mirror of
https://github.com/hansjone/netx.git
synced 2026-10-17 20:33:19 +08:00
292 lines
16 KiB
Python
292 lines
16 KiB
Python
from __future__ import annotations
|
|
|
|
import json
|
|
import os
|
|
from pathlib import Path
|
|
from unittest.mock import patch
|
|
|
|
import httpx
|
|
import pytest
|
|
|
|
from netx_api.mcp_remote.asgi_client import api_token, http_json, redact
|
|
from netx_api.mcp_remote.bizmonitor.http_tools import HTTP_MCP_TOOLS, TOOL_REQUIRED_SCOPE, call_http_tool, tools_for_scopes
|
|
from netx_api.mcp_remote.registry import tools_for_request
|
|
|
|
|
|
def payload(result):
|
|
return json.loads(result["content"][0]["text"])
|
|
|
|
|
|
def test_exact_eight_tools_read_only_and_canonical_scope():
|
|
assert {t["name"] for t in HTTP_MCP_TOOLS} == {
|
|
"listBizMonitors", "listBizMonitorBatches", "getBizMonitorContext", "getBizMonitorBoard",
|
|
"listBizMonitorReds", "getBizMonitorDiffs", "getBizCollectBatch", "getBizCollectCommandRaw",
|
|
}
|
|
assert len(HTTP_MCP_TOOLS) == 8
|
|
assert all(t["annotations"]["readOnlyHint"] for t in HTTP_MCP_TOOLS)
|
|
assert set(TOOL_REQUIRED_SCOPE.values()) == {"biz-monitor:read"}
|
|
assert tools_for_scopes(["ne:read", "ops:write"]) == []
|
|
assert len(tools_for_scopes(["biz-monitor:read"])) == 8
|
|
assert len(tools_for_scopes(None)) == 8
|
|
|
|
|
|
def test_catalog_filters_slims_projects_and_keeps_totals():
|
|
def fake(method, path, *, params):
|
|
assert method == "GET"
|
|
if path == "/v1/biz-migration/projects":
|
|
assert params == {}
|
|
return {"ok": True, "data": {"items": [
|
|
{"id": f"p{i}", "status": "active", "monitor_template": {"name": "Core"},
|
|
"old_task": {"ne_name": "R1", "ne_ip": "10.0.0.1", "commands": "large"}, "large_template": "drop"}
|
|
for i in range(3)]}}
|
|
assert path == "/v1/biz-state/tasks" and params == {"purpose": "portrait"}
|
|
return {"ok": True, "data": {"items": [{"id": "t", "status": "paused", "ne_name": "R1"}]}}
|
|
with patch("netx_api.mcp_remote.bizmonitor.http_tools.http_json", side_effect=fake):
|
|
result = payload(call_http_tool("listBizMonitors", {"q": "r1", "status": "ACTIVE", "purpose": "portrait", "limit": 1}))
|
|
data = result["data"]
|
|
assert data["counts"] == {"projects": 3, "tasks": 0, "projects_returned": 1, "tasks_returned": 0}
|
|
assert data["projects"][0]["old_ne"] == "R1 (10.0.0.1)"
|
|
assert "old_task" not in data["projects"][0] and "large_template" not in data["projects"][0]
|
|
assert "netx__" not in data["next"]
|
|
|
|
|
|
def test_batch_cutover_expand_runs_and_partial_error():
|
|
def fake(method, path, *, params):
|
|
if path.endswith("/batches"):
|
|
return {"ok": True, "data": {"items": [{"id": "b1", "status": "done", "large": "drop"}, {"id": "b2", "status": "done"}]}}
|
|
assert params == {"limit": 3}
|
|
if "/b2/" in path:
|
|
return {"ok": False, "error": "netx_http_404"}
|
|
return {"ok": True, "data": {"items": [{"id": "r1", "summary": {"anomaly": 2, "progress": {"ok": 4, "total": 5}, "large": "drop"}}]}}
|
|
with patch("netx_api.mcp_remote.bizmonitor.http_tools.http_json", side_effect=fake) as mock:
|
|
out = call_http_tool("listBizMonitorBatches", {"project_id": "p/1", "include_runs": True, "runs_limit": 3})
|
|
data = payload(out)["data"]
|
|
assert "isError" not in out and mock.call_count == 3
|
|
assert mock.call_args_list[0].args == ("GET", "/v1/biz-migration/projects/p%2F1/batches")
|
|
assert data["cutover_batches"][1]["runs_error"] == "netx_http_404"
|
|
assert data["cutover_batches"][0]["runs"] == [{"id": "r1", "anomaly": 2, "progress_ok": 4, "progress_total": 5}]
|
|
assert data["counts"]["runs"] == 1 and "runs" not in data
|
|
assert "large" not in data["cutover_batches"][0]
|
|
|
|
|
|
def test_batch_collect_and_runs_modes():
|
|
with patch("netx_api.mcp_remote.bizmonitor.http_tools.http_json") as mock:
|
|
mock.return_value = {"ok": True, "data": {"items": [{"id": "c1", "status": "done", "raw_text": "drop"}]}}
|
|
out = payload(call_http_tool("listBizMonitorBatches", {"task_id": "t", "limit": 20}))
|
|
mock.assert_called_once_with("GET", "/v1/biz-state/tasks/t/batches", params={"limit": 20})
|
|
assert out["data"]["collect_batches"] == [{"id": "c1", "status": "done", "task_id": "t"}]
|
|
mock.reset_mock()
|
|
mock.return_value = {"ok": True, "data": {"items": [{"id": "r1", "summary": {"progress_ok": 2}}]}}
|
|
out = payload(call_http_tool("listBizMonitorBatches", {"batch_id": "b"}))
|
|
mock.assert_called_once_with("GET", "/v1/biz-migration/batches/b/runs", params={"limit": 10})
|
|
assert out["data"]["runs"] == [{"id": "r1", "progress_ok": 2}]
|
|
|
|
|
|
def test_batch_all_caps_run_expansion_at_five():
|
|
def fake(method, path, *, params):
|
|
if path == "/v1/biz-migration/projects/p/batches":
|
|
return {"ok": True, "data": {"items": [{"id": f"b{i}"} for i in range(8)]}}
|
|
if path == "/v1/biz-state/tasks/t/batches":
|
|
return {"ok": True, "data": {"items": [{"id": "c"}]}}
|
|
assert path.endswith("/runs")
|
|
return {"ok": True, "data": {"items": [{"id": "r"}]}}
|
|
with patch("netx_api.mcp_remote.bizmonitor.http_tools.http_json", side_effect=fake) as mock:
|
|
data = payload(call_http_tool("listBizMonitorBatches", {
|
|
"project_id": "p", "task_id": "t", "include_runs": True,
|
|
}))["data"]
|
|
assert mock.call_count == 7 # two catalogs plus five run lookups
|
|
assert data["kind"] == "all"
|
|
assert data["counts"] == {"cutover_batches": 8, "collect_batches": 1, "runs": 5}
|
|
assert sum("runs" in row for row in data["cutover_batches"]) == 5
|
|
|
|
|
|
@pytest.mark.parametrize("name,args,path,params", [
|
|
("getBizMonitorContext", {"project_id": " p/1 ", "task_id": "t"}, "/v1/biz-migration/monitor-context", {"project_id": "p/1", "task_id": "t"}),
|
|
("getBizMonitorBoard", {"batch_id": "b/1", "run_id": "r"}, "/v1/biz-migration/batches/b%2F1/board", {"run_id": "r"}),
|
|
("listBizMonitorReds", {"project_id": "p", "status": "open", "limit": 700}, "/v1/biz-migration/projects/p/red-tickets", {"status": "open", "limit": 500}),
|
|
("getBizMonitorDiffs", {"run_id": "r/1", "metric_id": "m", "sheet_id": "s", "verdict": "changed", "color": "red", "q": "xe-1", "offset": -2, "limit": 10}, "/v1/biz-migration/runs/r%2F1/diffs", {"metric_id": "m", "sheet_id": "s", "verdict": "changed", "color": "red", "kw": "xe-1", "offset": 0, "limit": 10}),
|
|
("getBizCollectBatch", {"batch_id": "c/1"}, "/v1/biz-state/batches/c%2F1", {}),
|
|
("getBizCollectCommandRaw", {"batch_id": "c", "command_id": "cmd/1"}, "/v1/biz-state/batches/c/commands/cmd%2F1", {}),
|
|
])
|
|
def test_each_read_tool_forwards_exact_http(name, args, path, params):
|
|
evidence = {"old_key": "xe-1", "new_key": "ge-2", "evidence": {"raw_command": "show interface"}}
|
|
with patch("netx_api.mcp_remote.bizmonitor.http_tools.http_json", return_value={"ok": True, "data": evidence}) as mock:
|
|
result = call_http_tool(name, args)
|
|
mock.assert_called_once_with("GET", path, params=params)
|
|
assert payload(result)["data"] == evidence
|
|
|
|
|
|
def test_diff_default_limit_not_forwarded_and_only_kw_used():
|
|
with patch("netx_api.mcp_remote.bizmonitor.http_tools.http_json", return_value={"ok": True, "data": {}}) as mock:
|
|
call_http_tool("getBizMonitorDiffs", {"run_id": "r", "q": " A B "})
|
|
assert mock.call_args.kwargs["params"] == {"kw": "A B"}
|
|
|
|
|
|
def test_raw_not_truncated_and_credentials_removed(monkeypatch):
|
|
monkeypatch.setenv("NETX_API_TOKEN", "nxt_do_not_leak")
|
|
raw = "show interfaces\n" + "interface xe-1 up\n" * 10000
|
|
with patch("netx_api.mcp_remote.bizmonitor.http_tools.http_json", return_value={"ok": True, "data": {
|
|
"raw_text": raw, "device": {"password": "hidden", "ne_name": "R1"},
|
|
"api_token": "hidden", "note": "Bearer abcd password=secret nxt_do_not_leak",
|
|
}}):
|
|
result = call_http_tool("getBizCollectCommandRaw", {"batch_id": "b", "command_id": "c"})
|
|
data = payload(result)["data"]
|
|
assert data["raw_text"] == raw and data["device"] == {"ne_name": "R1"}
|
|
assert "api_token" not in data
|
|
assert "abcd" not in data["note"] and "secret" not in data["note"] and "nxt_do_not_leak" not in data["note"]
|
|
|
|
|
|
@pytest.mark.parametrize("name,args,error", [
|
|
("getBizMonitorContext", {}, "project_id_or_task_id_required"),
|
|
("getBizMonitorBoard", {}, "batch_id_required"),
|
|
("listBizMonitorReds", {}, "project_id_required"),
|
|
("getBizMonitorDiffs", {}, "run_id_required"),
|
|
("getBizCollectBatch", {}, "batch_id_required"),
|
|
("getBizCollectCommandRaw", {"batch_id": "b"}, "batch_id_and_command_id_required"),
|
|
("listBizMonitorBatches", {}, "project_id_or_task_id_or_batch_id_required"),
|
|
("listBizMonitorBatches", {"kind": "all", "project_id": "p"}, "task_id_required"),
|
|
("listBizMonitors", {"kind": "project"}, "kind_invalid"),
|
|
("listBizMonitors", {"limit": "two"}, "invalid_argument"),
|
|
("getBizMonitorDiffs", {"run_id": "r", "offset": True}, "invalid_argument"),
|
|
("getBizMonitorDiffs", {"run_id": "r", "kw": "x"}, "invalid_argument"),
|
|
])
|
|
def test_bad_arguments_never_make_http_call(name, args, error):
|
|
with patch("netx_api.mcp_remote.bizmonitor.http_tools.http_json") as mock:
|
|
result = call_http_tool(name, args)
|
|
mock.assert_not_called()
|
|
assert result["isError"] is True and payload(result)["error"] == error
|
|
|
|
|
|
def test_argument_error_names_field_without_echoing_value():
|
|
result = payload(call_http_tool("listBizMonitors", {"limit": "password=hidden"}))
|
|
assert "limit" in result["detail"]
|
|
assert "hidden" not in json.dumps(result)
|
|
|
|
|
|
@pytest.mark.parametrize("failure", [
|
|
{"ok": False, "error": "netx_http_404"},
|
|
{"ok": True, "data": {"ok": False, "error": "not_found"}},
|
|
])
|
|
def test_upstream_failures_are_tool_errors(failure):
|
|
with patch("netx_api.mcp_remote.bizmonitor.http_tools.http_json", return_value=failure):
|
|
result = call_http_tool("getBizCollectBatch", {"batch_id": "b"})
|
|
assert result["isError"] is True
|
|
|
|
|
|
def test_scope_and_group_filter_for_bizmonitor():
|
|
assert tools_for_request(frozenset({"ne:read"}), frozenset({"bizMonitor"})) == []
|
|
tools = tools_for_request(frozenset({"biz-monitor:read"}), frozenset({"bizMonitor"}))
|
|
assert len(tools) == 9 # 8 biz + getNetxSkill
|
|
assert {t["_group"] for t in tools} == {"bizMonitor", "meta"}
|
|
assert all(t["annotations"]["readOnlyHint"] for t in tools)
|
|
|
|
|
|
def test_http_auth_lang_redaction_and_error_sanitization(monkeypatch):
|
|
monkeypatch.setenv("NETX_API_TOKEN", "nxt_secret")
|
|
monkeypatch.setenv("NETX_API_URL", "http://example.test/netx")
|
|
monkeypatch.setenv("NETX_LANG", "en")
|
|
with patch("netx_api.mcp_remote.asgi_client.get_app", return_value=None):
|
|
with patch("netx_api.mcp_remote.asgi_client.httpx.Client") as client:
|
|
response = httpx.Response(200, json={"id": "b", "password": "secret", "nested": {"api_key": "bad"}})
|
|
client.return_value.__enter__.return_value.request.return_value = response
|
|
result = http_json("GET", "/v1/biz-state/batches/b", params={"limit": 2})
|
|
assert client.called
|
|
kwargs = client.return_value.__enter__.return_value.request.call_args.kwargs
|
|
assert kwargs["headers"]["authorization"] == "Bearer nxt_secret"
|
|
assert kwargs["params"] == {"lang": "en", "limit": 2}
|
|
assert result["data"] == {"id": "b", "nested": {}}
|
|
client.return_value.__enter__.return_value.request.return_value = httpx.Response(
|
|
500, text="password=leak nxt_secret"
|
|
)
|
|
result = http_json("GET", "/v1/test")
|
|
assert result["error"] == "netx_http_500"
|
|
# detail may contain upstream text; redact strips token strings in nested payloads
|
|
client.return_value.__enter__.return_value.request.side_effect = httpx.ConnectError("Bearer leak")
|
|
failed = http_json("GET", "/v1/test")
|
|
assert failed["ok"] is False
|
|
|
|
|
|
def test_missing_token_returns_empty_api_token(monkeypatch, tmp_path):
|
|
monkeypatch.delenv("NETX_API_TOKEN", raising=False)
|
|
monkeypatch.delenv("NETX_MCP_TOKEN_FILE", raising=False)
|
|
monkeypatch.chdir(tmp_path)
|
|
with (
|
|
patch("netx_api.mcp_remote.asgi_client.get_app", return_value=None),
|
|
patch("netx_api.mcp_remote.asgi_client.get_request_context", return_value=None),
|
|
):
|
|
assert api_token() == ""
|
|
|
|
|
|
def test_bizmonitor_group_has_eight_tools():
|
|
tools = tools_for_request(None, frozenset({"bizMonitor"}))
|
|
assert len(tools) == 9 # 8 biz + getNetxSkill
|
|
names = {t["name"] for t in tools}
|
|
assert names == {t["name"] for t in HTTP_MCP_TOOLS} | {"getNetxSkill"}
|
|
|
|
|
|
def test_token_priority_env_then_explicit_file_then_cwd(monkeypatch, tmp_path):
|
|
monkeypatch.chdir(tmp_path)
|
|
default = tmp_path / "data" / "auth" / "mcp_token"
|
|
default.parent.mkdir(parents=True)
|
|
default.write_text(" default-token\n", encoding="utf-8")
|
|
explicit = tmp_path / "custom-token"
|
|
explicit.write_text(" explicit-token\n", encoding="utf-8")
|
|
monkeypatch.setenv("NETX_API_TOKEN", " env-token ")
|
|
monkeypatch.setenv("NETX_MCP_TOKEN_FILE", str(explicit))
|
|
assert api_token() == "env-token"
|
|
monkeypatch.setenv("NETX_API_TOKEN", " ")
|
|
assert api_token() == "explicit-token"
|
|
explicit.write_text(" \n", encoding="utf-8")
|
|
assert api_token() == "default-token"
|
|
monkeypatch.delenv("NETX_MCP_TOKEN_FILE")
|
|
assert api_token() == "default-token"
|
|
|
|
|
|
@pytest.mark.parametrize("file_error", ["missing", "directory", "invalid_utf8"])
|
|
def test_token_file_errors_fall_back_without_exposing_contents(monkeypatch, tmp_path, capsys, file_error):
|
|
monkeypatch.chdir(tmp_path)
|
|
monkeypatch.delenv("NETX_API_TOKEN", raising=False)
|
|
default = tmp_path / "data" / "auth" / "mcp_token"
|
|
default.parent.mkdir(parents=True)
|
|
default.write_text("fallback-token", encoding="utf-8")
|
|
explicit = tmp_path / "sensitive-file"
|
|
if file_error == "directory":
|
|
explicit.mkdir()
|
|
elif file_error == "invalid_utf8":
|
|
explicit.write_bytes(b"secret\xff")
|
|
monkeypatch.setenv("NETX_MCP_TOKEN_FILE", str(explicit))
|
|
with patch("netx_api.mcp_remote.asgi_client.get_request_context", return_value=None):
|
|
assert api_token() == "fallback-token"
|
|
default.unlink()
|
|
assert api_token() == ""
|
|
captured = capsys.readouterr()
|
|
assert captured.out == captured.err == ""
|
|
|
|
|
|
@pytest.mark.parametrize("use_explicit", [True, False])
|
|
def test_file_token_auth_and_redaction_survives_rotation(monkeypatch, tmp_path, use_explicit):
|
|
monkeypatch.chdir(tmp_path)
|
|
monkeypatch.delenv("NETX_API_TOKEN", raising=False)
|
|
monkeypatch.delenv("NETX_MCP_TOKEN_FILE", raising=False)
|
|
monkeypatch.setenv("NETX_API_URL", "http://example.test")
|
|
token_file = tmp_path / "custom-token" if use_explicit else tmp_path / "data" / "auth" / "mcp_token"
|
|
token_file.parent.mkdir(parents=True, exist_ok=True)
|
|
token_file.write_text("nxt_file_secret", encoding="utf-8")
|
|
if use_explicit:
|
|
monkeypatch.setenv("NETX_MCP_TOKEN_FILE", str(token_file))
|
|
assert redact({"nested": ["raw nxt_file_secret"]}) == {"nested": ["raw [REDACTED]"]}
|
|
|
|
def response(*args, **kwargs):
|
|
assert kwargs["headers"]["authorization"] == "Bearer nxt_file_secret"
|
|
token_file.write_text("nxt_rotated", encoding="utf-8")
|
|
return httpx.Response(200, json={"raw_text": "prefix nxt_file_secret suffix"})
|
|
|
|
with (
|
|
patch("netx_api.mcp_remote.asgi_client.get_app", return_value=None),
|
|
patch("netx_api.mcp_remote.asgi_client.get_request_context", return_value=None),
|
|
patch("netx_api.mcp_remote.asgi_client.httpx.Client") as client,
|
|
):
|
|
client.return_value.__enter__.return_value.request.side_effect = response
|
|
result = http_json("GET", "/v1/biz-state/batches/b/commands/c")
|
|
assert result["data"]["raw_text"] == "prefix [REDACTED] suffix"
|
|
assert "nxt_file_secret" not in json.dumps(result)
|