feat: expose safe pi management api

2026-08-05 00:31:44 +02:00
parent 09eeea17e5
commit d6b4a08a02
10 changed files with 744 additions and 61 deletions
@@ -0,0 +1,112 @@
+import { expect, test, vi } from "vitest";
+import { buildApp } from "../src/app.js";
+import { loadConfig } from "../src/config.js";
+import type { PiManagementService } from "../src/pi/management.js";
+import { piManagementRoutes } from "../src/routes/pi-management.js";
+
+void piManagementRoutes;
+
+function fakeService(): PiManagementService {
+  return {
+    status: vi.fn(async () => ({
+      version: "0.80.3", ready: true,
+      config: { provider: "zai", model: "glm-5.2", reasoning: "medium" },
+      checkedAt: "2026-08-05T10:00:00.000Z",
+    })),
+    options: vi.fn(async () => ({
+      providers: ["zai"], models: [{ provider: "zai", id: "glm-5.2" }],
+      reasoning: ["low", "medium", "high"], checkedAt: "2026-08-05T10:00:00.000Z",
+    })),
+    configure: vi.fn(async (value) => ({ ...value, updatedAt: "2026-08-05T10:00:00.000Z" })),
+    test: vi.fn(async () => ({ ready: true, checkedAt: "2026-08-05T10:00:00.000Z" })),
+    logs: vi.fn(async () => ({ lines: ["Pi smoke check succeeded"], checkedAt: "2026-08-05T10:00:00.000Z" })),
+  };
+}
+
+function appWith(service: PiManagementService, env: Record<string, string> = {}) {
+  return buildApp(loadConfig({ THT_HARNESS_DIR: "../harness", ...env }), {
+    thtRunner: {} as any,
+    piManagement: service,
+  });
+}
+
+const adminHeaders = {
+  "x-thoth-principal-issuer": "portal",
+  "x-thoth-principal-subject": "operator",
+  "x-thoth-is-admin": "1",
+};
+
+const exposedServerEnv = {
+  AUTH_MODE: "upstream",
+  THOTH_PUBLIC_EXPOSURE: "true",
+  THT_SESSION_STORAGE: "postgres",
+  THT_SESSION_DB_HOST: "db.example.invalid",
+  THT_SESSION_DB_NAME: "thoth_sessions",
+  THT_SESSION_RUNTIME_USER: "thoth_runtime",
+  THT_SESSION_RUNTIME_PASSWORD_FILE: "/run/secrets/session-password",
+  THT_SESSION_DB_SSLMODE: "verify-full",
+  THT_SESSION_DB_SSLROOTCERT: "/run/secrets/session-ca.pem",
+};
+
+// Catches a server deployment that lets an ordinary authenticated user inspect or mutate
+// installation-wide Pi configuration without the trusted upstream admin claim.
+test("exposed upstream deployments reject Pi Management without a trusted admin identity", async () => {
+  const service = fakeService();
+  const app = appWith(service, exposedServerEnv);
+  try {
+    const response = await app.inject({
+      method: "GET", url: "/pi-management/status",
+      headers: { ...adminHeaders, "x-thoth-is-admin": "0" },
+    });
+
+    expect(response.statusCode).toBe(403);
+    expect(response.json()).toEqual({ code: "pi_management_forbidden", error: "Pi management is not permitted" });
+    expect(service.status).not.toHaveBeenCalled();
+  } finally {
+    await app.close();
+  }
+});
+
+// Catches an accidental privilege regression that blocks safe loopback-only installations or
+// returns fields beyond the sanctioned Pi Management status contract.
+test("loopback-only AUTH_MODE=none may read the sanitized Pi status", async () => {
+  const app = appWith(fakeService());
+  try {
+    const response = await app.inject({ method: "GET", url: "/pi-management/status" });
+
+    expect(response.statusCode).toBe(200);
+    expect(response.json()).toEqual({
+      version: "0.80.3", ready: true,
+      config: { provider: "zai", model: "glm-5.2", reasoning: "medium" },
+      checkedAt: "2026-08-05T10:00:00.000Z",
+    });
+  } finally {
+    await app.close();
+  }
+});
+
+// Catches route wiring that bypasses closed service validation or gives the browser a Docker/image
+// lifecycle endpoint rather than only installation-default configuration and diagnostics.
+test("trusted admins receive only configuration, smoke, options, and log endpoints", async () => {
+  const service = fakeService();
+  const app = appWith(service, exposedServerEnv);
+  try {
+    const options = await app.inject({ method: "GET", url: "/pi-management/options", headers: adminHeaders });
+    const configured = await app.inject({
+      method: "PUT", url: "/pi-management/config", headers: adminHeaders,
+      payload: { provider: "zai", model: "glm-5.2", reasoning: "high" },
+    });
+    const smoke = await app.inject({ method: "POST", url: "/pi-management/test", headers: adminHeaders });
+    const logs = await app.inject({ method: "GET", url: "/pi-management/logs", headers: adminHeaders });
+
+    expect(options.statusCode).toBe(200);
+    expect(configured.statusCode).toBe(200);
+    expect(configured.json()).toMatchObject({ provider: "zai", model: "glm-5.2", reasoning: "high" });
+    expect(smoke.statusCode).toBe(200);
+    expect(logs.statusCode).toBe(200);
+    expect(app.printRoutes()).not.toContain("update");
+    expect(app.printRoutes()).not.toContain("rollback");
+  } finally {
+    await app.close();
+  }
+});