Files
orchestrator/tests/test_plane_sync_labels.py
claude-bot 861b5ee984 fix(plane): sandbox-only fail-closed guard for Plane writes from test process (ORCH-117)
Close the root class of incident ORCH-114: a pytest/worktree process performed a
REAL write (PATCH issues state=<Done> + comment) against the PRODUCTION Plane
project, because test/staging processes inherit the live Plane token
(PLANE_HEADERS/PROJECT_ID are captured at import — a post-hoc env/token swap is a
no-op) and nothing forced them to write only to the sandbox. Symmetric to the
existing _no_telegram autouse floor.

- New pure never-raise leaf src/plane_write_guard.py (decide/audit_block/
  audit_allow), wired into the 3 plane_sync write primitives (update_issue_state /
  add_comment / _set_issue_state_direct) via _guard_allows_write, AT CALL TIME,
  before any network step. Active ONLY in a test process (pytest in sys.modules /
  PYTEST_CURRENT_TEST); live + staging runtimes (uvicorn) are a strict no-op.
- In a test process: default-deny. A write is allowed iff opt-in
  (plane_test_write_enabled) AND target project in the sandbox allowlist
  (plane_test_sandbox_projects, default = the one SANDBOX id). Prod is blocked even
  with opt-in (allowlist sandbox-only); unresolved project -> block (fail-closed).
- Independent second layer: tests/conftest.py::_plane_sandbox_only autouse floor.
  Intentionally NO prod-block kill-switch (anti back-door, NFR-6).
- Audit: block -> loud ERROR; sandbox-allow -> INFO.
- Bypass fixtures for the 3 (+1) pre-existing tests that assert on the mocked
  write primitive's httpx call (header/URL/state logic), the guard is no Quality
  Gate: STAGE_TRANSITIONS / QG_CHECKS / check_* / machine-verdict / DB schema
  untouched.
- Tests: tests/test_orch117_plane_write_isolation.py (TC-01 mandatory ORCH-114
  regression + TC-02..TC-14). Docs: CLAUDE.md, architecture/README.md,
  operations/INFRA.md, .env.example, CHANGELOG.md.

Refs: ORCH-117
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-15 21:32:20 +03:00

173 lines
6.3 KiB
Python

"""ORCH-089 — plane_sync: label reading + Approved setter (offline, httpx mocked).
Covers (04-test-plan.yaml):
TC-07 fetch_issue_labels parses the issue's `labels` field; get_project_labels
resolves {normalized_name -> uuid}.
TC-08 the project label-map is cached with a TTL (a repeat inside the TTL window
makes no second GET).
TC-09 set_issue_approved PATCHes the issue to the Approved UUID; never-raise.
"""
import os
import tempfile
import pytest
os.environ.setdefault("ORCH_DB_PATH", os.path.join(tempfile.gettempdir(), "test_ps_labels.db"))
os.environ.setdefault("ORCH_GITEA_TOKEN", "test-token")
os.environ.setdefault("ORCH_PLANE_API_TOKEN", "test-token")
from unittest.mock import MagicMock # noqa: E402
from src import plane_sync as ps # noqa: E402
def _resp(json_body):
m = MagicMock()
m.json.return_value = json_body
m.raise_for_status.return_value = None
return m
@pytest.fixture(autouse=True)
def fresh_cache(monkeypatch):
ps.reload_project_labels()
monkeypatch.setattr(ps, "_resolve_project_id", lambda w=None, p=None: "proj-1")
monkeypatch.setattr(ps.settings, "auto_label_states_ttl_s", 300, raising=False)
# ORCH-117: the TC-09 set_issue_approved test reaches the guarded write primitive
# with a non-sandbox project ("proj-1"); bypass the fail-closed sandbox guard so
# its (mocked) httpx.patch assertion runs. The guard is covered by
# tests/test_orch117_plane_write_isolation.py.
monkeypatch.setattr(
ps.plane_write_guard, "decide",
lambda *a, **k: (True, "test-bypass"), raising=False,
)
yield
ps.reload_project_labels()
# --- TC-07: fetch_issue_labels + get_project_labels ------------------------
def test_tc07_fetch_issue_labels(monkeypatch):
monkeypatch.setattr(ps, "find_issue_id", lambda w, p=None: "issue-uuid")
monkeypatch.setattr(
ps.httpx, "get",
lambda *a, **k: _resp({"labels": ["uuid-A", "uuid-B"]}),
)
assert ps.fetch_issue_labels("ORCH-1") == ["uuid-A", "uuid-B"]
def test_tc07_fetch_issue_labels_not_found(monkeypatch):
# Issue not resolvable -> None (distinct from [] = "no labels").
monkeypatch.setattr(ps, "find_issue_id", lambda w, p=None: None)
assert ps.fetch_issue_labels("ORCH-404") is None
def test_tc07_fetch_issue_labels_api_error(monkeypatch):
monkeypatch.setattr(ps, "find_issue_id", lambda w, p=None: "issue-uuid")
monkeypatch.setattr(ps.httpx, "get", MagicMock(side_effect=Exception("boom")))
assert ps.fetch_issue_labels("ORCH-1") is None # never-raise
def test_tc07_get_project_labels_normalized(monkeypatch):
monkeypatch.setattr(
ps.httpx, "get",
lambda *a, **k: _resp({"results": [
{"id": "uuid-A", "name": "autoApprove"},
{"id": "uuid-B", "name": "Auto Deploy"},
]}),
)
m = ps.get_project_labels("proj-1")
assert m["autoapprove"] == "uuid-A"
assert m["auto deploy"] == "uuid-B"
def test_tc07_get_project_labels_ambiguous(monkeypatch):
# Two distinct labels collapse to the same normalized name -> sentinel.
monkeypatch.setattr(
ps.httpx, "get",
lambda *a, **k: _resp([
{"id": "uuid-A", "name": "autoApprove"},
{"id": "uuid-B", "name": "AUTOAPPROVE"},
]),
)
m = ps.get_project_labels("proj-1")
assert m["autoapprove"] == "__AMBIGUOUS__"
def test_tc07_get_project_labels_api_error_empty(monkeypatch):
monkeypatch.setattr(ps.httpx, "get", MagicMock(side_effect=Exception("down")))
assert ps.get_project_labels("proj-1") == {} # never-raise, no cache -> {}
# --- TC-08: TTL cache ------------------------------------------------------
def test_tc08_label_map_cached_within_ttl(monkeypatch):
clock = {"t": 1000.0}
monkeypatch.setattr(ps.time, "monotonic", lambda: clock["t"])
mock_get = MagicMock(side_effect=lambda *a, **k: _resp(
{"results": [{"id": "uuid-A", "name": "autoApprove"}]}
))
monkeypatch.setattr(ps.httpx, "get", mock_get)
ps.get_project_labels("proj-1")
ps.get_project_labels("proj-1") # within TTL -> served from cache
assert mock_get.call_count == 1
# Past the TTL -> refetch.
clock["t"] += 301
ps.get_project_labels("proj-1")
assert mock_get.call_count == 2
def test_tc08_ttl_zero_lifetime_cache(monkeypatch):
monkeypatch.setattr(ps.settings, "auto_label_states_ttl_s", 0, raising=False)
clock = {"t": 1000.0}
monkeypatch.setattr(ps.time, "monotonic", lambda: clock["t"])
mock_get = MagicMock(side_effect=lambda *a, **k: _resp(
[{"id": "uuid-A", "name": "autoApprove"}]
))
monkeypatch.setattr(ps.httpx, "get", mock_get)
ps.get_project_labels("proj-1")
clock["t"] += 100000
ps.get_project_labels("proj-1")
assert mock_get.call_count == 1 # lifetime cache, never expires
def test_tc08_stale_served_on_refresh_failure(monkeypatch):
clock = {"t": 1000.0}
monkeypatch.setattr(ps.time, "monotonic", lambda: clock["t"])
responses = iter([
_resp({"results": [{"id": "uuid-A", "name": "autoApprove"}]}),
Exception("transient"),
])
def flaky(*a, **k):
r = next(responses)
if isinstance(r, Exception):
raise r
return r
monkeypatch.setattr(ps.httpx, "get", flaky)
ps.get_project_labels("proj-1")
clock["t"] += 301 # force a refresh that fails -> stale map served
m = ps.get_project_labels("proj-1")
assert m["autoapprove"] == "uuid-A"
# --- TC-09: set_issue_approved ---------------------------------------------
def test_tc09_set_issue_approved_patches_approved_uuid(monkeypatch):
monkeypatch.setattr(ps, "get_project_states", lambda pid: {"approved": "approved-uuid"})
monkeypatch.setattr(ps, "find_issue_id", lambda w, p=None: "issue-uuid")
patch_spy = MagicMock(return_value=_resp({}))
monkeypatch.setattr(ps.httpx, "patch", patch_spy)
ps.set_issue_approved("ORCH-1")
patch_spy.assert_called_once()
assert patch_spy.call_args.kwargs["json"] == {"state": "approved-uuid"}
def test_tc09_set_issue_approved_never_raises(monkeypatch):
monkeypatch.setattr(ps, "get_project_states", lambda pid: {"approved": "approved-uuid"})
monkeypatch.setattr(ps, "find_issue_id", lambda w, p=None: "issue-uuid")
monkeypatch.setattr(ps.httpx, "patch", MagicMock(side_effect=Exception("boom")))
# Must not raise.
ps.set_issue_approved("ORCH-1")