514 lines
18 KiB
Python
514 lines
18 KiB
Python
"""Upload preflight: credentials, scope, readiness, and tokens (US05-01).
|
|
|
|
Every external boundary is faked but never mocked away: the uploader is a real
|
|
executable on disk invoked through ``subprocess``, and the Immich server is a real
|
|
localhost HTTP server answering ``/api/server/ping``. Preflight itself must stay
|
|
read-only — the library snapshot is asserted unchanged.
|
|
"""
|
|
|
|
import json
|
|
import stat
|
|
import threading
|
|
import uuid
|
|
from datetime import datetime, timezone
|
|
from http.server import BaseHTTPRequestHandler, HTTPServer
|
|
|
|
import pytest
|
|
from fastapi.testclient import TestClient
|
|
|
|
from photo_pipeline.api.app import create_app
|
|
from photo_pipeline.config import Config
|
|
from photo_pipeline.db import create_db_engine, create_session_factory, run_migrations
|
|
from photo_pipeline.models import (
|
|
AnalysisResult,
|
|
Asset,
|
|
RenameOperation,
|
|
RenamePlan,
|
|
SafetyReview,
|
|
)
|
|
from photo_pipeline.services.hashing import sha256_file
|
|
from photo_pipeline.services.uploads import UploadError, UploadService
|
|
|
|
pytestmark = pytest.mark.phase_e # part of the Phase E acceptance gate (US05-06)
|
|
|
|
NOW = datetime(2026, 1, 1, tzinfo=timezone.utc)
|
|
# A sentinel credential: every assertion below proves it never leaves configuration.
|
|
SENTINEL_KEY = "immich-sentinel-9f3a2b"
|
|
UPLOADER_VERSION = "immich-go 0.21.0"
|
|
|
|
|
|
# ── fake external boundary ───────────────────────────────────────────────────
|
|
|
|
|
|
class _PingHandler(BaseHTTPRequestHandler):
|
|
payload = b'{"res":"pong"}'
|
|
status = 200
|
|
|
|
def do_GET(self): # noqa: N802 (BaseHTTPRequestHandler API)
|
|
self.send_response(type(self).status)
|
|
self.send_header("Content-Type", "application/json")
|
|
self.end_headers()
|
|
self.wfile.write(type(self).payload)
|
|
|
|
def log_message(self, *args):
|
|
pass # keep the test output clean
|
|
|
|
|
|
@pytest.fixture
|
|
def immich_server():
|
|
"""A real HTTP server that answers like Immich. Yields its base URL."""
|
|
handler = type("Handler", (_PingHandler,), {})
|
|
server = HTTPServer(("127.0.0.1", 0), handler)
|
|
thread = threading.Thread(target=server.serve_forever, daemon=True)
|
|
thread.start()
|
|
yield f"http://127.0.0.1:{server.server_port}", handler
|
|
server.shutdown()
|
|
server.server_close()
|
|
|
|
|
|
def _fake_uploader(tmp_path):
|
|
"""A real executable standing in for immich-go."""
|
|
path = tmp_path / "immich-go"
|
|
path.write_text(f"#!/bin/sh\necho '{UPLOADER_VERSION}'\n")
|
|
path.chmod(path.stat().st_mode | stat.S_IEXEC | stat.S_IXGRP | stat.S_IXOTH)
|
|
return path
|
|
|
|
|
|
# ── environment ──────────────────────────────────────────────────────────────
|
|
|
|
|
|
def _env(tmp_path, server_url, *, credential=SENTINEL_KEY, uploader=None):
|
|
(tmp_path / "data").mkdir(exist_ok=True)
|
|
lib = tmp_path / "lib"
|
|
lib.mkdir(exist_ok=True)
|
|
env = {
|
|
"PHOTO_PIPELINE_DATA_DIR": str(tmp_path / "data"),
|
|
"PHOTO_PIPELINE_LIBRARY_ROOTS": str(lib),
|
|
"PHOTO_PIPELINE_IMMICH_SERVER_URL": server_url,
|
|
"PHOTO_PIPELINE_IMMICH_GO_BINARY": str(
|
|
uploader if uploader is not None else _fake_uploader(tmp_path)
|
|
),
|
|
}
|
|
if credential:
|
|
env["PHOTO_PIPELINE_IMMICH_API_KEY"] = credential
|
|
config = Config.from_env(env)
|
|
run_migrations(config.database_url)
|
|
return config, create_session_factory(create_db_engine(config.database_url)), lib
|
|
|
|
|
|
def _album(
|
|
sf,
|
|
lib,
|
|
album="rome",
|
|
names=("a.jpg", "b.jpg"),
|
|
*,
|
|
decision="sfw",
|
|
exif_verified=True,
|
|
analyzed=True,
|
|
):
|
|
"""A real album folder with registered, stage-complete assets."""
|
|
folder = lib / album
|
|
folder.mkdir(parents=True, exist_ok=True)
|
|
ids = []
|
|
with sf() as session:
|
|
for name in names:
|
|
path = folder / name
|
|
path.write_bytes(name.encode() * 16)
|
|
asset_id = str(uuid.uuid4())
|
|
ids.append(asset_id)
|
|
session.add(
|
|
Asset(
|
|
id=asset_id,
|
|
original_path=str(path),
|
|
current_path=str(path),
|
|
discovered_at=NOW,
|
|
hash_version=1,
|
|
byte_size=path.stat().st_size,
|
|
current_sha256=sha256_file(path),
|
|
)
|
|
)
|
|
if decision is not None:
|
|
session.add(
|
|
SafetyReview(
|
|
id=str(uuid.uuid4()),
|
|
asset_id=asset_id,
|
|
decision=decision,
|
|
exif_verified_at=NOW if exif_verified else None,
|
|
)
|
|
)
|
|
if analyzed:
|
|
session.add(
|
|
AnalysisResult(
|
|
asset_id=asset_id,
|
|
status="analyzed",
|
|
exif_written_at=NOW,
|
|
)
|
|
)
|
|
session.commit()
|
|
return folder, ids
|
|
|
|
|
|
def _snapshot(lib):
|
|
return {
|
|
str(p.relative_to(lib)): (p.read_bytes() if p.is_file() else None)
|
|
for p in sorted(lib.rglob("*"))
|
|
}
|
|
|
|
|
|
def _service(sf, config):
|
|
return UploadService(sf, config=config)
|
|
|
|
|
|
def _codes(report):
|
|
return {issue["code"] for issue in report["blockers"]} | {
|
|
issue["code"] for album in report["albums"] for issue in album["blockers"]
|
|
} | {
|
|
issue["code"]
|
|
for album in report["albums"]
|
|
for asset in album["assets"]
|
|
for issue in asset["blockers"]
|
|
}
|
|
|
|
|
|
# ── happy path ───────────────────────────────────────────────────────────────
|
|
|
|
|
|
def test_ready_preflight_reports_scope_command_and_hashes(tmp_path, immich_server):
|
|
url, _ = immich_server
|
|
config, sf, lib = _env(tmp_path, url)
|
|
folder, ids = _album(sf, lib)
|
|
before = _snapshot(lib)
|
|
|
|
report = _service(sf, config).preflight()
|
|
|
|
assert report["state"] == "ready" and report["blockers"] == []
|
|
assert report["server"]["reachable"] is True
|
|
assert report["uploader"]["installed"] is True
|
|
assert report["uploader"]["version"] == UPLOADER_VERSION
|
|
assert report["credentials"]["api_key_configured"] is True
|
|
assert report["totals"] == {
|
|
"albums": 1,
|
|
"ready_albums": 1,
|
|
"assets": 2,
|
|
"eligible": 2,
|
|
"blocked": 0,
|
|
}
|
|
album = report["albums"][0]
|
|
assert album["album"] == "rome" and album["folder"] == str(folder)
|
|
assert album["album_name"] == "rome" # folder-as-album
|
|
assert album["partial"] is False and album["state"] == "ready"
|
|
assert sorted(a["asset_id"] for a in album["assets"]) == sorted(ids)
|
|
# Hashes are of the bytes on disk right now, not a remembered value.
|
|
for asset in album["assets"]:
|
|
assert asset["current_sha256"] == sha256_file(asset["current_path"])
|
|
assert report["token"].startswith("v1:")
|
|
assert _snapshot(lib) == before, "preflight must not touch the library"
|
|
|
|
|
|
def test_command_preview_shows_folder_and_album_without_the_key(tmp_path, immich_server):
|
|
url, _ = immich_server
|
|
config, sf, lib = _env(tmp_path, url)
|
|
folder, _ = _album(sf, lib)
|
|
|
|
preview = _service(sf, config).preflight()["albums"][0]["command_preview"]
|
|
|
|
assert f"--api-key={'***'}" in preview
|
|
assert "--album-name=rome" in preview
|
|
assert str(folder) in preview
|
|
assert SENTINEL_KEY not in " ".join(preview)
|
|
|
|
|
|
def test_scoping_to_one_album_excludes_the_others(tmp_path, immich_server):
|
|
url, _ = immich_server
|
|
config, sf, lib = _env(tmp_path, url)
|
|
_album(sf, lib, "rome")
|
|
_album(sf, lib, "paris", names=("c.jpg",))
|
|
|
|
report = _service(sf, config).preflight(["paris"])
|
|
|
|
assert [album["album"] for album in report["albums"]] == ["paris"]
|
|
assert report["totals"]["assets"] == 1
|
|
|
|
|
|
def test_unknown_album_in_scope_is_refused(tmp_path, immich_server):
|
|
url, _ = immich_server
|
|
config, sf, lib = _env(tmp_path, url)
|
|
_album(sf, lib, "rome")
|
|
|
|
with pytest.raises(UploadError):
|
|
_service(sf, config).preflight(["atlantis"])
|
|
|
|
|
|
def test_empty_scope_is_a_blocker(tmp_path, immich_server):
|
|
url, _ = immich_server
|
|
config, sf, _ = _env(tmp_path, url)
|
|
|
|
report = _service(sf, config).preflight()
|
|
|
|
assert report["state"] == "blocked" and "empty_scope" in _codes(report)
|
|
|
|
|
|
# ── credentials and environment ──────────────────────────────────────────────
|
|
|
|
|
|
def test_missing_api_key_blocks_without_touching_the_server(tmp_path, immich_server):
|
|
url, _ = immich_server
|
|
config, sf, lib = _env(tmp_path, url, credential=None)
|
|
_album(sf, lib)
|
|
|
|
report = _service(sf, config).preflight()
|
|
|
|
assert report["state"] == "blocked"
|
|
assert "credentials_missing" in _codes(report)
|
|
assert report["credentials"]["api_key_configured"] is False
|
|
|
|
|
|
def test_unreachable_server_blocks(tmp_path, immich_server):
|
|
url, _ = immich_server
|
|
config, sf, lib = _env(tmp_path, url.replace(url.rsplit(":", 1)[-1], "1"))
|
|
_album(sf, lib)
|
|
|
|
report = _service(sf, config).preflight()
|
|
|
|
assert "server_unreachable" in _codes(report)
|
|
assert report["server"]["reachable"] is False and report["server"]["detail"]
|
|
|
|
|
|
def test_server_that_is_not_immich_blocks(tmp_path, immich_server):
|
|
url, handler = immich_server
|
|
handler.payload = b'{"error":"unauthorized"}'
|
|
handler.status = 401
|
|
config, sf, lib = _env(tmp_path, url)
|
|
_album(sf, lib)
|
|
|
|
assert "server_unreachable" in _codes(_service(sf, config).preflight())
|
|
|
|
|
|
def test_missing_uploader_blocks(tmp_path, immich_server):
|
|
url, _ = immich_server
|
|
config, sf, lib = _env(tmp_path, url, uploader=tmp_path / "does-not-exist")
|
|
_album(sf, lib)
|
|
|
|
report = _service(sf, config).preflight()
|
|
|
|
assert "immich_go_missing" in _codes(report)
|
|
assert report["uploader"]["installed"] is False and report["uploader"]["version"] is None
|
|
|
|
|
|
def test_half_applied_rename_blocks_upload(tmp_path, immich_server):
|
|
"""Album paths must be final before upload: an operation that may have already
|
|
touched the disk blocks every other mutation until it is recovered (US04-04)."""
|
|
url, _ = immich_server
|
|
config, sf, lib = _env(tmp_path, url)
|
|
folder, _ = _album(sf, lib)
|
|
with sf() as session:
|
|
plan_id = str(uuid.uuid4())
|
|
session.add(RenamePlan(id=plan_id, state="applying", operation_count=1))
|
|
session.flush()
|
|
session.add(
|
|
RenameOperation(
|
|
id=str(uuid.uuid4()),
|
|
plan_id=plan_id,
|
|
sequence=0,
|
|
operation="move_folder",
|
|
source_path=str(folder),
|
|
destination_path=str(lib / "2019 Rome"),
|
|
journal_state="moving",
|
|
)
|
|
)
|
|
session.commit()
|
|
|
|
report = _service(sf, config).preflight()
|
|
|
|
assert report["state"] == "blocked" and "rename_pending" in _codes(report)
|
|
|
|
|
|
def test_no_secret_appears_anywhere_in_the_report(tmp_path, immich_server):
|
|
url, _ = immich_server
|
|
config, sf, lib = _env(tmp_path, url)
|
|
_album(sf, lib)
|
|
|
|
report = _service(sf, config).preflight()
|
|
|
|
assert SENTINEL_KEY not in json.dumps(report, default=str)
|
|
|
|
|
|
# ── stage readiness ──────────────────────────────────────────────────────────
|
|
|
|
|
|
@pytest.mark.parametrize(
|
|
"kwargs,code",
|
|
[
|
|
({"decision": None}, "safety_undecided"),
|
|
({"decision": "deferred"}, "safety_deferred"),
|
|
({"exif_verified": False}, "safety_exif_unverified"),
|
|
({"analyzed": False}, "analysis_incomplete"),
|
|
],
|
|
)
|
|
def test_blocked_stage_blocks_upload(tmp_path, immich_server, kwargs, code):
|
|
url, _ = immich_server
|
|
config, sf, lib = _env(tmp_path, url)
|
|
_album(sf, lib, **kwargs)
|
|
|
|
report = _service(sf, config).preflight()
|
|
|
|
assert report["state"] == "blocked"
|
|
assert code in _codes(report)
|
|
assert report["albums"][0]["eligible_count"] == 0
|
|
|
|
|
|
def test_reviewed_nsfw_asset_is_upload_eligible_without_analysis(tmp_path, immich_server):
|
|
"""NSFW never reaches the analyser, but a verified nsfw keyword makes it
|
|
uploadable (concept §8 eligibility table)."""
|
|
url, _ = immich_server
|
|
config, sf, lib = _env(tmp_path, url)
|
|
_album(sf, lib, decision="nsfw", analyzed=False)
|
|
|
|
report = _service(sf, config).preflight()
|
|
|
|
assert report["state"] == "ready"
|
|
assert report["albums"][0]["eligible_count"] == 2
|
|
|
|
|
|
def test_changed_bytes_block_the_album(tmp_path, immich_server):
|
|
url, _ = immich_server
|
|
config, sf, lib = _env(tmp_path, url)
|
|
folder, _ = _album(sf, lib)
|
|
(folder / "a.jpg").write_bytes(b"edited after the checkpoint")
|
|
|
|
report = _service(sf, config).preflight()
|
|
|
|
assert "bytes_changed" in _codes(report)
|
|
assert report["albums"][0]["blocked_count"] == 1
|
|
|
|
|
|
def test_missing_file_blocks_the_album(tmp_path, immich_server):
|
|
url, _ = immich_server
|
|
config, sf, lib = _env(tmp_path, url)
|
|
folder, _ = _album(sf, lib)
|
|
(folder / "a.jpg").unlink()
|
|
|
|
assert "file_missing" in _codes(_service(sf, config).preflight())
|
|
|
|
|
|
# ── partial scope ────────────────────────────────────────────────────────────
|
|
|
|
|
|
def test_partial_album_is_blocked_until_explicitly_approved(tmp_path, immich_server):
|
|
url, _ = immich_server
|
|
config, sf, lib = _env(tmp_path, url)
|
|
folder, _ = _album(sf, lib)
|
|
(folder / "a.jpg").write_bytes(b"changed")
|
|
|
|
blocked = _service(sf, config).preflight()
|
|
approved = _service(sf, config).preflight(allow_partial=True)
|
|
|
|
assert blocked["state"] == "blocked"
|
|
assert "partial_scope" in {issue["code"] for issue in blocked["albums"][0]["blockers"]}
|
|
assert approved["state"] == "ready"
|
|
assert approved["albums"][0]["partial"] is True
|
|
assert approved["albums"][0]["eligible_count"] == 1
|
|
# The approval is part of the token, so it can never be replayed as a full run.
|
|
assert approved["token"] != blocked["token"]
|
|
|
|
|
|
def test_partial_approval_cannot_rescue_an_album_with_nothing_ready(tmp_path, immich_server):
|
|
url, _ = immich_server
|
|
config, sf, lib = _env(tmp_path, url)
|
|
_album(sf, lib, decision=None)
|
|
|
|
report = _service(sf, config).preflight(allow_partial=True)
|
|
|
|
assert report["state"] == "blocked"
|
|
assert "empty_scope" in {issue["code"] for issue in report["albums"][0]["blockers"]}
|
|
|
|
|
|
# ── token ────────────────────────────────────────────────────────────────────
|
|
|
|
|
|
def test_token_is_stable_while_nothing_relevant_changes(tmp_path, immich_server):
|
|
url, _ = immich_server
|
|
config, sf, lib = _env(tmp_path, url)
|
|
_album(sf, lib)
|
|
service = _service(sf, config)
|
|
|
|
first = service.preflight()["token"]
|
|
|
|
assert service.preflight()["token"] == first
|
|
assert service.verify_token(first) is True
|
|
|
|
|
|
@pytest.mark.parametrize("scope", [None, ["rome"]])
|
|
def test_edited_bytes_make_the_token_stale(tmp_path, immich_server, scope):
|
|
url, _ = immich_server
|
|
config, sf, lib = _env(tmp_path, url)
|
|
folder, _ = _album(sf, lib)
|
|
service = _service(sf, config)
|
|
token = service.preflight(scope)["token"]
|
|
|
|
(folder / "b.jpg").write_bytes(b"edited outside the app")
|
|
|
|
assert service.verify_token(token, scope) is False
|
|
|
|
|
|
def test_changed_decision_makes_the_token_stale(tmp_path, immich_server):
|
|
url, _ = immich_server
|
|
config, sf, lib = _env(tmp_path, url)
|
|
_, ids = _album(sf, lib)
|
|
service = _service(sf, config)
|
|
token = service.preflight()["token"]
|
|
|
|
with sf() as session:
|
|
session.add(
|
|
SafetyReview(
|
|
id=str(uuid.uuid4()),
|
|
asset_id=ids[0],
|
|
decision="deferred",
|
|
created_at=datetime(2099, 1, 1, tzinfo=timezone.utc), # the latest review wins
|
|
)
|
|
)
|
|
session.commit()
|
|
|
|
assert service.verify_token(token) is False
|
|
|
|
|
|
def test_token_from_a_different_scope_is_rejected(tmp_path, immich_server):
|
|
url, _ = immich_server
|
|
config, sf, lib = _env(tmp_path, url)
|
|
_album(sf, lib, "rome")
|
|
_album(sf, lib, "paris", names=("c.jpg",))
|
|
service = _service(sf, config)
|
|
|
|
assert service.verify_token(service.preflight(["rome"])["token"], ["paris"]) is False
|
|
assert service.verify_token("v1:not-a-real-token") is False
|
|
assert service.verify_token("") is False
|
|
|
|
|
|
# ── API surface ──────────────────────────────────────────────────────────────
|
|
|
|
|
|
def test_api_preflight_returns_the_report_without_secrets(tmp_path, immich_server):
|
|
url, _ = immich_server
|
|
config, sf, lib = _env(tmp_path, url)
|
|
_album(sf, lib)
|
|
|
|
with TestClient(create_app(config)) as client:
|
|
response = client.post("/api/v1/upload-preflight", json={})
|
|
|
|
assert response.status_code == 200
|
|
body = response.json()
|
|
assert body["state"] == "ready" and body["token"].startswith("v1:")
|
|
assert SENTINEL_KEY not in response.text
|
|
|
|
|
|
def test_api_rejects_an_unknown_album(tmp_path, immich_server):
|
|
url, _ = immich_server
|
|
config, sf, lib = _env(tmp_path, url)
|
|
_album(sf, lib)
|
|
|
|
with TestClient(create_app(config)) as client:
|
|
response = client.post("/api/v1/upload-preflight", json={"albums": ["atlantis"]})
|
|
|
|
assert response.status_code == 422
|
|
assert response.json()["error"]["code"] == "unknown_album"
|