAD_PART_BYTES': '8388608',
+        'MAX_PENDING_UPLOADS': '10',
+        'SCAN_MAX_BYTES': '134217728',
+        'PAYMENT_ADAPTER': 'mercado-pago',
+        'FREIGHT_ADAPTER': 'approved-freight',
+        'TINY_ADAPTER': 'tiny-olist',
+        'WHATSAPP_ADAPTER': 'approved-whatsapp',
+    }
+    for name in (
+        'DATABASE_URL_SECRET', 'DATABASE_ADMIN_URL_SECRET',
+        'DB_ADMIN_PASSWORD_SECRET', 'APP_DB_PASSWORD_SECRET',
+        'R2_ACCESS_KEY_ID_SECRET', 'R2_SECRET_ACCESS_KEY_SECRET',
+        'OPERATOR_PASSWORD_SECRET', 'PAYMENT_TOKEN_SECRET',
+        'PAYMENT_WEBHOOK_SECRET', 'TINY_TOKEN_SECRET', 'WHATSAPP_TOKEN_SECRET',
+    ):
+        values[name] = 'dtf_prod_' + name.lower()
+    return values
+
+
+class ProductionPreflightTests(unittest.TestCase):
+    def test_structurally_complete_metadata_passes(self):
+        self.assertEqual(config_errors(valid_config()), [])
+
+    def test_mutable_images_and_fake_adapters_fail(self):
+        values = valid_config()
+        values['API_IMAGE'] = 'registry.example.com/dropstar/dtf-api:latest'
+        values['PAYMENT_ADAPTER'] = 'fake'
+        errors = config_errors(values)
+        self.assertTrue(any('API_IMAGE' in error for error in errors))
+        self.assertTrue(any('PAYMENT_ADAPTER' in error for error in errors))
+
+    def test_image_tag_and_public_ports_are_validated(self):
+        values = valid_config()
+        values['IMAGE_TAG'] = 'main'
+        values['KANBAN_PORT'] = values['SITE_PORT']
+        errors = config_errors(values)
+        self.assertTrue(any('IMAGE_TAG' in error for error in errors))
+        self.assertTrue(any('must differ' in error for error in errors))
+
+    def test_approval_and_secret_name_are_enforced(self):
+        values = valid_config()
+        values['PRODUCTION_DEPLOY_ENABLED'] = 'yes'
+        values['DATABASE_URL_SECRET'] = '../unsafe'
+        errors = config_errors(values)
+        self.assertTrue(any('PRODUCTION_DEPLOY_ENABLED' in error for error in errors))
+        self.assertTrue(any('DATABASE_URL_SECRET' in error for error in errors))
+
+    def test_current_application_is_explicitly_blocked(self):
+        errors = source_errors()
+        self.assertTrue(any('local/adapters.py remains local-only' in error for error in errors))
+        self.assertTrue(any('local/app.py remains local-only' in error for error in errors))
+
+    def test_secret_reuse_and_incoherent_limits_are_rejected(self):
+        values = valid_config()
+        values['PAYMENT_TOKEN_SECRET'] = values['TINY_TOKEN_SECRET']
+        values['OWNER_UPLOAD_QUOTA_BYTES'] = str(int(values['STORAGE_QUOTA_BYTES']) + 1)
+        values['SCAN_MAX_BYTES'] = str(int(values['MAX_UPLOAD_BYTES']) + 1)
+        errors = config_errors(values)
+        self.assertTrue(any('distinct external Swarm secret' in error for error in errors))
+        self.assertIn('OWNER_UPLOAD_QUOTA_BYTES cannot exceed STORAGE_QUOTA_BYTES', errors)
+        self.assertIn('SCAN_MAX_BYTES cannot exceed MAX_UPLOAD_BYTES', errors)
+
+
+if __name__ == '__main__':
+    unittest.main()