feat: supervise stelloauth and cloakbrowser
This commit is contained in:
Dennis Juhler Aagaard
@@ -0,0 +1,688 @@
|
||||
from __future__ import annotations
|
||||
|
||||
import importlib.machinery
|
||||
import importlib.util
|
||||
import json
|
||||
import logging
|
||||
import signal
|
||||
import sys
|
||||
from pathlib import Path
|
||||
from types import SimpleNamespace
|
||||
|
||||
import pytest
|
||||
|
||||
|
||||
ROOT = Path(__file__).parents[1]
|
||||
SUPERVISOR_PATH = ROOT / "stelloauth/rootfs/usr/local/bin/addon-supervisor"
|
||||
|
||||
|
||||
def load_supervisor():
|
||||
loader = importlib.machinery.SourceFileLoader("addon_supervisor", str(SUPERVISOR_PATH))
|
||||
spec = importlib.util.spec_from_loader(loader.name, loader)
|
||||
assert spec is not None
|
||||
module = importlib.util.module_from_spec(spec)
|
||||
sys.modules[loader.name] = module
|
||||
loader.exec_module(module)
|
||||
return module
|
||||
|
||||
|
||||
@pytest.fixture
|
||||
def supervisor():
|
||||
return load_supervisor()
|
||||
|
||||
|
||||
def test_options_load_valid_defaults(supervisor, tmp_path: Path) -> None:
|
||||
path = tmp_path / "options.json"
|
||||
path.write_text(
|
||||
json.dumps(
|
||||
{
|
||||
"queue_timeout": "60s",
|
||||
"rate_limit_count": 5,
|
||||
"rate_limit_duration": "1h",
|
||||
}
|
||||
),
|
||||
encoding="utf-8",
|
||||
)
|
||||
|
||||
assert supervisor.load_options(path) == supervisor.Options("60s", 5, "1h")
|
||||
|
||||
|
||||
def test_environment_maps_options_and_preserves_parent(supervisor, monkeypatch) -> None:
|
||||
monkeypatch.setenv("PARENT_SENTINEL", "preserved")
|
||||
|
||||
environment = supervisor.build_environment(supervisor.Options("60s", 5, "1h"))
|
||||
|
||||
assert environment["PARENT_SENTINEL"] == "preserved"
|
||||
assert {key: environment[key] for key in (
|
||||
"CLOAK_CDP_URL",
|
||||
"CLOAK_MAX_SESSIONS",
|
||||
"CLOAK_QUEUE_TIMEOUT",
|
||||
"RATE_LIMIT_COUNT",
|
||||
"RATE_LIMIT_DURATION",
|
||||
"HTTP_ADDRESS",
|
||||
"PORT",
|
||||
"METRICS_ADDRESS",
|
||||
"METRICS_PORT",
|
||||
)} == {
|
||||
"CLOAK_CDP_URL": "http://127.0.0.1:9222",
|
||||
"CLOAK_MAX_SESSIONS": "1",
|
||||
"CLOAK_QUEUE_TIMEOUT": "60s",
|
||||
"RATE_LIMIT_COUNT": "5",
|
||||
"RATE_LIMIT_DURATION": "1h",
|
||||
"HTTP_ADDRESS": "0.0.0.0",
|
||||
"PORT": "8080",
|
||||
"METRICS_ADDRESS": "127.0.0.1",
|
||||
"METRICS_PORT": "9090",
|
||||
}
|
||||
|
||||
|
||||
@pytest.mark.parametrize(
|
||||
"content",
|
||||
[
|
||||
"{}",
|
||||
json.dumps(
|
||||
{
|
||||
"queue_timeout": "60s",
|
||||
"rate_limit_count": 5,
|
||||
"rate_limit_duration": "1h",
|
||||
"unknown-SENTINEL": "secret-SENTINEL",
|
||||
}
|
||||
),
|
||||
json.dumps({"queue_timeout": "60s", "rate_limit_count": 5}),
|
||||
json.dumps(
|
||||
{
|
||||
"queue_timeout": "0s-SENTINEL",
|
||||
"rate_limit_count": 5,
|
||||
"rate_limit_duration": "1h",
|
||||
}
|
||||
),
|
||||
json.dumps(
|
||||
{
|
||||
"queue_timeout": "60-SENTINEL",
|
||||
"rate_limit_count": 5,
|
||||
"rate_limit_duration": "1h",
|
||||
}
|
||||
),
|
||||
json.dumps(
|
||||
{
|
||||
"queue_timeout": "60s",
|
||||
"rate_limit_count": True,
|
||||
"rate_limit_duration": "1h",
|
||||
}
|
||||
),
|
||||
json.dumps(
|
||||
{
|
||||
"queue_timeout": "60s",
|
||||
"rate_limit_count": 0,
|
||||
"rate_limit_duration": "1h",
|
||||
}
|
||||
),
|
||||
json.dumps(
|
||||
{
|
||||
"queue_timeout": "60s",
|
||||
"rate_limit_count": 21,
|
||||
"rate_limit_duration": "1h",
|
||||
}
|
||||
),
|
||||
json.dumps(
|
||||
{
|
||||
"queue_timeout": "60s",
|
||||
"rate_limit_count": 5,
|
||||
"rate_limit_duration": "1-SENTINEL",
|
||||
}
|
||||
),
|
||||
'{"queue_timeout":"malformed-SENTINEL"',
|
||||
],
|
||||
)
|
||||
def test_invalid_options_raise_fixed_non_secret_error(
|
||||
supervisor, tmp_path: Path, caplog, content: str
|
||||
) -> None:
|
||||
path = tmp_path / "options.json"
|
||||
path.write_text(content, encoding="utf-8")
|
||||
|
||||
with caplog.at_level(logging.INFO), pytest.raises(
|
||||
supervisor.ConfigError, match="^Invalid add-on configuration$"
|
||||
):
|
||||
supervisor.load_options(path)
|
||||
|
||||
assert "SENTINEL" not in caplog.text
|
||||
assert "SENTINEL" not in str(sys.exc_info())
|
||||
|
||||
|
||||
def test_unreadable_options_raise_fixed_non_secret_error(
|
||||
supervisor, tmp_path: Path, caplog
|
||||
) -> None:
|
||||
missing = tmp_path / "missing-SENTINEL.json"
|
||||
|
||||
with caplog.at_level(logging.INFO), pytest.raises(
|
||||
supervisor.ConfigError, match="^Invalid add-on configuration$"
|
||||
):
|
||||
supervisor.load_options(missing)
|
||||
|
||||
assert "SENTINEL" not in caplog.text
|
||||
|
||||
|
||||
def test_invalid_options_main_logs_only_fixed_error(
|
||||
supervisor, tmp_path: Path, caplog, monkeypatch
|
||||
) -> None:
|
||||
path = tmp_path / "options.json"
|
||||
path.write_text('{"credential":"secret-SENTINEL"}', encoding="utf-8")
|
||||
monkeypatch.setattr(supervisor, "OPTIONS_PATH", path)
|
||||
|
||||
with caplog.at_level(logging.INFO):
|
||||
assert supervisor.main() == 2
|
||||
|
||||
assert caplog.messages == ["Invalid add-on configuration"]
|
||||
assert "SENTINEL" not in caplog.text
|
||||
|
||||
|
||||
def test_probe_cloak_uses_real_cdp_websocket_and_closes_profile(supervisor) -> None:
|
||||
calls: list[tuple[str, str, float]] = []
|
||||
|
||||
def request(method: str, url: str, timeout: float):
|
||||
calls.append((method, url, timeout))
|
||||
if url == supervisor.CLOAK_VERSION:
|
||||
return supervisor.HttpResponse(
|
||||
200,
|
||||
json.dumps(
|
||||
{
|
||||
"webSocketDebuggerUrl": (
|
||||
"ws://127.0.0.1:9222/devtools/browser/readiness"
|
||||
)
|
||||
}
|
||||
).encode(),
|
||||
)
|
||||
return supervisor.HttpResponse(200, b"ok")
|
||||
|
||||
supervisor.probe_cloak(request)
|
||||
|
||||
assert [(method, url) for method, url, _ in calls] == [
|
||||
("GET", supervisor.CLOAK_ROOT),
|
||||
("GET", supervisor.CLOAK_VERSION),
|
||||
("POST", supervisor.CLOAK_CLOSE),
|
||||
]
|
||||
assert all(timeout == 2.0 for _, _, timeout in calls)
|
||||
|
||||
|
||||
@pytest.mark.parametrize(
|
||||
"root_status,version_status,version_body,close_status",
|
||||
[
|
||||
(200, 200, b"{}", 200),
|
||||
(200, 200, b'{"webSocketDebuggerUrl":""}', 200),
|
||||
(200, 200, b"not-json-SENTINEL", 200),
|
||||
(
|
||||
200,
|
||||
200,
|
||||
b'{"webSocketDebuggerUrl":"ws://192.0.2.1:9222/devtools/browser/x"}',
|
||||
200,
|
||||
),
|
||||
(
|
||||
200,
|
||||
200,
|
||||
b'{"webSocketDebuggerUrl":"WS://127.0.0.1:9222/devtools/browser/x"}',
|
||||
200,
|
||||
),
|
||||
(
|
||||
503,
|
||||
200,
|
||||
b'{"webSocketDebuggerUrl":"ws://127.0.0.1:9222/devtools/browser/x"}',
|
||||
200,
|
||||
),
|
||||
(
|
||||
200,
|
||||
503,
|
||||
b'{"webSocketDebuggerUrl":"ws://127.0.0.1:9222/devtools/browser/x"}',
|
||||
200,
|
||||
),
|
||||
(
|
||||
200,
|
||||
200,
|
||||
b'{"webSocketDebuggerUrl":"ws://127.0.0.1:9222/devtools/browser/x"}',
|
||||
503,
|
||||
),
|
||||
],
|
||||
)
|
||||
def test_probe_cloak_rejects_invalid_readiness(
|
||||
supervisor, root_status, version_status, version_body, close_status
|
||||
) -> None:
|
||||
responses = {
|
||||
supervisor.CLOAK_ROOT: supervisor.HttpResponse(root_status, b"root"),
|
||||
supervisor.CLOAK_VERSION: supervisor.HttpResponse(version_status, version_body),
|
||||
supervisor.CLOAK_CLOSE: supervisor.HttpResponse(close_status, b"close"),
|
||||
}
|
||||
|
||||
with pytest.raises(supervisor.ReadinessError):
|
||||
supervisor.probe_cloak(lambda _method, url, _timeout: responses[url])
|
||||
|
||||
|
||||
def test_probe_stelloauth_requires_http_200(supervisor) -> None:
|
||||
calls = []
|
||||
|
||||
def request(method: str, url: str, timeout: float):
|
||||
calls.append((method, url, timeout))
|
||||
return supervisor.HttpResponse(200, b"SENTINEL-body-is-ignored")
|
||||
|
||||
supervisor.probe_stelloauth(request)
|
||||
assert calls == [("GET", supervisor.STELLOAUTH_ROOT, 2.0)]
|
||||
|
||||
with pytest.raises(supervisor.ReadinessError):
|
||||
supervisor.probe_stelloauth(
|
||||
lambda _method, _url, _timeout: supervisor.HttpResponse(503, b"")
|
||||
)
|
||||
|
||||
|
||||
class FakeClock:
|
||||
def __init__(self) -> None:
|
||||
self.now = 0.0
|
||||
self.sleeps: list[float] = []
|
||||
|
||||
def monotonic(self) -> float:
|
||||
return self.now
|
||||
|
||||
def sleep(self, delay: float) -> None:
|
||||
self.sleeps.append(delay)
|
||||
self.now += delay
|
||||
|
||||
|
||||
def test_readiness_backoff_starts_at_quarter_second_and_caps_at_two(supervisor) -> None:
|
||||
clock = FakeClock()
|
||||
attempts = 0
|
||||
|
||||
def probe() -> None:
|
||||
nonlocal attempts
|
||||
attempts += 1
|
||||
if attempts <= 5:
|
||||
raise OSError("transient-SENTINEL")
|
||||
|
||||
supervisor.wait_until_ready(
|
||||
"Service", probe, 60.0, lambda: False, clock.monotonic, clock.sleep
|
||||
)
|
||||
|
||||
assert clock.sleeps == [0.25, 0.5, 1.0, 2.0, 2.0]
|
||||
|
||||
|
||||
@pytest.mark.parametrize("name,timeout", [("CloakBrowser", 60.0), ("Stelloauth", 30.0)])
|
||||
def test_readiness_expires_at_service_timeout(supervisor, name: str, timeout: float) -> None:
|
||||
clock = FakeClock()
|
||||
|
||||
with pytest.raises(
|
||||
supervisor.ReadinessError, match=f"^{name} did not become ready$"
|
||||
):
|
||||
supervisor.wait_until_ready(
|
||||
name,
|
||||
lambda: (_ for _ in ()).throw(ValueError("transient-SENTINEL")),
|
||||
timeout,
|
||||
lambda: False,
|
||||
clock.monotonic,
|
||||
clock.sleep,
|
||||
)
|
||||
|
||||
assert timeout <= clock.now <= timeout + 2.0
|
||||
assert max(clock.sleeps) == 2.0
|
||||
|
||||
|
||||
def test_readiness_stop_flag_aborts_immediately(supervisor) -> None:
|
||||
clock = FakeClock()
|
||||
called = False
|
||||
|
||||
def probe() -> None:
|
||||
nonlocal called
|
||||
called = True
|
||||
|
||||
with pytest.raises(
|
||||
supervisor.ReadinessError, match="^CloakBrowser did not become ready$"
|
||||
):
|
||||
supervisor.wait_until_ready(
|
||||
"CloakBrowser", probe, 60.0, lambda: True, clock.monotonic, clock.sleep
|
||||
)
|
||||
|
||||
assert called is False
|
||||
assert clock.sleeps == []
|
||||
|
||||
|
||||
def test_probe_http_request_disables_proxies(supervisor, monkeypatch) -> None:
|
||||
observed = {}
|
||||
|
||||
class Response:
|
||||
status = 200
|
||||
|
||||
def read(self) -> bytes:
|
||||
return b"response"
|
||||
|
||||
def __enter__(self):
|
||||
return self
|
||||
|
||||
def __exit__(self, *_args):
|
||||
return None
|
||||
|
||||
class Opener:
|
||||
def open(self, request, timeout):
|
||||
observed["request"] = request
|
||||
observed["timeout"] = timeout
|
||||
return Response()
|
||||
|
||||
def build_opener(handler):
|
||||
observed["handler"] = handler
|
||||
return Opener()
|
||||
|
||||
monkeypatch.setattr(supervisor.urllib.request, "build_opener", build_opener)
|
||||
|
||||
assert supervisor.http_request("POST", "http://127.0.0.1/", 3.0) == (
|
||||
200,
|
||||
b"response",
|
||||
)
|
||||
assert observed["handler"].proxies == {}
|
||||
assert observed["request"].get_method() == "POST"
|
||||
assert observed["timeout"] == 3.0
|
||||
|
||||
|
||||
class FakeProcess:
|
||||
def __init__(self, pid: int, *, ignores_term: bool = False) -> None:
|
||||
self.pid = pid
|
||||
self.returncode: int | None = None
|
||||
self.ignores_term = ignores_term
|
||||
self.wait_calls: list[float | None] = []
|
||||
|
||||
def poll(self) -> int | None:
|
||||
return self.returncode
|
||||
|
||||
def wait(self, timeout: float | None) -> int:
|
||||
self.wait_calls.append(timeout)
|
||||
if self.returncode is None:
|
||||
self.returncode = -9
|
||||
return self.returncode
|
||||
|
||||
|
||||
def manager_harness(
|
||||
supervisor,
|
||||
tmp_path: Path,
|
||||
*,
|
||||
cloak_probe=None,
|
||||
stelloauth_probe=None,
|
||||
ignores_term: tuple[bool, bool] = (False, False),
|
||||
):
|
||||
clock = FakeClock()
|
||||
events: list[object] = []
|
||||
processes = [
|
||||
FakeProcess(1001, ignores_term=ignores_term[0]),
|
||||
FakeProcess(1002, ignores_term=ignores_term[1]),
|
||||
]
|
||||
spawned: list[FakeProcess] = []
|
||||
|
||||
def popen(command, *, env, start_new_session):
|
||||
process = processes[len(spawned)]
|
||||
spawned.append(process)
|
||||
events.append(("start", list(command), env, start_new_session))
|
||||
return process
|
||||
|
||||
def killpg(pid: int, sent_signal: int) -> None:
|
||||
events.append(("signal", pid, sent_signal))
|
||||
process = next(item for item in processes if item.pid == pid)
|
||||
if sent_signal == signal.SIGKILL or not process.ignores_term:
|
||||
process.returncode = -sent_signal
|
||||
|
||||
def default_cloak_probe() -> None:
|
||||
events.append("probe cloak")
|
||||
|
||||
def default_stelloauth_probe() -> None:
|
||||
events.append("probe stelloauth")
|
||||
|
||||
profile_path = tmp_path / "cloakserve"
|
||||
environment = {"SENSITIVE_SENTINEL": "credential-code-cookie-token-SENTINEL"}
|
||||
manager = supervisor.ProcessManager(
|
||||
environment,
|
||||
popen=popen,
|
||||
killpg=killpg,
|
||||
cloak_probe=cloak_probe or default_cloak_probe,
|
||||
stelloauth_probe=stelloauth_probe or default_stelloauth_probe,
|
||||
monotonic=clock.monotonic,
|
||||
sleep=clock.sleep,
|
||||
profile_path=profile_path,
|
||||
)
|
||||
return SimpleNamespace(
|
||||
manager=manager,
|
||||
clock=clock,
|
||||
events=events,
|
||||
processes=processes,
|
||||
spawned=spawned,
|
||||
profile_path=profile_path,
|
||||
environment=environment,
|
||||
)
|
||||
|
||||
|
||||
def test_lifecycle_startup_order_and_profiles(supervisor, tmp_path: Path, monkeypatch) -> None:
|
||||
harness = manager_harness(supervisor, tmp_path)
|
||||
harness.profile_path.mkdir()
|
||||
stale = harness.profile_path / "stale-profile"
|
||||
stale.write_text("stale", encoding="utf-8")
|
||||
|
||||
original_cloak = harness.manager._cloak_probe
|
||||
original_stelloauth = harness.manager._stelloauth_probe
|
||||
|
||||
def cloak_probe() -> None:
|
||||
assert not stale.exists()
|
||||
assert harness.profile_path.stat().st_mode & 0o777 == 0o700
|
||||
original_cloak()
|
||||
|
||||
def stelloauth_probe() -> None:
|
||||
original_stelloauth()
|
||||
harness.manager._handle_signal(signal.SIGTERM, None)
|
||||
|
||||
harness.manager._cloak_probe = cloak_probe
|
||||
harness.manager._stelloauth_probe = stelloauth_probe
|
||||
monkeypatch.setattr(supervisor.signal, "signal", lambda *_args: None)
|
||||
|
||||
assert harness.manager.run() == 0
|
||||
|
||||
starts_and_probes = [event for event in harness.events if event == "probe cloak" or event == "probe stelloauth" or (isinstance(event, tuple) and event[0] == "start")]
|
||||
assert [(event[0], event[1]) if isinstance(event, tuple) else event for event in starts_and_probes] == [
|
||||
("start", supervisor.CLOAK_COMMAND),
|
||||
"probe cloak",
|
||||
("start", supervisor.STELLOAUTH_COMMAND),
|
||||
"probe stelloauth",
|
||||
]
|
||||
for event in starts_and_probes:
|
||||
if isinstance(event, tuple):
|
||||
assert event[2] is harness.environment
|
||||
assert event[3] is True
|
||||
|
||||
|
||||
def test_cloak_readiness_failure_never_starts_stelloauth(
|
||||
supervisor, tmp_path: Path, monkeypatch
|
||||
) -> None:
|
||||
def failing_probe() -> None:
|
||||
raise supervisor.ReadinessError("secret-SENTINEL")
|
||||
|
||||
harness = manager_harness(supervisor, tmp_path, cloak_probe=failing_probe)
|
||||
monkeypatch.setattr(supervisor.signal, "signal", lambda *_args: None)
|
||||
|
||||
assert harness.manager.run() == 1
|
||||
assert len(harness.spawned) == 1
|
||||
assert harness.clock.now >= 60.0
|
||||
assert harness.processes[0].wait_calls == [None]
|
||||
|
||||
|
||||
def test_stelloauth_readiness_failure_stops_both_children(
|
||||
supervisor, tmp_path: Path, monkeypatch
|
||||
) -> None:
|
||||
def failing_probe() -> None:
|
||||
raise OSError("credential-SENTINEL")
|
||||
|
||||
harness = manager_harness(supervisor, tmp_path, stelloauth_probe=failing_probe)
|
||||
monkeypatch.setattr(supervisor.signal, "signal", lambda *_args: None)
|
||||
|
||||
assert harness.manager.run() == 1
|
||||
assert len(harness.spawned) == 2
|
||||
assert {(event[1], event[2]) for event in harness.events if event[0] == "signal"} == {
|
||||
(1001, signal.SIGTERM),
|
||||
(1002, signal.SIGTERM),
|
||||
}
|
||||
assert [process.wait_calls for process in harness.processes] == [[None], [None]]
|
||||
|
||||
|
||||
@pytest.mark.parametrize(
|
||||
"child_index,child_status,expected_status",
|
||||
[(0, 0, 1), (0, 7, 7), (1, 0, 1), (1, 9, 9)],
|
||||
)
|
||||
def test_child_exit_stops_sibling_and_returns_failure(
|
||||
supervisor,
|
||||
tmp_path: Path,
|
||||
monkeypatch,
|
||||
child_index: int,
|
||||
child_status: int,
|
||||
expected_status: int,
|
||||
) -> None:
|
||||
harness = manager_harness(supervisor, tmp_path)
|
||||
slept = False
|
||||
|
||||
def sleep(delay: float) -> None:
|
||||
nonlocal slept
|
||||
harness.clock.sleep(delay)
|
||||
if not slept:
|
||||
slept = True
|
||||
harness.processes[child_index].returncode = child_status
|
||||
|
||||
harness.manager._sleep = sleep
|
||||
monkeypatch.setattr(supervisor.signal, "signal", lambda *_args: None)
|
||||
|
||||
assert harness.manager.run() == expected_status
|
||||
sibling = harness.processes[1 - child_index]
|
||||
assert ("signal", sibling.pid, signal.SIGTERM) in harness.events
|
||||
assert [process.wait_calls for process in harness.processes] == [[None], [None]]
|
||||
|
||||
|
||||
@pytest.mark.parametrize("incoming_signal", [signal.SIGTERM, signal.SIGINT])
|
||||
def test_signal_shutdown_forwards_sigterm_and_returns_zero(
|
||||
supervisor, tmp_path: Path, monkeypatch, incoming_signal: int
|
||||
) -> None:
|
||||
harness = manager_harness(supervisor, tmp_path)
|
||||
triggered = False
|
||||
|
||||
def sleep(delay: float) -> None:
|
||||
nonlocal triggered
|
||||
if not triggered:
|
||||
triggered = True
|
||||
harness.manager._handle_signal(incoming_signal, None)
|
||||
harness.clock.sleep(delay)
|
||||
|
||||
harness.manager._sleep = sleep
|
||||
monkeypatch.setattr(supervisor.signal, "signal", lambda *_args: None)
|
||||
|
||||
assert harness.manager.run() == 0
|
||||
assert {(event[1], event[2]) for event in harness.events if event[0] == "signal"} == {
|
||||
(1001, signal.SIGTERM),
|
||||
(1002, signal.SIGTERM),
|
||||
}
|
||||
assert [process.wait_calls for process in harness.processes] == [[None], [None]]
|
||||
|
||||
|
||||
def test_signal_during_cloak_readiness_never_starts_stelloauth(
|
||||
supervisor, tmp_path: Path, monkeypatch
|
||||
) -> None:
|
||||
harness = manager_harness(supervisor, tmp_path)
|
||||
|
||||
def cloak_probe() -> None:
|
||||
harness.manager._handle_signal(signal.SIGTERM, None)
|
||||
|
||||
harness.manager._cloak_probe = cloak_probe
|
||||
monkeypatch.setattr(supervisor.signal, "signal", lambda *_args: None)
|
||||
|
||||
assert harness.manager.run() == 0
|
||||
assert len(harness.spawned) == 1
|
||||
assert ("signal", 1001, signal.SIGTERM) in harness.events
|
||||
assert harness.processes[0].wait_calls == [None]
|
||||
|
||||
|
||||
def test_child_exit_during_cloak_readiness_never_starts_stelloauth(
|
||||
supervisor, tmp_path: Path, monkeypatch
|
||||
) -> None:
|
||||
harness = manager_harness(supervisor, tmp_path)
|
||||
|
||||
def cloak_probe() -> None:
|
||||
harness.processes[0].returncode = 7
|
||||
|
||||
harness.manager._cloak_probe = cloak_probe
|
||||
monkeypatch.setattr(supervisor.signal, "signal", lambda *_args: None)
|
||||
|
||||
assert harness.manager.run() == 7
|
||||
assert len(harness.spawned) == 1
|
||||
assert harness.processes[0].wait_calls == [None]
|
||||
|
||||
|
||||
def test_signal_while_starting_child_still_terminates_new_process_group(
|
||||
supervisor, tmp_path: Path, monkeypatch
|
||||
) -> None:
|
||||
harness = manager_harness(supervisor, tmp_path)
|
||||
original_popen = harness.manager._popen
|
||||
starts = 0
|
||||
|
||||
def popen(command, *, env, start_new_session):
|
||||
nonlocal starts
|
||||
starts += 1
|
||||
if starts == 2:
|
||||
harness.manager._handle_signal(signal.SIGTERM, None)
|
||||
return original_popen(command, env=env, start_new_session=start_new_session)
|
||||
|
||||
harness.manager._popen = popen
|
||||
monkeypatch.setattr(supervisor.signal, "signal", lambda *_args: None)
|
||||
|
||||
assert harness.manager.run() == 0
|
||||
assert ("signal", 1002, signal.SIGTERM) in harness.events
|
||||
assert [process.wait_calls for process in harness.processes] == [[None], [None]]
|
||||
|
||||
|
||||
def test_shutdown_uses_one_ten_second_deadline_then_sigkills_remaining_groups(
|
||||
supervisor, tmp_path: Path, monkeypatch
|
||||
) -> None:
|
||||
harness = manager_harness(supervisor, tmp_path, ignores_term=(True, True))
|
||||
triggered = False
|
||||
|
||||
def sleep(delay: float) -> None:
|
||||
nonlocal triggered
|
||||
if not triggered:
|
||||
triggered = True
|
||||
harness.manager._handle_signal(signal.SIGTERM, None)
|
||||
harness.clock.sleep(delay)
|
||||
|
||||
harness.manager._sleep = sleep
|
||||
monkeypatch.setattr(supervisor.signal, "signal", lambda *_args: None)
|
||||
|
||||
assert harness.manager.run() == 0
|
||||
assert harness.clock.now == pytest.approx(10.0)
|
||||
assert [
|
||||
(event[1], event[2]) for event in harness.events if event[0] == "signal"
|
||||
] == [
|
||||
(1001, signal.SIGTERM),
|
||||
(1002, signal.SIGTERM),
|
||||
(1001, signal.SIGKILL),
|
||||
(1002, signal.SIGKILL),
|
||||
]
|
||||
assert [process.wait_calls for process in harness.processes] == [[None], [None]]
|
||||
|
||||
|
||||
def test_lifecycle_logs_are_fixed_and_contain_no_sensitive_values(
|
||||
supervisor, tmp_path: Path, monkeypatch, caplog
|
||||
) -> None:
|
||||
harness = manager_harness(supervisor, tmp_path)
|
||||
|
||||
def stelloauth_probe() -> None:
|
||||
harness.manager._handle_signal(signal.SIGTERM, None)
|
||||
|
||||
harness.manager._stelloauth_probe = stelloauth_probe
|
||||
monkeypatch.setattr(supervisor.signal, "signal", lambda *_args: None)
|
||||
|
||||
with caplog.at_level(logging.INFO):
|
||||
assert harness.manager.run() == 0
|
||||
|
||||
assert caplog.messages == [
|
||||
"Cleaning CloakBrowser profiles",
|
||||
"Starting CloakBrowser",
|
||||
"CloakBrowser ready",
|
||||
"Starting Stelloauth",
|
||||
"Shutdown requested",
|
||||
"Stopping child processes",
|
||||
"Child processes stopped",
|
||||
]
|
||||
lowered = caplog.text.lower()
|
||||
for sensitive in ("sentinel", "credential", "code", "cookie", "token"):
|
||||
assert sensitive not in lowered
|
||||
Reference in New Issue
Block a user