From 094f3af43f575fb85b446ce19eb080535340a426 Mon Sep 17 00:00:00 2001 From: Pulkit Chauhan Date: Wed, 17 Jun 2026 12:52:58 +0530 Subject: [PATCH] Implement REST API Endpoints --- migrations/versions/d4f8e2a1b3c7_.py | 44 + mod_api/__init__.py | 27 + mod_api/middleware/__init__.py | 1 + mod_api/middleware/auth.py | 131 + mod_api/middleware/error_handler.py | 144 + mod_api/middleware/rate_limit.py | 133 + mod_api/middleware/security.py | 11 + mod_api/middleware/validation.py | 325 +++ mod_api/models/__init__.py | 1 + mod_api/models/api_token.py | 141 + mod_api/routes/__init__.py | 1 + mod_api/routes/auth.py | 200 ++ mod_api/routes/errors_logs.py | 193 ++ mod_api/routes/results.py | 457 ++++ mod_api/routes/runs.py | 528 ++++ mod_api/routes/samples.py | 509 ++++ mod_api/routes/system.py | 333 +++ mod_api/schemas/__init__.py | 1 + mod_api/schemas/auth.py | 69 + mod_api/schemas/common.py | 27 + mod_api/schemas/errors.py | 54 + mod_api/schemas/results.py | 91 + mod_api/schemas/runs.py | 120 + mod_api/schemas/samples.py | 71 + mod_api/schemas/system.py | 63 + mod_api/services/__init__.py | 1 + mod_api/services/diff_service.py | 205 ++ mod_api/services/error_service.py | 223 ++ mod_api/services/log_service.py | 121 + mod_api/services/status.py | 214 ++ mod_api/services/storage.py | 65 + mod_api/utils.py | 72 + mod_auth/controllers.py | 27 +- mod_auth/models.py | 1 + openapi-ci-api.yaml | 2840 ++++++++++++++++++++ requirements.txt | 3 + run.py | 3 + tests/api/__init__.py | 1 + tests/api/conftest.py | 22 + tests/api/test_middleware_auth.py | 176 ++ tests/api/test_middleware_error_handler.py | 95 + tests/api/test_middleware_rate_limit.py | 164 ++ tests/api/test_middleware_validation.py | 257 ++ tests/api/test_models_api_token.py | 71 + tests/api/test_routes_auth.py | 277 ++ tests/api/test_routes_errors_logs.py | 276 ++ tests/api/test_routes_results.py | 321 +++ tests/api/test_routes_runs.py | 344 +++ tests/api/test_routes_samples.py | 196 ++ tests/api/test_routes_system.py | 172 ++ tests/api/test_services_diff_service.py | 126 + tests/api/test_services_error_service.py | 173 ++ tests/api/test_services_log_service.py | 124 + tests/api/test_services_status.py | 138 + tests/api/test_services_storage.py | 130 + tests/api/test_utils.py | 70 + tests/api/verify_schemathesis.py | 938 +++++++ 57 files changed, 11516 insertions(+), 5 deletions(-) create mode 100644 migrations/versions/d4f8e2a1b3c7_.py create mode 100644 mod_api/__init__.py create mode 100644 mod_api/middleware/__init__.py create mode 100644 mod_api/middleware/auth.py create mode 100644 mod_api/middleware/error_handler.py create mode 100644 mod_api/middleware/rate_limit.py create mode 100644 mod_api/middleware/security.py create mode 100644 mod_api/middleware/validation.py create mode 100644 mod_api/models/__init__.py create mode 100644 mod_api/models/api_token.py create mode 100644 mod_api/routes/__init__.py create mode 100644 mod_api/routes/auth.py create mode 100644 mod_api/routes/errors_logs.py create mode 100644 mod_api/routes/results.py create mode 100644 mod_api/routes/runs.py create mode 100644 mod_api/routes/samples.py create mode 100644 mod_api/routes/system.py create mode 100644 mod_api/schemas/__init__.py create mode 100644 mod_api/schemas/auth.py create mode 100644 mod_api/schemas/common.py create mode 100644 mod_api/schemas/errors.py create mode 100644 mod_api/schemas/results.py create mode 100644 mod_api/schemas/runs.py create mode 100644 mod_api/schemas/samples.py create mode 100644 mod_api/schemas/system.py create mode 100644 mod_api/services/__init__.py create mode 100644 mod_api/services/diff_service.py create mode 100644 mod_api/services/error_service.py create mode 100644 mod_api/services/log_service.py create mode 100644 mod_api/services/status.py create mode 100644 mod_api/services/storage.py create mode 100644 mod_api/utils.py create mode 100644 openapi-ci-api.yaml create mode 100644 tests/api/__init__.py create mode 100644 tests/api/conftest.py create mode 100644 tests/api/test_middleware_auth.py create mode 100644 tests/api/test_middleware_error_handler.py create mode 100644 tests/api/test_middleware_rate_limit.py create mode 100644 tests/api/test_middleware_validation.py create mode 100644 tests/api/test_models_api_token.py create mode 100644 tests/api/test_routes_auth.py create mode 100644 tests/api/test_routes_errors_logs.py create mode 100644 tests/api/test_routes_results.py create mode 100644 tests/api/test_routes_runs.py create mode 100644 tests/api/test_routes_samples.py create mode 100644 tests/api/test_routes_system.py create mode 100644 tests/api/test_services_diff_service.py create mode 100644 tests/api/test_services_error_service.py create mode 100644 tests/api/test_services_log_service.py create mode 100644 tests/api/test_services_status.py create mode 100644 tests/api/test_services_storage.py create mode 100644 tests/api/test_utils.py create mode 100644 tests/api/verify_schemathesis.py diff --git a/migrations/versions/d4f8e2a1b3c7_.py b/migrations/versions/d4f8e2a1b3c7_.py new file mode 100644 index 000000000..e84d0302e --- /dev/null +++ b/migrations/versions/d4f8e2a1b3c7_.py @@ -0,0 +1,44 @@ +"""Add api_token table for scoped API token auth. + +Revision ID: d4f8e2a1b3c7 +Revises: c8f3a2b1d4e5 +Create Date: 2026-06-11 03:00:00.000000 + +""" +import sqlalchemy as sa +from alembic import op + +# revision identifiers, used by Alembic. +revision = 'd4f8e2a1b3c7' +down_revision = 'c8f3a2b1d4e5' +branch_labels = None +depends_on = None + + +def upgrade(): + """Apply the migration.""" + op.add_column('user', sa.Column('github_login', sa.String(length=255), nullable=True)) + op.create_table( + 'api_token', + sa.Column('id', sa.Integer(), nullable=False, autoincrement=True), + sa.Column('user_id', sa.Integer(), nullable=False), + sa.Column('token_name', sa.String(length=50), nullable=False), + sa.Column('token_hash', sa.String(length=255), nullable=False), + sa.Column('token_prefix', sa.String(length=16), nullable=False), + sa.Column('scopes_json', sa.Text(), nullable=False), + sa.Column('created_at', sa.DateTime(timezone=True), nullable=False), + sa.Column('expires_at', sa.DateTime(timezone=True), nullable=False), + sa.Column('revoked_at', sa.DateTime(timezone=True), nullable=True), + sa.PrimaryKeyConstraint('id'), + sa.ForeignKeyConstraint(['user_id'], ['user.id'], onupdate='CASCADE', ondelete='CASCADE'), + sa.UniqueConstraint('user_id', 'token_name', name='uq_user_token_name'), + mysql_engine='InnoDB' + ) + op.create_index('ix_api_token_token_prefix', 'api_token', ['token_prefix']) + + +def downgrade(): + """Revert the migration.""" + op.drop_index('ix_api_token_token_prefix', table_name='api_token') + op.drop_table('api_token') + op.drop_column('user', 'github_login') diff --git a/mod_api/__init__.py b/mod_api/__init__.py new file mode 100644 index 000000000..966c11da5 --- /dev/null +++ b/mod_api/__init__.py @@ -0,0 +1,27 @@ +""" +mod_api: JSON REST API blueprint for the CCExtractor CI platform. + +Registered at /api/v1. All endpoints return structured JSON, use scoped +Bearer token auth, and enforce per-client rate limiting. +""" + +from flask import Blueprint + +mod_api = Blueprint('api', __name__) + +# Middleware (registers before_request hooks and error handlers) +# WARNING: auth must be imported before rate_limit. The auth middleware +# manually calls check_rate_limit() for unauthenticated paths. If +# rate_limit is imported first, its before_request hook fires first and +# the auth middleware's manual call would double-count requests. +from mod_api.middleware import auth # noqa: E402, F401 +from mod_api.middleware import error_handler # noqa: E402, F401 +from mod_api.middleware import rate_limit # noqa: E402, F401 +from mod_api.middleware import security # noqa: E402, F401 +# Route modules (registers endpoint functions on the blueprint) +from mod_api.routes import auth as auth_routes # noqa: E402, F401 +from mod_api.routes import errors_logs # noqa: E402, F401 +from mod_api.routes import results # noqa: E402, F401 +from mod_api.routes import runs # noqa: E402, F401 +from mod_api.routes import samples # noqa: E402, F401 +from mod_api.routes import system # noqa: E402, F401 diff --git a/mod_api/middleware/__init__.py b/mod_api/middleware/__init__.py new file mode 100644 index 000000000..860b3ce01 --- /dev/null +++ b/mod_api/middleware/__init__.py @@ -0,0 +1 @@ +"""mod_api.middleware: auth, rate limiting, validation, and error handling.""" diff --git a/mod_api/middleware/auth.py b/mod_api/middleware/auth.py new file mode 100644 index 000000000..f8a7df1c7 --- /dev/null +++ b/mod_api/middleware/auth.py @@ -0,0 +1,131 @@ +""" +Bearer token authentication and scope/role enforcement for API routes. + +Runs as a before_request hook on the api blueprint. Public endpoints +(token creation, health check) are exempted. On success, the authenticated +user and token are stored in flask.g for downstream handlers. + +HTTP semantics: + 401 = token missing, expired, revoked, or invalid + 403 = valid token but insufficient scope or role +""" + +import functools +from typing import List + +from flask import g, request + +from mod_api import mod_api +from mod_api.middleware.error_handler import make_error_response +from mod_api.models.api_token import ApiToken + +_AUTH_FAILED_MSG = 'Bearer token is missing, expired, or invalid.' + +# These endpoints bypass auth entirely. +_PUBLIC_ENDPOINTS = frozenset([ + 'api.create_token', # POST /auth/tokens (uses email/password body) + 'api.system_health', # GET /system/health (uptime monitoring) +]) + + +def _unauthorized(): + """Shorthand for a 401 response with the standard auth failure message.""" + from mod_api.middleware.rate_limit import check_rate_limit + rate_limit_resp = check_rate_limit() + if rate_limit_resp: + return rate_limit_resp + + return make_error_response( + 'unauthorized', _AUTH_FAILED_MSG, http_status=401) + + +@mod_api.before_request +def authenticate_request(): + """Validate Bearer token and attach user context to the request.""" + if request.endpoint in _PUBLIC_ENDPOINTS: + g.api_user = None + g.api_token = None + return + + auth_header = request.headers.get('Authorization', '') + if not auth_header: + return _unauthorized() + + parts = auth_header.split(' ', 1) + if len(parts) != 2 or parts[0] != 'Bearer': + return _unauthorized() + + token_value = parts[1].strip() + if not token_value or not token_value.startswith('spci_'): + return _unauthorized() + + # Look up by prefix, then verify the full hash against each candidate. + prefix = ApiToken.extract_prefix(token_value) + candidates = ApiToken.query.filter_by(token_prefix=prefix).all() + + if not candidates: + return _unauthorized() + + matched_token = None + for candidate in candidates: + if ApiToken.verify_token(token_value, candidate.token_hash): + matched_token = candidate + break + + if matched_token is None: + return _unauthorized() + + if not matched_token.is_valid: + return _unauthorized() + + g.api_token = matched_token + g.api_user = matched_token.user + + +def require_scope(*scopes: str): + """Reject the request if the token lacks any of the ``scopes``.""" + def decorator(f): + @functools.wraps(f) + def decorated_function(*args, **kwargs): + token = getattr(g, 'api_token', None) + if token is None: + return _unauthorized() + + missing_scopes = [s for s in scopes if not token.has_scope(s)] + if missing_scopes: + return make_error_response( + 'forbidden', + 'Token lacks the required scopes for this operation.', + details={ + 'required_scopes': list(scopes), + 'missing_scopes': missing_scopes, + 'token_scopes': token.scopes, + }, + http_status=403, + ) + return f(*args, **kwargs) + return decorated_function + return decorator + + +def require_roles(roles: List[str]): + """Reject the request if the user's role is not in ``roles``.""" + def decorator(f): + @functools.wraps(f) + def decorated_function(*args, **kwargs): + user = getattr(g, 'api_user', None) + if user is None: + return _unauthorized() + if user.role.value not in roles: + return make_error_response( + 'forbidden', + 'Your role does not have permission for this operation.', + details={ + 'required_roles': roles, + 'user_role': user.role.value, + }, + http_status=403, + ) + return f(*args, **kwargs) + return decorated_function + return decorator diff --git a/mod_api/middleware/error_handler.py b/mod_api/middleware/error_handler.py new file mode 100644 index 000000000..d54d09d96 --- /dev/null +++ b/mod_api/middleware/error_handler.py @@ -0,0 +1,144 @@ +"""Structured JSON error responses for API routes.""" + +from flask import jsonify, make_response, request +from marshmallow import ValidationError as MarshmallowValidationError +from sqlalchemy.exc import SQLAlchemyError + +from mod_api import mod_api + +_API_PREFIX = '/api/v1' + + +def make_error_response(code, message, details=None, http_status=400): + """Build a JSON error response conforming to the ErrorResponse schema.""" + body = { + 'code': code, + 'message': str(message)[:500], + 'details': details if details is not None else {}, + } + response = jsonify(body) + response.status_code = http_status + return response + + +@mod_api.errorhandler(400) +def handle_400(error): + """Bad request.""" + return make_error_response( + 'validation_error', + getattr(error, 'description', 'Bad request.'), + http_status=400, + ) + + +@mod_api.errorhandler(401) +def handle_401(error): + """Unauthorized.""" + return make_error_response( + 'unauthorized', + 'Bearer token is missing, expired, or invalid.', + http_status=401, + ) + + +@mod_api.errorhandler(403) +def handle_403(error): + """Forbidden.""" + return make_error_response( + 'forbidden', + 'Token does not have the required scope for this operation.', + http_status=403, + ) + + +@mod_api.errorhandler(404) +def handle_404(error): + """Not found.""" + return make_error_response( + 'not_found', + getattr(error, 'description', 'Resource not found.'), + http_status=404, + ) + + +@mod_api.errorhandler(405) +def handle_405(error): + """Handle method-not-allowed errors for API routes.""" + resp = make_error_response( + 'method_not_allowed', + 'Method not allowed.', + http_status=405, + ) + if hasattr(error, 'valid_methods') and error.valid_methods: + resp.headers['Allow'] = ', '.join(error.valid_methods) + return resp + + +@mod_api.errorhandler(422) +def handle_422(error): + """Unprocessable entity.""" + return make_error_response( + 'unprocessable', + getattr( + error, + 'description', + 'Request is valid JSON but semantically invalid.'), + http_status=422, + ) + + +@mod_api.errorhandler(429) +def handle_429(error): + """Rate limited.""" + return make_error_response( + 'rate_limited', + 'Rate limit exceeded.', + details={'retry_after': 30, 'limit': 120, 'window': '60s'}, + http_status=429, + ) + + +@mod_api.errorhandler(500) +def handle_500(error): + """Handle unexpected server errors for API routes.""" + return make_error_response( + 'internal_error', + 'An unexpected error occurred.', + http_status=500, + ) + + +@mod_api.errorhandler(MarshmallowValidationError) +def handle_marshmallow_validation_error(error): + """Catch schema validation failures and return them as 400.""" + return make_error_response( + 'validation_error', + 'Request failed schema validation.', + details={'fields': error.messages}, + http_status=400, + ) + + +@mod_api.errorhandler(SQLAlchemyError) +def handle_sqlalchemy_error(error): + """Log database errors.""" + from flask import g + log = getattr(g, 'log', None) + if log: + log.error(f'Database error in API: {type(error).__name__}') + return make_error_response( + 'internal_error', + 'An unexpected database error occurred.', + http_status=500, + ) + + +@mod_api.after_app_request +def convert_api_errors_to_json(response): + """Catch routing errors that were handled by global app handlers and convert them to JSON.""" + if request.path.startswith(_API_PREFIX): + if response.status_code == 404: + return make_error_response('not_found', 'Resource not found.', http_status=404) + if response.status_code == 405: + return make_error_response('method_not_allowed', 'Method not allowed.', http_status=405) + return response diff --git a/mod_api/middleware/rate_limit.py b/mod_api/middleware/rate_limit.py new file mode 100644 index 000000000..5cb1dca23 --- /dev/null +++ b/mod_api/middleware/rate_limit.py @@ -0,0 +1,133 @@ +""" +Per-client rate limiting for API endpoints. + +Limits: + POST /auth/tokens 5 req / 15 min (keyed by IP) + POST/DELETE/PUT/PATCH 20 req / min (keyed by token) + GET 120 req / min (keyed by token) + +Includes X-RateLimit-* headers on every response. +""" + +import threading +import time + +from flask import g, request + +from mod_api import mod_api + +_rate_limit_store = {} # key -> {'count': int, 'window_start': float} +_rate_limit_lock = threading.Lock() +_eviction_counter = 0 +_EVICTION_INTERVAL = 100 # run cleanup every N requests + + +def _evict_stale_entries(): + """Prune entries older than 15 min to bound memory usage.""" + global _eviction_counter + with _rate_limit_lock: + _eviction_counter += 1 + if _eviction_counter < _EVICTION_INTERVAL: + return + _eviction_counter = 0 + now = time.time() + stale_keys = [ + key for key, entry in _rate_limit_store.items() + if (now - entry['window_start']) > 900 + ] + for key in stale_keys: + del _rate_limit_store[key] + + +def _get_client_ip(): + """Extract the real client IP, ignoring X-Forwarded-For to prevent spoofing.""" + return request.remote_addr + + +def _get_rate_limit_key(): + """Build the rate-limit bucket key for this request.""" + if request.endpoint == 'api.create_token': + return f'ip:{_get_client_ip()}' + token = getattr(g, 'api_token', None) + if token: + return f'token:{token.id}' + return f'ip:{_get_client_ip()}' + + +def _get_limits(): + """Return (max_requests, window_seconds) for the current endpoint.""" + if request.endpoint == 'api.create_token': + return 5, 900 + if request.method in ('POST', 'DELETE', 'PUT', 'PATCH'): + return 20, 60 + return 120, 60 + + +@mod_api.before_request +def check_rate_limit(): + """Reject the request if the client has exceeded their rate limit.""" + from flask import current_app + if current_app.config.get('TESTING'): + return + + _evict_stale_entries() + + key = _get_rate_limit_key() + max_requests, window_seconds = _get_limits() + now = time.time() + + with _rate_limit_lock: + entry = _rate_limit_store.get(key) + + if entry is None or (now - entry['window_start']) >= window_seconds: + _rate_limit_store[key] = {'count': 1, 'window_start': now} + else: + entry['count'] += 1 + if entry['count'] > max_requests: + reset_at = int(entry['window_start'] + window_seconds) + retry_after = max(1, reset_at - int(now)) + + from mod_api.middleware.error_handler import \ + make_error_response + response = make_error_response( + 'rate_limited', + f'Rate limit exceeded. Retry after {retry_after} seconds.', + details={ + 'retry_after': retry_after, + 'limit': max_requests, + 'window': f'{window_seconds}s', + }, + http_status=429, + ) + response.headers['Retry-After'] = str(retry_after) + response.headers['X-RateLimit-Limit'] = str(max_requests) + response.headers['X-RateLimit-Remaining'] = '0' + response.headers['X-RateLimit-Reset'] = str(reset_at) + return response + + +@mod_api.after_request +def add_rate_limit_headers(response): + """Attach X-RateLimit-* headers to every response.""" + from flask import current_app + if current_app.config.get('TESTING'): + return response + + key = _get_rate_limit_key() + max_requests, window_seconds = _get_limits() + now = time.time() + + with _rate_limit_lock: + entry = _rate_limit_store.get(key) + if entry: + remaining = max(0, max_requests - entry['count']) + reset_at = int(entry['window_start'] + window_seconds) + else: + remaining = max_requests + reset_at = int(now + window_seconds) + + response.headers['X-RateLimit-Limit'] = str(max_requests) + response.headers['X-RateLimit-Remaining'] = str(remaining) + response.headers['X-RateLimit-Reset'] = str(reset_at) + + return response diff --git a/mod_api/middleware/security.py b/mod_api/middleware/security.py new file mode 100644 index 000000000..068f0abae --- /dev/null +++ b/mod_api/middleware/security.py @@ -0,0 +1,11 @@ +from mod_api import mod_api + + +@mod_api.after_request +def add_security_headers(response): + """Attach security headers to all API responses.""" + response.headers['Strict-Transport-Security'] = 'max-age=31536000; includeSubDomains' + response.headers['Content-Security-Policy'] = "default-src 'none'; frame-ancestors 'none'" + response.headers['X-Content-Type-Options'] = 'nosniff' + response.headers['X-Frame-Options'] = 'DENY' + return response diff --git a/mod_api/middleware/validation.py b/mod_api/middleware/validation.py new file mode 100644 index 000000000..892f8c015 --- /dev/null +++ b/mod_api/middleware/validation.py @@ -0,0 +1,325 @@ +""" +Request validation decorators for bodies, query params, and path IDs. + +All of these return 400 with field-level details on failure, so route +handlers can assume clean input. +""" + +import re +from functools import wraps + +from flask import request +from marshmallow import ValidationError as MarshmallowValidationError + +from mod_api.middleware.error_handler import make_error_response + +PATTERNS = { + 'commit_sha': re.compile(r'^[a-fA-F0-9]{40}$'), + 'sha256': re.compile(r'^[a-fA-F0-9]{64}$'), + 'repository': re.compile(r'^[a-zA-Z0-9_.\-]+/[a-zA-Z0-9_.\-]+$'), + 'branch': re.compile(r'^[A-Za-z0-9._/\-]+$'), + 'token_name': re.compile(r'^[a-zA-Z0-9_\-]+$'), + 'extension': re.compile(r'^[a-zA-Z0-9]+$'), +} + +# Whitelist of allowed sort params. +ALLOWED_RUN_SORTS = frozenset([ + 'created_at', '-created_at', + 'run_id', '-run_id', +]) + + +def validate_body(schema_class): + """Validate the JSON body with a schema, pass result as ``validated_data``.""" + def decorator(f): + @wraps(f) + def decorated(*args, **kwargs): + content_type = request.content_type or '' + if content_type.split(';')[0].strip() != 'application/json': + return make_error_response( + 'validation_error', + 'Content-Type must be application/json.', + http_status=415, + ) + json_data = request.get_json(silent=True) + if json_data is None: + return make_error_response( + 'validation_error', + 'Request body must be valid JSON.', + http_status=400, + ) + schema = schema_class() + try: + validated = schema.load(json_data) + except MarshmallowValidationError as e: + return make_error_response( + 'validation_error', + 'Request failed schema validation.', + details={'fields': e.messages}, + http_status=400, + ) + kwargs['validated_data'] = validated + return f(*args, **kwargs) + return decorated + return decorator + + +def validate_offset_pagination(default_limit=50): + """Extract and validate ``limit`` and ``offset`` query params.""" + def decorator(f): + @wraps(f) + def decorated(*args, **kwargs): + if 'cursor' in request.args: + return make_error_response( + 'validation_error', + 'Cannot mix cursor and offset pagination.', + details={'fields': { + 'cursor': 'Cannot specify cursor when using offset pagination.'}}, + http_status=400, + ) + + try: + limit = int(request.args.get('limit', default_limit)) + except (ValueError, TypeError): + return make_error_response( + 'validation_error', + 'limit must be an integer.', + details={'fields': { + 'limit': 'Must be an integer between 1 and 100.'}}, + http_status=400, + ) + + try: + offset = int(request.args.get('offset', 0)) + except (ValueError, TypeError): + return make_error_response( + 'validation_error', + 'offset must be a non-negative integer.', + details={'fields': { + 'offset': 'Must be a non-negative integer.'}}, + http_status=400, + ) + + if limit < 1 or limit > 100: + return make_error_response( + 'validation_error', + 'limit must be between 1 and 100.', + details={'fields': {'limit': 'Must be between 1 and 100.'}}, + http_status=400, + ) + + if offset < 0: + return make_error_response( + 'validation_error', + 'offset must be non-negative.', + details={'fields': {'offset': 'Must be >= 0.'}}, + http_status=400, + ) + + if offset > 2147483647: + return make_error_response( + 'validation_error', + 'offset is too large.', + details={'fields': {'offset': 'Must be <= 2147483647.'}}, + http_status=400, + ) + + kwargs['limit'] = limit + kwargs['offset'] = offset + return f(*args, **kwargs) + return decorated + return decorator + + +def _parse_limit(default_limit): + try: + limit = int(request.args.get('limit', default_limit)) + except (ValueError, TypeError): + return None, make_error_response( + 'validation_error', + 'limit must be an integer.', + details={'fields': {'limit': 'Must be an integer between 1 and 100.'}}, + http_status=400, + ) + + if limit < 1 or limit > 100: + return None, make_error_response( + 'validation_error', + 'limit must be between 1 and 100.', + details={'fields': {'limit': 'Must be between 1 and 100.'}}, + http_status=400, + ) + return limit, None + + +def _parse_cursor(): + cursor = request.args.get('cursor') + if cursor is None: + return None, None + try: + cursor = int(cursor) + except (ValueError, TypeError): + return None, make_error_response( + 'validation_error', + 'cursor must be an integer.', + details={'fields': {'cursor': 'Must be an integer.'}}, + http_status=400, + ) + if cursor < 0: + return None, make_error_response( + 'validation_error', + 'cursor must be non-negative.', + details={'fields': {'cursor': 'Must be >= 0.'}}, + http_status=400, + ) + if cursor > 10_000_000: + return None, make_error_response( + 'validation_error', + 'cursor out of range.', + details={'fields': {'cursor': 'Must be <= 10000000.'}}, + http_status=400, + ) + return cursor, None + + +def validate_cursor_pagination(default_limit=50): + """Extract and validate ``limit`` and ``cursor`` query params.""" + def decorator(f): + @wraps(f) + def decorated(*args, **kwargs): + if 'offset' in request.args: + return make_error_response( + 'validation_error', + 'Cannot mix cursor and offset pagination.', + details={'fields': { + 'offset': 'Cannot specify offset when using cursor pagination.'}}, + http_status=400, + ) + + limit, err = _parse_limit(default_limit) + if err: + return err + + cursor, err = _parse_cursor() + if err: + return err + + kwargs['limit'] = limit + kwargs['cursor'] = cursor + return f(*args, **kwargs) + return decorated + return decorator + + +def validate_path_id(param_name): + """Ensure a URL path parameter is a positive integer.""" + def decorator(f): + @wraps(f) + def decorated(*args, **kwargs): + value = kwargs.get(param_name) + try: + int_value = int(value) + except (ValueError, TypeError): + return make_error_response( + 'validation_error', + f'{param_name} must be a positive integer.', + details={ + 'fields': { + param_name: 'Must be a positive integer.'}}, + http_status=400, + ) + if int_value < 1 or int_value > 2147483647: + return make_error_response( + 'validation_error', + f'{param_name} must be between 1 and 2147483647.', + details={ + 'fields': { + param_name: 'Must be between 1 and 2147483647. Out of bounds IDs are rejected.' + } + }, + http_status=400, + ) + kwargs[param_name] = int_value + return f(*args, **kwargs) + return decorated + return decorator + + +def validate_date_range(f): + """Parse date query params and reject inverted ranges.""" + @wraps(f) + def decorated(*args, **kwargs): + from datetime import datetime + + created_after_str = request.args.get('created_after') + created_before_str = request.args.get('created_before') + created_after = None + created_before = None + + if created_after_str: + try: + created_after = datetime.fromisoformat( + created_after_str.replace('Z', '+00:00')) + except ValueError: + return make_error_response( + 'validation_error', + 'created_after must be a valid ISO 8601 datetime.', + details={ + 'fields': { + 'created_after': 'Invalid ISO 8601 format.'}}, + http_status=400, + ) + + if created_before_str: + try: + created_before = datetime.fromisoformat( + created_before_str.replace('Z', '+00:00')) + except ValueError: + return make_error_response( + 'validation_error', + 'created_before must be a valid ISO 8601 datetime.', + details={ + 'fields': { + 'created_before': 'Invalid ISO 8601 format.'}}, + http_status=400, + ) + + if created_after and created_before and created_after > created_before: + return make_error_response( + 'validation_error', + 'created_after cannot be later than created_before.', + details={'fields': { + 'created_after': 'Cannot be after created_before.'}}, + http_status=400, + ) + + kwargs['created_after'] = created_after + kwargs['created_before'] = created_before + return f(*args, **kwargs) + return decorated + + +def validate_sort(allowed=None): + """Validate the ``sort`` query param against a whitelist.""" + if allowed is None: + allowed = ALLOWED_RUN_SORTS + + def decorator(f): + @wraps(f) + def decorated(*args, **kwargs): + sort = request.args.get('sort', '-created_at') + if sort not in allowed: + return make_error_response( + 'validation_error', + f'sort must be one of: {", ".join(sorted(allowed))}', + details={ + 'fields': { + 'sort': f'Must be one of: {sorted(allowed)}' + } + }, + http_status=400, + ) + kwargs['sort'] = sort + return f(*args, **kwargs) + return decorated + return decorator diff --git a/mod_api/models/__init__.py b/mod_api/models/__init__.py new file mode 100644 index 000000000..dcb36537a --- /dev/null +++ b/mod_api/models/__init__.py @@ -0,0 +1 @@ +"""mod_api.models: database models for the API module.""" diff --git a/mod_api/models/api_token.py b/mod_api/models/api_token.py new file mode 100644 index 000000000..ca406bacc --- /dev/null +++ b/mod_api/models/api_token.py @@ -0,0 +1,141 @@ +""" +ApiToken model: server-side storage for scoped API tokens. + +Tokens are opaque strings prefixed with 'spci_'. Only the argon2 hash +is persisted; the plaintext is returned exactly once at creation time. +""" + +import json +import secrets +from datetime import datetime, timedelta, timezone +from typing import List + +from argon2 import PasswordHasher +from argon2.exceptions import (InvalidHashError, VerificationError, + VerifyMismatchError) +from sqlalchemy import (Column, DateTime, ForeignKey, Integer, String, Text, + UniqueConstraint) +from sqlalchemy.orm import relationship + +from database import Base + +_ph = PasswordHasher() + +VALID_SCOPES = frozenset([ + 'runs:read', + 'runs:write', + 'results:read', + 'baselines:write', + 'system:read', + 'tokens:manage', +]) + +DEFAULT_SCOPES = ['runs:read', 'results:read'] + +TOKEN_PREFIX = 'spci_' +TOKEN_BYTE_LENGTH = 32 + + +class ApiToken(Base): + """Scoped API token bound to a user account.""" + + __tablename__ = 'api_token' + __table_args__ = ( + UniqueConstraint('user_id', 'token_name', name='uq_user_token_name'), + {'mysql_engine': 'InnoDB'}, + ) + + id = Column(Integer, primary_key=True) + user_id = Column( + Integer, + ForeignKey('user.id', onupdate='CASCADE', ondelete='CASCADE'), + nullable=False, + ) + user = relationship('User', uselist=False) + token_name = Column(String(50), nullable=False) + token_hash = Column(String(255), nullable=False) + token_prefix = Column(String(16), nullable=False, index=True) + scopes_json = Column(Text(), nullable=False) + created_at = Column(DateTime(timezone=True), nullable=False) + expires_at = Column(DateTime(timezone=True), nullable=False) + revoked_at = Column(DateTime(timezone=True), nullable=True) + + def __init__( + self, + user_id: int, + token_name: str, + token_hash: str, + token_prefix: str, + scopes: List[str], + expires_in_days: int = 7, + ) -> None: + self.user_id = user_id + self.token_name = token_name + self.token_hash = token_hash + self.token_prefix = token_prefix + self.scopes_json = json.dumps(scopes) + self.created_at = datetime.now(timezone.utc) + self.expires_at = self.created_at + timedelta(days=expires_in_days) + + def __repr__(self) -> str: + """Return a debug representation of the token.""" + return f'' + + @property + def scopes(self) -> List[str]: + """Parse the JSON scopes column into a list.""" + return json.loads(self.scopes_json) + + @property + def is_expired(self) -> bool: + """Check whether this token has passed its expiration time.""" + now = datetime.now(timezone.utc) + expires = self.expires_at + if expires is None: + return True + # MySQL DATETIME columns don't preserve tzinfo; treat naive as UTC. + if expires.tzinfo is None: + expires = expires.replace(tzinfo=timezone.utc) + return bool(now > expires) + + @property + def is_revoked(self) -> bool: + """Check whether this token has been explicitly revoked.""" + return bool(self.revoked_at is not None) + + @property + def is_valid(self) -> bool: + """Return True if the token is neither expired nor revoked.""" + return not self.is_expired and not self.is_revoked + + def has_scope(self, scope: str) -> bool: + """Return True if the token grants the given scope.""" + return scope in self.scopes + + def revoke(self) -> None: + """Mark this token as revoked with the current timestamp.""" + self.revoked_at = datetime.now(timezone.utc) + + @staticmethod + def generate_token() -> str: + """Create a new random token string with the spci_ prefix.""" + random_bytes = secrets.token_urlsafe(TOKEN_BYTE_LENGTH) + return f'{TOKEN_PREFIX}{random_bytes}' + + @staticmethod + def hash_token(plaintext: str) -> str: + """Hash a token with argon2 for storage.""" + return _ph.hash(plaintext) + + @staticmethod + def verify_token(plaintext: str, token_hash: str) -> bool: + """Verify a plaintext token against its stored argon2 hash.""" + try: + return _ph.verify(token_hash, plaintext) + except (VerifyMismatchError, VerificationError, InvalidHashError): + return False + + @staticmethod + def extract_prefix(token: str) -> str: + """Return the first 16 chars used for DB lookup.""" + return token[:16] if len(token) >= 16 else token diff --git a/mod_api/routes/__init__.py b/mod_api/routes/__init__.py new file mode 100644 index 000000000..eac65b967 --- /dev/null +++ b/mod_api/routes/__init__.py @@ -0,0 +1 @@ +"""mod_api.routes — Endpoint handlers for the API.""" diff --git a/mod_api/routes/auth.py b/mod_api/routes/auth.py new file mode 100644 index 000000000..fe3ae300e --- /dev/null +++ b/mod_api/routes/auth.py @@ -0,0 +1,200 @@ +""" +Token lifecycle: create, list, and revoke API tokens. + +POST /auth/tokens Authenticate with email/password, get a token +GET /auth/tokens List tokens (own tokens; admin can see all) +DELETE /auth/tokens/current Revoke the token you're currently using +DELETE /auth/tokens/{id} Revoke a specific token by ID +""" + +from flask import g, request +from passlib.apps import custom_app_context as pwd_context + +from mod_api import mod_api +from mod_api.middleware.auth import require_roles, require_scope +from mod_api.middleware.error_handler import make_error_response +from mod_api.middleware.validation import (validate_body, + validate_offset_pagination) +from mod_api.models.api_token import DEFAULT_SCOPES, ApiToken +from mod_api.schemas.auth import (ApiTokenItemSchema, AuthTokenSchema, + TokenCreateRequestSchema) +from mod_api.utils import paginated_response, single_response +from mod_auth.models import User + +_DUMMY_HASH = pwd_context.hash('__dummy__') + + +@mod_api.route('/auth/tokens', methods=['POST']) +@validate_body(TokenCreateRequestSchema) +def create_token(validated_data=None): + """ + Authenticate with email + password and issue a scoped API token. + + The plaintext token value is returned exactly once in this response. + It's never stored or logged — only the argon2 hash is persisted. + """ + email = validated_data['email'] + password = validated_data['password'] + token_name = validated_data['token_name'] + expires_in_days = validated_data.get('expires_in_days', 7) + scopes = validated_data.get('scopes') or DEFAULT_SCOPES + + user = User.query.filter_by(email=email).first() + + # Hash password even if user is not found to prevent timing attacks + if user is None: + try: + pwd_context.verify(password, _DUMMY_HASH) + except Exception: + pass + return make_error_response( + 'invalid_credentials', + 'Invalid email or password.', + http_status=401, + ) + + if not user.is_password_valid(password): + return make_error_response( + 'invalid_credentials', + 'Invalid email or password.', + http_status=401, + ) + + # Check role limitations + allowed_scopes = { + 'runs:read', 'runs:write', 'results:read', + 'system:read', 'tokens:manage' + } + if user.role.value == 'admin': + allowed_scopes.add('baselines:write') + + invalid_scopes = set(scopes) - allowed_scopes + if invalid_scopes: + return make_error_response( + 'forbidden', + f'Your current role ({user.role.value}) does not permit requesting ' + f'the following scopes: {", ".join(invalid_scopes)}.', + http_status=403, + ) + + plaintext = ApiToken.generate_token() + token_hash = ApiToken.hash_token(plaintext) + token_prefix = ApiToken.extract_prefix(plaintext) + + api_token = ApiToken( + user_id=user.id, + token_name=token_name, + token_hash=token_hash, + token_prefix=token_prefix, + scopes=scopes, + expires_in_days=expires_in_days, + ) + g.db.add(api_token) + + from sqlalchemy.exc import IntegrityError + try: + g.db.commit() + except IntegrityError as e: + g.db.rollback() + error_msg = str(e).lower() + if 'uq_user_token_name' in error_msg or 'duplicate' in error_msg: + return make_error_response( + 'validation_error', + f'Token name "{token_name}" already exists for this user.', + details={'fields': { + 'token_name': 'Already in use. Revoke the existing token first.'}}, + http_status=400, + ) + raise + + return single_response( + { + 'token': plaintext, + 'token_type': 'bearer', + 'token_name': token_name, + 'scopes': scopes, + 'expires_at': api_token.expires_at, + }, + schema=AuthTokenSchema(), + http_status=201, + ) + + +@mod_api.route('/auth/tokens/current', methods=['DELETE']) +def revoke_current_token(): + """Revoke whatever token is in the Authorization header right now.""" + token = getattr(g, 'api_token', None) + if token is None: + return make_error_response( + 'unauthorized', + 'No token found in the current request.', + http_status=401, + ) + token.revoke() + g.db.add(token) + g.db.commit() + return '', 204 + + +@mod_api.route('/auth/tokens', methods=['GET']) +@require_roles(['admin', 'contributor', 'tester']) +@require_scope('tokens:manage') +@validate_offset_pagination() +def list_tokens(limit=50, offset=0): + """ + List tokens for the current user, paginated. + + Admins can pass ?all=true to see every token in the system. + Non-admins who try ?all=true get a 403. + """ + want_all = request.args.get('all', 'false').lower() == 'true' + is_admin = g.api_user.role.value == 'admin' + + if want_all and not is_admin: + return make_error_response( + 'forbidden', + 'Only admins may list all tokens.', + details={'required_roles': ['admin']}, + http_status=403, + ) + + if want_all and is_admin: + query = ApiToken.query.order_by(ApiToken.created_at.desc()) + else: + query = ApiToken.query.filter_by( + user_id=g.api_user.id, + ).order_by(ApiToken.created_at.desc()) + + total = query.count() + tokens = query.offset(offset).limit(limit).all() + schema = ApiTokenItemSchema(many=True) + + return paginated_response(tokens, total, limit, offset, schema=schema) + + +@mod_api.route('/auth/tokens/', methods=['DELETE']) +def revoke_specific_token(token_id): + """ + Revoke a token by its numeric ID. + + Non-admins can only revoke their own tokens. Admins can revoke anyone's. + Already-revoked tokens are silently accepted (idempotent). + """ + is_admin = g.api_user.role.value == 'admin' + token = ApiToken.query.filter_by(id=token_id).first() + + # Non-admins get a uniform 404 for both "doesn't exist" and "belongs to + # another user" to prevent token-ID enumeration. + is_own = token is not None and token.user_id == g.api_user.id + if not token or (not is_admin and not is_own): + return make_error_response('not_found', 'Token not found.', http_status=404) + + if not is_own and not g.api_token.has_scope('tokens:manage'): + return make_error_response('forbidden', 'Cross-user revocation requires tokens:manage scope.', http_status=403) + + if not token.is_revoked: + token.revoke() + g.db.add(token) + g.db.commit() + + return '', 204 diff --git a/mod_api/routes/errors_logs.py b/mod_api/routes/errors_logs.py new file mode 100644 index 000000000..ca439f881 --- /dev/null +++ b/mod_api/routes/errors_logs.py @@ -0,0 +1,193 @@ +""" +Error and build log routes. + +GET /runs/{id}/errors Test-level errors for a run +GET /runs/{id}/infrastructure-errors Infra errors (VM, build, worker) +GET /runs/{id}/error-summary Grouped error counts +GET /runs/{id}/logs Build log (cursor-paginated) +GET /runs/{id}/samples/{sid}/logs Per-sample logs (not yet available) +""" + +from flask import g, request + +from mod_api import mod_api +from mod_api.middleware.auth import require_roles, require_scope +from mod_api.middleware.error_handler import make_error_response +from mod_api.middleware.validation import (validate_cursor_pagination, + validate_offset_pagination, + validate_path_id) +from mod_api.schemas.errors import ErrorItemSchema, ErrorSummaryBucketSchema +from mod_api.services.error_service import (derive_error_summary, + derive_errors_for_run, + derive_infrastructure_errors) +from mod_api.services.log_service import read_log_lines +from mod_api.utils import cursor_paginated_response, paginated_response +from mod_test.models import Test + + +@mod_api.route('/runs//errors', methods=['GET']) +@require_scope('results:read') +@validate_path_id('run_id') +@validate_offset_pagination() +def list_run_errors(run_id, limit=50, offset=0): + """List test errors for a run, derived from result and output data.""" + test = Test.query.filter(Test.id == run_id).first() + if test is None: + return make_error_response('not_found', f'Run {run_id} not found.', http_status=404) + + errors = derive_errors_for_run(run_id) + + error_type = request.args.get('type') + if error_type: + errors = [e for e in errors if e['type'] == error_type] + + severity = request.args.get('severity') + if severity: + errors = [e for e in errors if e['severity'] == severity] + + sample_id = request.args.get('sample_id', type=int) + if sample_id: + errors = [e for e in errors if e.get('sample_id') == sample_id] + + total = len(errors) + paged = errors[offset:offset + limit] + + return paginated_response(paged, total, limit, offset) + + +@mod_api.route('/runs//infrastructure-errors', methods=['GET']) +@require_scope('system:read') +@validate_path_id('run_id') +@validate_offset_pagination() +def list_infrastructure_errors(run_id, limit=50, offset=0): + """ + Infra errors classified from TestProgress messages on a best-effort basis. + + Stack traces are opt-in because they may contain internal paths. + """ + test = Test.query.filter(Test.id == run_id).first() + if test is None: + return make_error_response('not_found', f'Run {run_id} not found.', http_status=404) + + include_stack = request.args.get( + 'include_stack', 'false').lower() == 'true' + if include_stack: + user = getattr(g, 'api_user', None) + if user is None or user.role.value not in ('admin', 'contributor'): + return make_error_response( + 'forbidden', + 'Stack traces require admin or contributor role.', + details={'required_roles': ['admin', 'contributor']}, + http_status=403, + ) + + errors = derive_infrastructure_errors(run_id) + + if not include_stack: + for e in errors: + e.pop('stack', None) + + # Apply optional type and severity filters. + error_type = request.args.get('type') + if error_type: + errors = [e for e in errors if e.get('type') == error_type] + + severity = request.args.get('severity') + if severity: + errors = [e for e in errors if e.get('severity') == severity] + + total = len(errors) + paged = errors[offset:offset + limit] + return paginated_response(paged, total, limit, offset) + + +@mod_api.route('/runs//error-summary', methods=['GET']) +@require_scope('results:read') +@validate_path_id('run_id') +@validate_offset_pagination() +def get_error_summary(run_id, limit=50, offset=0): + """Group error summary for triaging a run before drilling into details.""" + test = Test.query.filter(Test.id == run_id).first() + if test is None: + return make_error_response('not_found', f'Run {run_id} not found.', http_status=404) + + group_by = request.args.get('group_by', 'type') + if group_by not in ('type', 'severity', 'sample_id', 'regression_id'): + return make_error_response( + 'validation_error', + 'group_by must be one of: type, severity, sample_id, regression_id.', + http_status=400, + ) + + severity = request.args.get('severity') + + summary = derive_error_summary(run_id, group_by=group_by) + + if severity: + summary = [s for s in summary if s.get('severity') == severity] + + total = len(summary) + paged = summary[offset:offset + limit] + return paginated_response(paged, total, limit, offset) + + +@mod_api.route('/runs//logs', methods=['GET']) +@require_scope('system:read') +@validate_path_id('run_id') +@validate_cursor_pagination(default_limit=100) +def get_run_logs(run_id, limit=100, cursor=None): + """ + Read a run's build log with cursor-based pagination. + + Returns 404 (not a broken download link) when the file doesn't exist. + """ + test = Test.query.filter(Test.id == run_id).first() + if test is None: + return make_error_response('not_found', f'Run {run_id} not found.', http_status=404) + + level = request.args.get('level') + source = request.args.get('source') + contains = request.args.get('contains') + if contains and len(contains) > 100: + return make_error_response( + 'validation_error', + 'contains parameter must be 100 characters or less.', + http_status=400, + ) + + try: + lines, next_cursor = read_log_lines( + run_id, + cursor=cursor, + limit=limit, + level=level, + source=source, + contains=contains, + ) + except FileNotFoundError: + return make_error_response( + 'log_not_found', + f'Log file for run {run_id} is not available locally. ' + 'It may have been moved to cold storage. Please download it via the artifacts API.', + details={'run_id': run_id, + 'action_required': 'Use the /runs/{run_id}/artifacts/logs endpoint'}, + http_status=404, + ) + + return cursor_paginated_response(lines, next_cursor, limit) + + +@mod_api.route('/runs//samples//logs', methods=['GET']) +@require_scope('system:read') +@validate_path_id('run_id') +@validate_path_id('sample_id') +@validate_offset_pagination() +def get_sample_logs(run_id, sample_id, limit=50, offset=0): + """Per-sample logs aren't available yet — the CI worker doesn't support them.""" + return make_error_response( + 'not_found', + f'Per-sample logs are not available for sample {sample_id} in run {run_id}.', + details={ + 'reason': 'Per-sample log storage is not yet supported by the CI worker.'}, + http_status=404, + ) diff --git a/mod_api/routes/results.py b/mod_api/routes/results.py new file mode 100644 index 000000000..4026842d3 --- /dev/null +++ b/mod_api/routes/results.py @@ -0,0 +1,457 @@ +""" +Expected/actual output, diffs, and baseline approval routes. + +GET /runs/{id}/samples/{sid}/expected Expected output file +GET /runs/{id}/samples/{sid}/actual Actual output file +GET /runs/{id}/samples/{sid}/diff Structured diff +POST /runs/{id}/samples/{sid}/baseline-approval Approve a new baseline +""" + +import base64 +import os + +from flask import g, request + +from mod_api import mod_api +from mod_api.middleware.auth import require_roles, require_scope +from mod_api.middleware.error_handler import make_error_response +from mod_api.middleware.validation import validate_body, validate_path_id +from mod_api.schemas.results import BaselineApprovalRequestSchema +from mod_api.services.diff_service import compute_diff, file_sha256, read_lines +from mod_api.services.status import is_dummy_row +from mod_api.services.storage import get_test_results_base_path +from mod_api.utils import single_response +from mod_test.models import Test, TestResult, TestResultFile + +INVALID_PATH_MSG = 'Invalid file path.' +READ_ERROR_MSG = 'Failed to read file.' + + +def _safe_resolve(base_path, filename): + """ + Resolve filename under base_path, rejecting path traversal. + + Returns the absolute path if it's safely within base_path, + or None if traversal was detected. + """ + resolved = os.path.realpath(os.path.join(base_path, filename)) + base_real = os.path.realpath(base_path) + if not resolved.startswith(base_real + os.sep) and resolved != base_real: + return None + return resolved + + +def _find_result_file(run_id, regression_test_id, output_id=None): + """ + Look up the right TestResultFile row. + + Uses run_id + regression_test_id from the path. If output_id is + given as a query param, narrow to that specific output file. + """ + query = TestResultFile.query.filter_by( + test_id=run_id, + regression_test_id=regression_test_id, + ) + + if output_id is not None: + query = query.filter_by(regression_test_output_id=output_id) + + return query.first() + + +def _parse_output_id(): + """Pull output_id from query string, if provided.""" + return request.args.get('output_id', type=int) + + +def _validate_result_file_access(run_id, sample_id, regression_id, output_id): + """Validate access to a result file and return it, or an error response.""" + test = Test.query.filter(Test.id == run_id).first() + if test is None: + return None, make_error_response('not_found', f'Run {run_id} not found.', http_status=404) + + result_file = _find_result_file(run_id, regression_id, output_id) + + if result_file is None: + return None, make_error_response( + 'not_found', + f'No result for regression test {regression_id}.', + http_status=404, + ) + + actual_sample_id = ( + result_file.regression_test.sample_id + if result_file.regression_test else None + ) + if actual_sample_id != sample_id: + return None, make_error_response( + 'not_found', + f'Regression test {regression_id} does not belong to sample {sample_id}.', + http_status=404, + ) + + return result_file, None + + +def _read_output_file(file_path, fmt, is_expected=True): + """Read output file and return properties.""" + if not os.path.isfile(file_path): + type_str = 'Expected' if is_expected else 'Actual' + return None, make_error_response( + 'not_found', + f'{type_str} output file not found on disk.', + http_status=404, + ) + + sha256 = file_sha256(file_path) + file_size = os.path.getsize(file_path) + truncated = False + download_url = None + + if file_size > 1048576: + truncated = True + from mod_api.services.storage import resolve_artifact + filename = os.path.basename(file_path) + download_url, _ = resolve_artifact(f'TestResults/{filename}') + + if fmt == 'text': + try: + with open(file_path, 'r', encoding='utf-8', errors='replace') as f: + content = f.read(1048576) + encoding = 'utf-8' + except Exception: + return None, make_error_response('internal_error', READ_ERROR_MSG, http_status=500) + else: + try: + with open(file_path, 'rb') as f: + content = base64.b64encode(f.read(1048576)).decode('ascii') + encoding = 'base64' + except Exception: + return None, make_error_response('internal_error', READ_ERROR_MSG, http_status=500) + + return { + 'content': content, + 'encoding': encoding, + 'sha256': sha256, + 'truncated': truncated, + 'download_url': download_url, + }, None + + +@mod_api.route( + '/runs//samples//regression-tests//outputs//expected', + methods=['GET'] +) +@require_scope('results:read') +@validate_path_id('run_id') +@validate_path_id('sample_id') +@validate_path_id('regression_id') +@validate_path_id('output_id') +def get_expected_output(run_id, sample_id, regression_id, output_id): + """Return the expected output file for a regression test result.""" + result_file, err = _validate_result_file_access( + run_id, sample_id, regression_id, output_id) + if err: + return err + + if is_dummy_row(result_file): + return make_error_response('not_found', 'Expected output not found.', http_status=404) + + base_path = get_test_results_base_path() + expected_filename = result_file.expected + ext = '' + if result_file.regression_test_output: + ext = result_file.regression_test_output.correct_extension + if ext: + ext = ext.replace('/', '').replace('\\', '').replace('..', '') + expected_filename += ext + + file_path = _safe_resolve(base_path, expected_filename) + if file_path is None: + return make_error_response('forbidden', INVALID_PATH_MSG, http_status=403) + + fmt = request.args.get('format', 'base64') + + data, err = _read_output_file(file_path, fmt, is_expected=True) + if err: + return err + + content = data['content'] + encoding = data['encoding'] + sha256 = data['sha256'] + truncated = data['truncated'] + download_url = data['download_url'] + + return single_response({ + 'run_id': run_id, + 'sample_id': sample_id, + 'regression_id': result_file.regression_test_id, + 'output_id': result_file.regression_test_output_id, + 'filename': expected_filename, + 'content_type': 'application/octet-stream', + 'encoding': encoding, + 'content': content, + 'truncated': truncated, + 'download_url': download_url, + 'sha256': sha256, + 'storage_status': 'ok', + }) + + +@mod_api.route( + '/runs//samples//regression-tests//outputs//actual', + methods=['GET'] +) +@require_scope('results:read') +@validate_path_id('run_id') +@validate_path_id('sample_id') +@validate_path_id('regression_id') +@validate_path_id('output_id') +def get_actual_output(run_id, sample_id, regression_id, output_id): + """ + Return the actual output file for a regression test result. + + got=null in the DB means the output matched expected — not that it's + missing. We return 303 (redirect to expected) in that case. Missing + output (the dummy sentinel row) returns 404. + """ + result_file, err = _validate_result_file_access( + run_id, sample_id, regression_id, output_id) + if err: + return err + + if is_dummy_row(result_file): + return make_error_response( + 'missing_output', + 'Test produced no output when output was expected.', + http_status=404, + ) + + if result_file.got is None: + from flask import redirect, url_for + return redirect(url_for( + 'api.get_expected_output', + run_id=run_id, + sample_id=sample_id, + regression_id=regression_id, + output_id=output_id, + format=request.args.get('format', 'base64'), + _external=True + ), code=303) + + base_path = get_test_results_base_path() + actual_filename = result_file.got + if result_file.regression_test_output: + ext = result_file.regression_test_output.correct_extension + if ext: + ext = ext.replace('/', '').replace('\\', '').replace('..', '') + actual_filename += ext + + file_path = _safe_resolve(base_path, actual_filename) + if file_path is None: + return make_error_response('forbidden', INVALID_PATH_MSG, http_status=403) + + fmt = request.args.get('format', 'base64') + + data, err = _read_output_file(file_path, fmt, is_expected=False) + if err: + return err + + content = data['content'] + encoding = data['encoding'] + sha256 = data['sha256'] + truncated = data['truncated'] + download_url = data['download_url'] + + return single_response({ + 'run_id': run_id, + 'sample_id': sample_id, + 'regression_id': result_file.regression_test_id, + 'output_id': result_file.regression_test_output_id, + 'filename': actual_filename, + 'content_type': 'application/octet-stream', + 'encoding': encoding, + 'content': content, + 'truncated': truncated, + 'download_url': download_url, + 'sha256': sha256, + 'storage_status': 'ok', + }) + + +def _handle_missing_diff(result_file, format_type, diff_ids): + if is_dummy_row(result_file): + if format_type == 'unified': + return single_response({**diff_ids, 'format': 'unified', 'content': ''}) + return single_response({ + **diff_ids, + 'status': 'missing_actual', + 'format': 'structured', + 'summary': {'added_lines': 0, 'removed_lines': 0, 'changed_hunks': 0}, + 'hunks': [], + }) + + if result_file.got is None: + if format_type == 'unified': + return single_response({**diff_ids, 'format': 'unified', 'content': ''}) + return single_response({ + **diff_ids, + 'status': 'identical', + 'format': 'structured', + 'summary': {'added_lines': 0, 'removed_lines': 0, 'changed_hunks': 0}, + 'hunks': [], + }) + return None + + +@mod_api.route( + '/runs//samples//regression-tests//outputs//diff', + methods=['GET'] +) +@require_scope('results:read') +@validate_path_id('run_id') +@validate_path_id('sample_id') +@validate_path_id('regression_id') +@validate_path_id('output_id') +def get_diff(run_id, sample_id, regression_id, output_id): + """Structured diff between expected and actual output.""" + result_file, err = _validate_result_file_access( + run_id, sample_id, regression_id, output_id) + if err: + return err + + diff_ids = { + 'run_id': run_id, + 'sample_id': sample_id, + 'regression_id': result_file.regression_test_id, + 'output_id': result_file.regression_test_output_id, + } + + format_type = request.args.get('format', 'structured') + + missing_response = _handle_missing_diff(result_file, format_type, diff_ids) + if missing_response: + return missing_response + + base_path = get_test_results_base_path() + ext = result_file.regression_test_output.correct_extension if result_file.regression_test_output else '' + if ext: + ext = ext.replace('/', '').replace('\\', '').replace('..', '') + expected_path = _safe_resolve(base_path, result_file.expected + ext) + actual_path = _safe_resolve(base_path, result_file.got + ext) + + if expected_path is None or actual_path is None: + return make_error_response('forbidden', INVALID_PATH_MSG, http_status=403) + + if not os.path.isfile(expected_path): + return make_error_response('not_found', 'Expected output file not found on disk.', http_status=404) + if not os.path.isfile(actual_path): + return make_error_response('not_found', 'Actual output file not found on disk.', http_status=404) + + max_diff_bytes = 10 * 1024 * 1024 # 10 MiB + if os.path.getsize(expected_path) > max_diff_bytes or os.path.getsize(actual_path) > max_diff_bytes: + return make_error_response('unprocessable', 'File too large for diff. Use download_url.', http_status=422) + + if format_type == 'unified': + import difflib + expected_lines = read_lines(expected_path) + actual_lines = read_lines(actual_path) + differ = difflib.unified_diff( + expected_lines, + actual_lines, + fromfile='expected', + tofile='actual', + lineterm='' + ) + unified_content = '\n'.join(differ) + return single_response({ + **diff_ids, + 'format': 'unified', + 'content': unified_content + }) + + context_lines = request.args.get('context_lines', 3, type=int) + context_lines = max(1, min(context_lines, 50)) + + diff_result = compute_diff( + expected_path, actual_path, context_lines=context_lines) + diff_result.update(diff_ids) + diff_result['format'] = 'structured' + return single_response(diff_result) + + +@mod_api.route('/runs//samples//baseline-approval', methods=['POST']) +@require_roles(['admin', 'contributor']) +@require_scope('baselines:write') +@validate_path_id('run_id') +@validate_path_id('sample_id') +@validate_body(BaselineApprovalRequestSchema) +def create_baseline_approval(run_id, sample_id, validated_data=None): + """ + Record intent to approve actual output as the new expected baseline. + + WARNING: When remove_variants is set to true, this action will remove all + platform-specific variants, making this output the single source of truth + across all platforms. Care should be taken as this applies globally. + """ + test = Test.query.filter(Test.id == run_id).first() + if test is None: + return make_error_response('not_found', f'Run {run_id} not found.', http_status=404) + + regression_id = validated_data['regression_id'] + output_id = validated_data['output_id'] + + result_file = TestResultFile.query.filter_by( + test_id=run_id, + regression_test_id=regression_id, + regression_test_output_id=output_id, + ).first() + + if result_file is None: + return make_error_response('not_found', 'Result file not found.', http_status=404) + + actual_sample_id = ( + result_file.regression_test.sample_id + if result_file.regression_test else None + ) + if actual_sample_id != sample_id: + return make_error_response( + 'not_found', + f'Regression test {regression_id} does not belong to sample {sample_id}.', + http_status=404, + ) + + if is_dummy_row(result_file): + return make_error_response('unprocessable', 'Cannot approve a dummy row.', http_status=422) + + if result_file.got is None: + return make_error_response('unprocessable', 'Output already matches expected.', http_status=422) + + # The actual output file (named by its hash) is already in TestResults/. + # We just need to update the RegressionTestOutput to point to this new hash. + rto = result_file.regression_test_output + if rto is None: + return make_error_response('internal_error', 'No RegressionTestOutput linked.', http_status=500) + + new_baseline = result_file.got + + rto.correct = new_baseline + + remove_variants = validated_data.get('remove_variants', False) + if remove_variants: + from mod_regression.models import RegressionTestOutputFiles + RegressionTestOutputFiles.query.filter_by( + regression_test_output_id=rto.id).delete() + + g.db.commit() + + import datetime + return single_response({ + 'status': 'approved', + 'run_id': run_id, + 'sample_id': sample_id, + 'regression_id': regression_id, + 'output_id': output_id, + 'requested_by': getattr(g, 'api_user').name if getattr(g, 'api_user', None) else 'unknown', + 'created_at': datetime.datetime.now(datetime.timezone.utc).isoformat() + }) diff --git a/mod_api/routes/runs.py b/mod_api/routes/runs.py new file mode 100644 index 000000000..18c894924 --- /dev/null +++ b/mod_api/routes/runs.py @@ -0,0 +1,528 @@ +""" +Test run routes. + +GET /runs List runs (filtered, paginated, sorted) +POST /runs Trigger a new run +GET /runs/{id} Single run details +GET /runs/{id}/summary Pass/fail/skip counts +GET /runs/{id}/progress Progress event timeline +GET /runs/{id}/config Run configuration and test matrix +POST /runs/{id}/cancel Cancel a queued or running test +""" + +from flask import g, request +from sqlalchemy.exc import IntegrityError + +from mod_api import mod_api +from mod_api.middleware.auth import require_roles, require_scope +from mod_api.middleware.error_handler import make_error_response +from mod_api.middleware.validation import (PATTERNS, validate_body, + validate_date_range, + validate_offset_pagination, + validate_path_id, validate_sort) +from mod_api.schemas.runs import ProgressEventSchema, RunCreateRequestSchema +from mod_api.services.status import (derive_run_status, derive_sample_status, + get_run_timestamps) +from mod_api.utils import (cursor_paginated_response, get_sort_column, + paginated_response, single_response) +from mod_customized.models import CustomizedTest +from mod_regression.models import RegressionTest +from mod_test.models import (Fork, Test, TestPlatform, TestProgress, + TestResult, TestResultFile, TestStatus, TestType) + + +def _serialize_run(test): + """Turn a Test row into the Run response shape the spec expects.""" + return _batch_serialize([test])[0] + + +def _batch_serialize(tests, statuses=None, timestamps=None): + from mod_api.services.status import batch_get_run_data + if statuses is None or timestamps is None: + statuses, timestamps = batch_get_run_data(tests) + return [ + { + 'run_id': t.id, + 'status': statuses.get(t.id, 'queued'), + 'platform': t.platform.value, + 'test_type': 'pr' if t.test_type == TestType.pull_request else 'commit', + 'repository': t.fork.github_name if t.fork else 'unknown', + 'branch': t.branch, + 'commit_sha': t.commit, + 'pr_number': t.pr_nr if t.pr_nr and t.pr_nr > 0 else None, + 'created_at': timestamps.get(t.id, {}).get('created_at'), + 'queued_at': timestamps.get(t.id, {}).get('queued_at'), + 'started_at': timestamps.get(t.id, {}).get('started_at'), + 'completed_at': timestamps.get(t.id, {}).get('completed_at'), + 'github_link': t.github_link if t.fork else None, + } + for t in tests + ] + + +def _apply_run_filters(query, created_after, created_before): + platform = request.args.get('platform') + if platform: + try: + platform_enum = TestPlatform.from_string(platform) + query = query.filter(Test.platform == platform_enum) + except Exception: + valid_platforms = ', '.join(TestPlatform.values()) + return None, make_error_response( + 'validation_error', + f'Invalid platform: {platform}. Must be one of: {valid_platforms}.', + http_status=400, + ) + + branch = request.args.get('branch') + if branch: + query = query.filter(Test.branch == branch) + + commit_sha = request.args.get('commit_sha') + if commit_sha: + query = query.filter(Test.commit == commit_sha) + + repository = request.args.get('repository') + if repository: + from mod_api.middleware.validation import PATTERNS + if not PATTERNS['repository'].match(repository): + return None, make_error_response( + 'validation_error', + 'repository must match owner/repo format.', + details={'fields': { + 'repository': 'Must match ^[a-zA-Z0-9_.-]+/[a-zA-Z0-9_.-]+$'}}, + http_status=400, + ) + fork_url = f'https://github.com/{repository}.git' + query = query.join(Fork).filter(Fork.github == fork_url) + + if created_after or created_before: + from sqlalchemy import func + first_progress = ( + g.db.query(TestProgress.test_id, func.min( + TestProgress.timestamp).label('min_ts')) + .group_by(TestProgress.test_id) + .subquery() + ) + query = query.join(first_progress, Test.id == first_progress.c.test_id) + if created_after: + query = query.filter(first_progress.c.min_ts >= created_after) + if created_before: + query = query.filter(first_progress.c.min_ts <= created_before) + + return query, None + + +def _validate_run_permissions(user, target_repo, main_repo_full): + if target_repo == main_repo_full: + if user.role.value not in ('admin', 'tester', 'contributor'): + return make_error_response( + 'forbidden', + 'Only admins, testers, and contributors can trigger runs for the main repository.', + details={ + 'required_roles': ['admin', 'tester', 'contributor'], + 'repository': target_repo, + }, + http_status=403, + ) + else: + owner = target_repo.split('/')[0] + github_login = user.github_login + + if not github_login and user.github_token: + from mod_auth.controllers import fetch_username_from_token + github_login = fetch_username_from_token(user) + if github_login: + user.github_login = github_login + from flask import g + g.db.add(user) + + github_login = github_login or '' + + is_owner = bool(github_login) and owner.lower() == github_login.lower() + is_staff = user.role.value in ('admin', 'tester', 'contributor') + + if not is_owner and not is_staff: + return make_error_response( + 'forbidden', + 'You can only trigger runs for your own repository.', + details={ + 'repository': target_repo, + 'owner_required': github_login, + }, + http_status=403, + ) + return None + + +def _validate_regression_test_ids(regression_test_ids): + if regression_test_ids is not None: + if not regression_test_ids: + return None, make_error_response( + 'validation_error', + 'regression_test_ids cannot be empty.', + details={'fields': { + 'regression_test_ids': 'Must contain at least one ID.'}}, + http_status=400, + ) + active_tests = RegressionTest.query.filter( + RegressionTest.id.in_(regression_test_ids), + RegressionTest.active == True, # noqa: E712 + ).all() + active_ids = {t.id for t in active_tests} + inactive_ids = [ + tid for tid in regression_test_ids if tid not in active_ids] + if inactive_ids: + return None, make_error_response( + 'unprocessable', + 'Some regression test IDs are inactive or do not exist.', + details={'inactive_ids': inactive_ids}, + http_status=422, + ) + else: + active_tests = RegressionTest.query.filter_by(active=True).all() + regression_test_ids = [t.id for t in active_tests] + return regression_test_ids, None + + +@mod_api.route('/runs', methods=['GET']) +@require_scope('runs:read') +@validate_offset_pagination() +@validate_sort() +@validate_date_range +def list_runs(limit=50, offset=0, sort='-created_at', created_after=None, created_before=None): + """List runs with filters for platform, branch, commit, repo, status, and date range.""" + query, err = _apply_run_filters(Test.query, created_after, created_before) + if err: + return err + + sort_map = { + 'run_id': Test.id, + 'created_at': Test.id, # best proxy - Test has no created_at column + } + order = get_sort_column(sort, sort_map) + if order is not None: + query = query.order_by(order) + else: + query = query.order_by(Test.id.desc()) + + status_filter = request.args.get('status') + + if status_filter: + # Hard limit to prevent loading all historical runs into memory + all_matching = query.limit(1000).all() + is_truncated = len(all_matching) == 1000 + # Batch derivation logic + from mod_api.services.status import batch_get_run_data + statuses, timestamps = batch_get_run_data(all_matching) + + filtered = [] + for t in all_matching: + if statuses.get(t.id, 'queued') == status_filter: + filtered.append(t) + + serialized = _batch_serialize( + filtered, statuses=statuses, timestamps=timestamps) + + total = len(serialized) + paged = serialized[offset:offset + limit] + from mod_api.schemas.runs import RunSchema + return paginated_response(paged, total, limit, offset, schema=RunSchema(), truncated=is_truncated) + + total = query.count() + tests = query.offset(offset).limit(limit).all() + serialized = _batch_serialize(tests) + from mod_api.schemas.runs import RunSchema + return paginated_response(serialized, total, limit, offset, schema=RunSchema()) + + +def _get_or_create_fork(fork_url): + fork = Fork.query.filter(Fork.github == fork_url).first() + if fork is None: + fork = Fork(fork_url) + g.db.add(fork) + try: + g.db.flush() + except IntegrityError: + g.db.rollback() + fork = Fork.query.filter(Fork.github == fork_url).first() + if fork is None: + return None, make_error_response('internal_error', 'Failed to create or resolve fork.', http_status=500) + return fork, None + + +@mod_api.route('/runs', methods=['POST']) +@require_scope('runs:write') +@validate_body(RunCreateRequestSchema) +def create_run(validated_data=None): + """Trigger a new test run for a commit + platform combination. + + CI worker pickup: The worker's cron job (run_cron.py) polls the Test + table for rows without a 'completed' or 'canceled' TestProgress entry. + Creating a Test row here is sufficient to enqueue it — no explicit + signal is needed. See mod_ci/controllers.py queue_test() which follows + the same pattern: 'Created tests, waiting for cron...'. + """ + commit_sha = validated_data['commit_sha'] + platform_str = validated_data['platform'] + branch = validated_data.get('branch', 'master') + repository = validated_data.get('repository') + pull_request = validated_data.get('pull_request') or 0 + regression_test_ids = validated_data.get('regression_test_ids') + + platform = TestPlatform.from_string(platform_str) + + # Main repo requires contributor+; forks allow any authenticated user. + from run import config + main_owner = config.get('GITHUB_OWNER', '') + main_repo = config.get('GITHUB_REPOSITORY', '') + main_repo_full = f'{main_owner}/{main_repo}' + target_repo = repository or main_repo_full + + err = _validate_run_permissions(g.api_user, target_repo, main_repo_full) + if err: + return err + + if repository: + fork_url = f'https://github.com/{repository}.git' + else: + fork_url = f"https://github.com/{main_owner}/{main_repo}.git" + + fork, err = _get_or_create_fork(fork_url) + if err: + return err + + # Validate regression test IDs against active tests only. + regression_test_ids, err = _validate_regression_test_ids( + regression_test_ids) + if err: + return err + + test_type = TestType.pull_request if pull_request else TestType.commit + + test = Test( + platform=platform, + test_type=test_type, + fork_id=fork.id, + branch=branch, + commit=commit_sha, + pr_nr=pull_request, + ) + g.db.add(test) + try: + g.db.flush() + except Exception: + g.db.rollback() + return make_error_response('internal_error', 'Failed to create run.', http_status=500) + + for rt_id in regression_test_ids: + ct = CustomizedTest(test.id, rt_id) + g.db.add(ct) + try: + g.db.commit() + except Exception: + g.db.rollback() + return make_error_response('internal_error', 'Failed to finalize run.', http_status=500) + + from mod_api.schemas.runs import RunSchema + return single_response(_serialize_run(test), schema=RunSchema(), http_status=202) + + +@mod_api.route('/runs/', methods=['GET']) +@require_scope('runs:read') +@validate_path_id('run_id') +def get_run(run_id): + """Fetch a single run by ID.""" + test = Test.query.filter(Test.id == run_id).first() + if test is None: + return make_error_response('not_found', f'Run {run_id} not found.', http_status=404) + + from mod_api.schemas.runs import RunSchema + return single_response(_serialize_run(test), schema=RunSchema()) + + +@mod_api.route('/runs//summary', methods=['GET']) +@require_scope('runs:read') +@validate_path_id('run_id') +def get_run_summary(run_id): + """ + Aggregate pass/fail/skip/missing/error counts from result rows. + + fail_count comes from TestResult rows, not from test.failed (which + only reflects cancellation status and is unreliable for this purpose). + """ + test = Test.query.filter(Test.id == run_id).first() + if test is None: + return make_error_response('not_found', f'Run {run_id} not found.', http_status=404) + + results = TestResult.query.filter_by(test_id=run_id).all() + total_samples = len(test.get_customized_regressiontests()) + + pass_count = 0 + fail_count = 0 + skipped_count = 0 + missing_count = 0 + total_runtime = 0 + + # Preload TestResultFiles + from collections import defaultdict + all_files = TestResultFile.query.filter_by( + test_id=run_id).all() if results else [] + files_by_result = defaultdict(list) + for f in all_files: + files_by_result[f.regression_test_id].append(f) + + for result in results: + result_files = files_by_result.get(result.regression_test_id, []) + + status = derive_sample_status(result, result_files) + + if status == 'pass': + pass_count += 1 + elif status == 'fail': + fail_count += 1 + elif status == 'missing_output': + missing_count += 1 + else: + skipped_count += 1 + + if result.runtime: + total_runtime += result.runtime + + # Retrieve error_count from the error service + from mod_api.services.error_service import derive_errors_for_run + error_count = len(derive_errors_for_run(run_id)) + + return single_response({ + 'run_id': run_id, + 'status': derive_run_status(test), + 'total_samples': total_samples, + 'pass_count': pass_count, + 'fail_count': fail_count, + 'skipped_count': skipped_count, + 'missing_output_count': missing_count, + 'error_count': error_count, + 'duration_ms': total_runtime if total_runtime > 0 else None, + 'triggered_by': None, + }) + + +@mod_api.route('/runs//progress', methods=['GET']) +@require_scope('runs:read') +@validate_path_id('run_id') +@validate_offset_pagination() +def get_run_progress(run_id, limit=50, offset=0): + """ + Get the timeline of progress events for a run, paginated. + + Events come from TestProgress rows written by the CI worker. + """ + test = Test.query.filter(Test.id == run_id).first() + if test is None: + return make_error_response('not_found', f'Run {run_id} not found.', http_status=404) + + query = TestProgress.query.filter_by(test_id=run_id) + + # Optional status filter. + status_filter = request.args.get('status') + if status_filter: + try: + status_enum = TestStatus.from_string(status_filter) + query = query.filter(TestProgress.status == status_enum) + except Exception: + return make_error_response( + 'validation_error', + f'Invalid status filter: {status_filter}.', + details={'fields': { + 'status': 'Must be one of: queued, preparation, testing, completed, canceled, error.' + }}, + http_status=400, + ) + + query = query.order_by(TestProgress.id.asc()) + total = query.count() + progress = query.offset(offset).limit(limit).all() + + events = [{ + 'timestamp': p.timestamp, + 'status': p.status.name, + 'message': p.message, + 'step': None, + } for p in progress] + + schema = ProgressEventSchema() + return paginated_response(events, total, limit, offset, schema=schema) + + +@mod_api.route('/runs//config', methods=['GET']) +@require_scope('runs:read') +@validate_path_id('run_id') +def get_run_config(run_id): + """Get the configuration that was used to launch this run.""" + test = Test.query.filter(Test.id == run_id).first() + if test is None: + return make_error_response('not_found', f'Run {run_id} not found.', http_status=404) + + regression_ids = test.get_customized_regressiontests() + + return single_response({ + 'run_id': run_id, + 'platform': test.platform.value, + 'branch': test.branch, + 'commit_sha': test.commit, + 'regression_test_ids': regression_ids, + }) + + +@mod_api.route('/runs//cancel', methods=['POST']) +@require_roles(['admin', 'contributor', 'tester']) +@require_scope('runs:write') +@validate_path_id('run_id') +def cancel_run(run_id): + """Cancel a running or queued test. + + Idempotent — canceling something already finished returns 202 + with status=no_op. + """ + test = Test.query.filter(Test.id == run_id).first() + if test is None: + return make_error_response('not_found', f'Run {run_id} not found.', http_status=404) + + status = derive_run_status(test) + if status in ('pass', 'fail', 'canceled', 'error'): + return single_response({ + 'run_id': run_id, + 'action': 'cancel', + 'status': 'no_op', + 'message': f'Run is already in terminal state: {status}', + }, http_status=202) + + user = g.api_user + reason = None + if request.is_json and request.get_json(silent=True): + reason = request.get_json(silent=True).get('reason') + if reason: + reason_str = str(reason).strip() + if len(reason_str) < 5: + return make_error_response( + 'validation_error', + 'Cancel reason must be at least 5 characters.', + details={'fields': {'reason': 'Minimum length is 5.'}}, + http_status=400, + ) + reason = reason_str[:255] + + cancel_msg = f'Canceled by {user.name} via API' if user else 'Canceled via API' + if reason: + cancel_msg = f'{cancel_msg}: {reason}' + + progress = TestProgress(run_id, TestStatus.canceled, cancel_msg) + g.db.add(progress) + g.db.commit() + + return single_response({ + 'run_id': run_id, + 'action': 'cancel', + 'status': 'accepted', + 'message': 'Run has been canceled.', + }, http_status=202) diff --git a/mod_api/routes/samples.py b/mod_api/routes/samples.py new file mode 100644 index 000000000..64b1431eb --- /dev/null +++ b/mod_api/routes/samples.py @@ -0,0 +1,509 @@ +""" +Sample and regression test routes. + +GET /runs/{id}/samples Per-run regression test results +GET /runs/{id}/samples/{sid} Single result in a run +GET /samples Media sample catalog +GET /samples/{id} Single media sample +GET /samples/{id}/history Cross-run history for a sample +GET /regression-tests Regression test definitions +""" + +from flask import request + +from mod_api import mod_api +from mod_api.middleware.auth import require_scope +from mod_api.middleware.error_handler import make_error_response +from mod_api.middleware.validation import (validate_date_range, + validate_offset_pagination, + validate_path_id) +from mod_api.services.status import (derive_output_status, + derive_sample_status, get_run_timestamps, + is_dummy_row) +from mod_api.utils import paginated_response, single_response +from mod_regression.models import Category, RegressionTest +from mod_sample.models import Sample +from mod_test.models import Test, TestResult, TestResultFile + + +def _serialize_outputs(result_files): + outputs = [] + for rf in result_files: + if is_dummy_row(rf): + continue + outputs.append({ + 'output_id': rf.regression_test_output_id, + 'filename': ( + rf.regression_test_output.create_correct_filename(rf.expected) + if rf.regression_test_output else rf.expected + ), + 'status': derive_output_status(rf), + }) + return outputs + + +def _serialize_run_sample(result, result_files): + """Build the per-regression-test result dict for a run.""" + status = derive_sample_status(result, result_files) + outputs = _serialize_outputs(result_files) + + sample_name = None + sample_id = None + command = None + categories = [] + + if result.regression_test: + rt = result.regression_test + command = rt.command + if rt.sample: + sample_id = rt.sample_id + sample_name = rt.sample.original_name + if rt.categories: + categories = [c.name for c in rt.categories] + + return { + 'regression_test_id': result.regression_test_id, + 'sample_id': sample_id, + 'sample_name': sample_name, + 'status': status, + 'exit_code': result.exit_code, + 'expected_rc': result.expected_rc, + 'runtime_ms': result.runtime, + 'command': command, + 'categories': categories, + 'outputs': outputs, + } + + +def _filter_run_samples_by_tag(serialized, tag_filter): + tag_lower = tag_filter.lower() + tagged_sample_ids = set() + + valid_sample_ids = [s['sample_id'] + for s in serialized if s.get('sample_id')] + samples = Sample.query.filter(Sample.id.in_( + valid_sample_ids)).all() if valid_sample_ids else [] + sample_map = {sample.id: sample for sample in samples} + + for s in serialized: + if s['sample_id']: + sample = sample_map.get(s['sample_id']) + if sample and any(tag_lower == t.name.lower() for t in sample.tags): + tagged_sample_ids.add(s['sample_id']) + return [s for s in serialized if s.get('sample_id') in tagged_sample_ids] + + +def _apply_run_sample_filters(serialized, args): + status_filter = args.get('status') + if status_filter: + serialized = [s for s in serialized if s['status'] == status_filter] + + name_filter = args.get('name') + if name_filter: + name_lower = name_filter.lower() + serialized = [s for s in serialized if s.get( + 'sample_name') and name_lower in s['sample_name'].lower()] + + tag_filter = args.get('tag') + if tag_filter: + serialized = _filter_run_samples_by_tag(serialized, tag_filter) + + category_filter = args.get('category') + if category_filter: + cat_lower = category_filter.lower() + serialized = [ + s for s in serialized + if s.get('categories') and cat_lower in [c.lower() for c in s['categories']] + ] + return serialized + + +@mod_api.route('/runs//samples', methods=['GET']) +@require_scope('runs:read') +@validate_path_id('run_id') +@validate_offset_pagination() +def list_run_samples(run_id, limit=50, offset=0): + """ + List per-sample results for a run, with optional filters. + + Supports ?status, ?name, ?tag, ?category query params. + """ + test = Test.query.filter(Test.id == run_id).first() + if test is None: + return make_error_response('not_found', f'Run {run_id} not found.', http_status=404) + + results = TestResult.query.filter_by(test_id=run_id).all() + + # Preload TestResultFiles + from collections import defaultdict + all_files = TestResultFile.query.filter_by( + test_id=run_id).all() if results else [] + files_by_result = defaultdict(list) + for f in all_files: + files_by_result[f.regression_test_id].append(f) + + # Serialize list to filter by derived status and joined fields + serialized = [] + for result in results: + result_files = files_by_result.get(result.regression_test_id, []) + serialized.append(_serialize_run_sample(result, result_files)) + + # Apply query param filters. + serialized = _apply_run_sample_filters(serialized, request.args) + + total = len(serialized) + paged = serialized[offset:offset + limit] + return paginated_response(paged, total, limit, offset) + + +@mod_api.route('/runs//samples/', methods=['GET']) +@require_scope('runs:read') +@validate_path_id('run_id') +@validate_path_id('regression_test_id') +def get_run_sample(run_id, regression_test_id): + """Get a single regression test result within a run.""" + test = Test.query.filter(Test.id == run_id).first() + if test is None: + return make_error_response('not_found', f'Run {run_id} not found.', http_status=404) + + result = TestResult.query.filter_by( + test_id=run_id, + regression_test_id=regression_test_id, + ).first() + if result is None: + return make_error_response( + 'not_found', + f'Regression test {regression_test_id} not found in run {run_id}.', + http_status=404, + ) + + result_files = TestResultFile.query.filter_by( + test_id=run_id, + regression_test_id=regression_test_id, + ).all() + + return single_response(_serialize_run_sample(result, result_files)) + + +@mod_api.route('/samples', methods=['GET']) +@require_scope('runs:read') +@validate_offset_pagination() +def list_samples(limit=50, offset=0): + """ + List media samples from the catalog. + + Supports ?name, ?extension, ?tag, ?sha256, ?status (active/inactive) filters. + """ + query = Sample.query + + name = request.args.get('name') + if name: + # Escape LIKE wildcards to prevent unintended pattern matching. + safe_name = name.replace('%', '\\%').replace('_', '\\_') + query = query.filter(Sample.original_name.ilike(f'%{safe_name}%')) + + extension = request.args.get('extension') + if extension: + query = query.filter(Sample.extension == extension) + + sha256_filter = request.args.get('sha256') + if sha256_filter: + query = query.filter(Sample.sha == sha256_filter) + + tag_filter = request.args.get('tag') + if tag_filter: + from sqlalchemy import func + + from mod_sample.models import Tag + query = query.filter(Sample.tags.any( + func.lower(Tag.name) == tag_filter.lower())) + + status_filter = request.args.get('status') + if status_filter: + want_active = status_filter.lower() == 'active' + if want_active: + query = query.filter(Sample.tests.any(RegressionTest.active == True)) # noqa: E712 + else: + query = query.filter(~Sample.tests.any(RegressionTest.active == True)) # noqa: E712 + + # Paginate at DB level without Python-side filters + total = query.count() + samples = query.offset(offset).limit(limit).all() + + # Batch load active regression test counts + from flask import g + from sqlalchemy import func + sample_ids = [s.id for s in samples] + counts_list = g.db.query( + RegressionTest.sample_id, + func.count(RegressionTest.id) + ).filter( + RegressionTest.sample_id.in_(sample_ids), + RegressionTest.active == True # noqa: E712 + ).group_by(RegressionTest.sample_id).all() if sample_ids else [] + counts = dict(counts_list) + + serialized = [] + for s in samples: + active_count = counts.get(s.id, 0) + serialized.append({ + 'sample_id': s.id, + 'sha': s.sha, + 'extension': s.extension, + 'original_name': s.original_name, + 'filename': s.filename, + 'tags': [t.name for t in s.tags], + 'regression_test_count': active_count, + 'active': active_count > 0, + }) + + return paginated_response(serialized, total, limit, offset) + + +@mod_api.route('/samples/', methods=['GET']) +@require_scope('runs:read') +@validate_path_id('sample_id') +def get_sample(sample_id): + """Get a single media sample by its ID.""" + sample = Sample.query.filter(Sample.id == sample_id).first() + if sample is None: + return make_error_response('not_found', f'Sample {sample_id} not found.', http_status=404) + + active_count = RegressionTest.query.filter_by( + sample_id=sample.id, active=True + ).count() + + return single_response({ + 'sample_id': sample.id, + 'sha': sample.sha, + 'extension': sample.extension, + 'original_name': sample.original_name, + 'filename': sample.filename, + 'tags': [t.name for t in sample.tags], + 'regression_test_count': active_count, + 'active': active_count > 0, + }) + + +def _get_history_failure_signature(result, result_files, status): + if status == 'fail': + for rf in result_files: + if rf.got is not None and not is_dummy_row(rf): + return f'diff_mismatch:output:{rf.regression_test_output_id}' + if result.exit_code != result.expected_rc: + return f'exit_code_mismatch:rc:{result.exit_code}' + elif status == 'missing_output': + return 'missing_output' + return None + + +def _process_history_entries(results, files_by_result, status_filter): + entries = [] + for result in results: + test = result.test + if test is None: + test = Test.query.get(result.test_id) + if test is None: + continue + + result_files = files_by_result.get( + (result.test_id, result.regression_test_id), []) + status = derive_sample_status(result, result_files) + + if status_filter and status != status_filter: + continue + + failure_sig = _get_history_failure_signature( + result, result_files, status) + timestamps = get_run_timestamps(test) + + entries.append({ + 'run_id': test.id, + 'regression_test_id': result.regression_test_id, + 'status': status, + 'platform': test.platform.value, + 'branch': test.branch, + 'commit_sha': test.commit, + 'tested_at': timestamps.get('completed_at') or timestamps.get('started_at'), + 'failure_signature': failure_sig, + }) + return entries + + +def _apply_history_filters(query, branch, platform, created_after, created_before): + if branch: + query = query.filter(Test.branch == branch) + + if platform: + try: + from mod_test.models import TestPlatform + platform_enum = TestPlatform.from_string(platform) + query = query.filter(Test.platform == platform_enum) + except Exception: + from mod_test.models import TestPlatform + valid_platforms = ', '.join(TestPlatform.values()) + return None, make_error_response( + 'validation_error', + f'Invalid platform: {platform}. Must be one of: {valid_platforms}.', + http_status=400, + ) + + if created_after or created_before: + from flask import g + from sqlalchemy import func + + from mod_test.models import TestProgress + first_progress = ( + g.db.query(TestProgress.test_id, func.min( + TestProgress.timestamp).label('min_ts')) + .group_by(TestProgress.test_id) + .subquery() + ) + query = query.join(first_progress, Test.id == first_progress.c.test_id) + if created_after: + query = query.filter(first_progress.c.min_ts >= created_after) + if created_before: + query = query.filter(first_progress.c.min_ts <= created_before) + + return query, None + + +@mod_api.route('/samples//history', methods=['GET']) +@require_scope('runs:read') +@validate_path_id('sample_id') +@validate_offset_pagination() +@validate_date_range +def get_sample_history(sample_id, limit=50, offset=0, created_after=None, created_before=None): + """ + Show how a sample performed across different runs. + + Use failure_signature to tell apart genuine regressions from infra flakes. + """ + sample = Sample.query.filter(Sample.id == sample_id).first() + if sample is None: + return make_error_response('not_found', f'Sample {sample_id} not found.', http_status=404) + + regression_tests = RegressionTest.query.filter_by( + sample_id=sample_id).all() + rt_ids = [rt.id for rt in regression_tests] + + if not rt_ids: + return paginated_response([], 0, limit, offset) + + query = TestResult.query.filter( + TestResult.regression_test_id.in_(rt_ids) + ).join(Test, Test.id == TestResult.test_id) + + branch = request.args.get('branch') + platform = request.args.get('platform') + + query, err = _apply_history_filters( + query, branch, platform, created_after, created_before) + if err: + return err + + results = query.order_by(Test.id.desc()).all() + + status_filter = request.args.get('status') + + # Preload TestResultFiles + from collections import defaultdict + test_ids = list({r.test_id for r in results}) + all_files = TestResultFile.query.filter( + TestResultFile.test_id.in_(test_ids)).all() if test_ids else [] + files_by_result = defaultdict(list) + for f in all_files: + files_by_result[(f.test_id, f.regression_test_id)].append(f) + + entries = _process_history_entries(results, files_by_result, status_filter) + + total = len(entries) + paged = entries[offset:offset + limit] + + from mod_api.schemas.samples import SampleHistoryEntrySchema + return paginated_response(paged, total, limit, offset, schema=SampleHistoryEntrySchema()) + + +def _serialize_rt(rt): + return { + 'regression_test_id': rt.id, + 'sample_id': rt.sample_id, + 'sample_name': rt.sample.original_name if rt.sample else None, + 'command': rt.command, + 'input_type': rt.input_type.value, + 'output_type': rt.output_type.value, + 'expected_rc': rt.expected_rc, + 'active': rt.active, + 'categories': [c.name for c in rt.categories], + 'description': rt.description, + } + + +def _filter_regression_tests_by_tag(query, tag_filter): + all_tests = query.all() + serialized = [] + for rt in all_tests: + if rt.sample: + sample_tags = [t.name.lower() for t in rt.sample.tags] + if tag_filter.lower() not in sample_tags: + continue + else: + continue # no sample = no tags to match + serialized.append(_serialize_rt(rt)) + return serialized + + +@mod_api.route('/regression-tests', methods=['GET']) +@require_scope('runs:read') +@validate_offset_pagination() +def list_regression_tests(limit=50, offset=0): + """ + List regression test definitions. + + Supports ?active, ?category, ?tag, ?sample_id filters. + """ + query = RegressionTest.query + + active_filter = request.args.get('active') + if active_filter is not None: + is_active = active_filter.lower() in ('true', '1', 'yes') + else: + is_active = True + query = query.filter(RegressionTest.active == is_active) + + category = request.args.get('category') + if category: + query = query.join(RegressionTest.categories).filter( + Category.name == category) + + sample_id_filter = request.args.get('sample_id') + if sample_id_filter: + try: + sid = int(sample_id_filter) + if sid < 1 or sid > 2147483647: + raise ValueError("Out of bounds") + query = query.filter(RegressionTest.sample_id == sid) + except (ValueError, TypeError): + return make_error_response( + 'validation_error', + 'sample_id must be a positive integer between 1 and 2147483647.', + details={'fields': { + 'sample_id': 'Must be a positive integer between 1 and 2147483647.'}}, + http_status=400, + ) + + tag_filter = request.args.get('tag') + + # Filter tags in Python before paginating + if tag_filter: + serialized = _filter_regression_tests_by_tag(query, tag_filter) + + total = len(serialized) + paged = serialized[offset:offset + limit] + return paginated_response(paged, total, limit, offset) + + # Paginate at DB level without tag filters + total = query.count() + tests = query.offset(offset).limit(limit).all() + serialized = [_serialize_rt(rt) for rt in tests] + return paginated_response(serialized, total, limit, offset) diff --git a/mod_api/routes/system.py b/mod_api/routes/system.py new file mode 100644 index 000000000..f0fda8409 --- /dev/null +++ b/mod_api/routes/system.py @@ -0,0 +1,333 @@ +""" +System, health, queue, and artifact routes. + +GET /system/health Health check (unauthenticated) +GET /system/queue Queue status — active + queued runs +GET /runs/{id}/artifacts Run artifacts from GCS + local storage +""" + +import os +from datetime import datetime, timezone + +from flask import g, jsonify, request +from sqlalchemy import text + +from mod_api import mod_api +from mod_api.middleware.auth import require_scope +from mod_api.middleware.error_handler import make_error_response +from mod_api.middleware.validation import (validate_offset_pagination, + validate_path_id) +from mod_api.services.status import derive_run_status, is_dummy_row +from mod_api.services.storage import (get_log_file_path, + get_test_results_base_path, + resolve_artifact) +from mod_api.utils import paginated_response +from mod_test.models import (Test, TestPlatform, TestProgress, TestResultFile, + TestStatus) + +OCTET_STREAM = 'application/octet-stream' + + +@mod_api.route('/system/health', methods=['GET']) +def system_health(): + """ + Public health check — no auth required. + + Returns 200 when things are ok or degraded, 503 when the system is down. + Monitoring services and load balancers can hit this freely. + """ + now = datetime.now(timezone.utc) + dependencies = [] + overall = 'ok' + + # Database connectivity. + try: + g.db.execute(text('SELECT 1')) + dependencies.append( + {'name': 'database', 'status': 'ok', 'message': None}) + except Exception: + dependencies.append( + {'name': 'database', 'status': 'down', 'message': 'Database connection failed.'}) + overall = 'down' + + # Local sample storage. + try: + from run import config + sample_repo = config.get('SAMPLE_REPOSITORY', '') + if os.path.isdir(sample_repo): + dependencies.append( + {'name': 'local_storage', 'status': 'ok', 'message': None}) + else: + dependencies.append({ + 'name': 'local_storage', + 'status': 'degraded', + 'message': 'Local storage check failed.', + }) + if overall == 'ok': + overall = 'degraded' + except Exception: + dependencies.append({'name': 'local_storage', 'status': 'down', + 'message': 'Local storage check failed.'}) + overall = 'down' + + # Google Cloud Storage. + try: + from run import storage_client_bucket + if storage_client_bucket: + dependencies.append( + {'name': 'gcs', 'status': 'ok', 'message': None}) + else: + dependencies.append( + {'name': 'gcs', 'status': 'degraded', 'message': 'GCS client not initialized.'}) + if overall == 'ok': + overall = 'degraded' + except Exception: + dependencies.append({'name': 'gcs', 'status': 'degraded', + 'message': 'GCS connectivity check failed.'}) + if overall == 'ok': + overall = 'degraded' + + http_status = 503 if overall == 'down' else 200 + response = jsonify({ + 'status': overall, + 'checked_at': now.isoformat(), + 'dependencies': dependencies, + }) + response.status_code = http_status + return response + + +def _apply_queue_filters(base_query, running_subq, queue_depth, running_count, status_filter): + if status_filter == 'queued': + query = base_query.filter(~Test.id.in_( + g.db.query(running_subq.c.test_id))) + total = queue_depth + elif status_filter == 'running': + query = base_query.filter(Test.id.in_( + g.db.query(running_subq.c.test_id))) + total = running_count + elif status_filter: + return None, None, make_error_response( + 'validation_error', 'Invalid status. Must be queued or running.', http_status=400 + ) + else: + query = base_query + total = queue_depth + running_count + return query, total, None + + +@mod_api.route('/system/queue', methods=['GET']) +@require_scope('system:read') +@validate_offset_pagination() +def get_queue(limit=50, offset=0): + """ + Return queued and running jobs. + + Excludes anything that's already completed or canceled. Supports + ?platform and ?status filters. + """ + terminal_subq = g.db.query( + TestProgress.test_id + ).filter( + TestProgress.status.in_([TestStatus.completed, TestStatus.canceled]) + ).group_by(TestProgress.test_id).subquery() + + running_subq = g.db.query( + TestProgress.test_id + ).filter( + TestProgress.status.in_([TestStatus.preparation, TestStatus.testing]) + ).group_by(TestProgress.test_id).subquery() + + base_query = Test.query.filter( + ~Test.id.in_(g.db.query(terminal_subq.c.test_id)) + ) + + platform_filter = request.args.get('platform') + if platform_filter: + try: + plat = TestPlatform.from_string(platform_filter) + base_query = base_query.filter(Test.platform == plat) + except Exception: + return make_error_response('validation_error', 'Invalid platform.', http_status=400) + + running_count = base_query.filter(Test.id.in_( + g.db.query(running_subq.c.test_id))).count() + queue_depth = base_query.filter(~Test.id.in_( + g.db.query(running_subq.c.test_id))).count() + + status_filter = request.args.get('status') + query, total, err = _apply_queue_filters( + base_query, running_subq, queue_depth, running_count, status_filter) + if err: + return err + + query = query.order_by(Test.id.asc()) + paged_tests = query.offset(offset).limit(limit).all() + + from mod_api.services.status import batch_get_run_data + statuses, timestamps = batch_get_run_data(paged_tests) + + paged_jobs = [] + queued_index = offset + 1 if status_filter == 'queued' else None + + for test in paged_tests: + status = statuses.get(test.id, 'queued') + ts = timestamps.get(test.id, {}) + + pos = None + if status == 'queued' and queued_index is not None: + pos = queued_index + queued_index += 1 + + paged_jobs.append({ + 'run_id': test.id, + 'status': status, + 'platform': test.platform.value, + 'queued_at': ts.get('queued_at').isoformat() if ts.get('queued_at') else None, + 'started_at': ts.get('started_at').isoformat() if ts.get('started_at') else None, + 'position': pos, + }) + + response = jsonify({ + 'queue_depth': queue_depth, + 'running_count': running_count, + 'data': paged_jobs, + 'pagination': { + 'limit': limit, + 'offset': offset, + 'total': total, + 'next_offset': offset + limit if (offset + limit) < total else None, + }, + }) + return response + + +def _get_gcs_artifacts(run_id, platform): + binary_name = ( + 'ccextractor' if platform == TestPlatform.linux + else 'ccextractorwinfull.exe' + ) + gcs_artifacts = [ + ('binary', + f'test_artifacts/{run_id}/{binary_name}', binary_name, OCTET_STREAM), + ('coredump', f'test_artifacts/{run_id}/coredump', + f'coredump-{run_id}', OCTET_STREAM), + ( + 'combined_stdout', + f'test_artifacts/{run_id}/combined_stdout.log', + f'combined_stdout-{run_id}.log', + 'text/plain', + ), + ] + artifacts = [] + for artifact_type, gcs_path, filename, content_type in gcs_artifacts: + download_url, storage_status = resolve_artifact(gcs_path) + artifacts.append({ + 'artifact_id': f'{artifact_type}_{run_id}', + 'run_id': run_id, + 'sample_id': None, + 'type': artifact_type, + 'filename': filename, + 'content_type': content_type, + 'size_bytes': None, + 'storage_status': storage_status, + 'download_url': download_url, + }) + return artifacts + + +def _get_output_artifacts(run_id): + artifacts = [] + result_files = TestResultFile.query.filter_by(test_id=run_id).all() + base_path = get_test_results_base_path() + from mod_api.routes.results import _safe_resolve + for rf in result_files: + if is_dummy_row(rf): + continue + + ext = rf.regression_test_output.correct_extension if rf.regression_test_output else '' + + expected_name = rf.expected + ext + expected_url, expected_status = resolve_artifact( + f'TestResults/{expected_name}') + local_expected = _safe_resolve(base_path, expected_name) + + artifacts.append({ + 'artifact_id': f'expected_{run_id}_{rf.regression_test_id}_{rf.regression_test_output_id}', + 'run_id': run_id, + 'sample_id': rf.regression_test_id, + 'type': 'expected_output', + 'filename': expected_name, + 'content_type': OCTET_STREAM, + 'size_bytes': ( + os.path.getsize(local_expected) + if local_expected and os.path.isfile(local_expected) else None + ), + 'storage_status': expected_status, + 'download_url': expected_url, + }) + + if rf.got is not None: + actual_name = rf.got + ext + actual_url, actual_status = resolve_artifact( + f'TestResults/{actual_name}') + local_actual = _safe_resolve(base_path, actual_name) + + artifacts.append({ + 'artifact_id': f'actual_{run_id}_{rf.regression_test_id}_{rf.regression_test_output_id}', + 'run_id': run_id, + 'sample_id': rf.regression_test_id, + 'type': 'sample_output', + 'filename': actual_name, + 'content_type': OCTET_STREAM, + 'size_bytes': ( + os.path.getsize(local_actual) + if local_actual and os.path.isfile(local_actual) else None + ), + 'storage_status': actual_status, + 'download_url': actual_url, + }) + return artifacts + + +@mod_api.route('/runs//artifacts', methods=['GET']) +@require_scope('results:read') +@validate_path_id('run_id') +@validate_offset_pagination() +def list_artifacts(run_id, limit=50, offset=0): + """ + List all artifacts for a run. + + Checks both GCS and local storage. Falls back to local when GCS + is unavailable. Supports ?type filter. + """ + test = Test.query.filter(Test.id == run_id).first() + if test is None: + return make_error_response('not_found', f'Run {run_id} not found.', http_status=404) + + artifacts = _get_gcs_artifacts(run_id, test.platform) + + # Build log — accessed via /runs/{id}/logs, no direct download link. + log_path = get_log_file_path(run_id) + artifacts.append({ + 'artifact_id': f'buildlog_{run_id}', + 'run_id': run_id, + 'sample_id': None, + 'type': 'build_log', + 'filename': f'{run_id}.txt', + 'content_type': 'text/plain', + 'size_bytes': os.path.getsize(log_path) if log_path else None, + 'storage_status': 'ok' if log_path else 'missing', + 'download_url': None, + }) + + artifacts.extend(_get_output_artifacts(run_id)) + + # Apply optional ?type filter. + type_filter = request.args.get('type') + if type_filter: + artifacts = [a for a in artifacts if a['type'] == type_filter] + + total = len(artifacts) + paged = artifacts[offset:offset + limit] + return paginated_response(paged, total, limit, offset) diff --git a/mod_api/schemas/__init__.py b/mod_api/schemas/__init__.py new file mode 100644 index 000000000..889960659 --- /dev/null +++ b/mod_api/schemas/__init__.py @@ -0,0 +1 @@ +"""mod_api.schemas: Marshmallow schemas for request/response validation.""" diff --git a/mod_api/schemas/auth.py b/mod_api/schemas/auth.py new file mode 100644 index 000000000..ddf92e088 --- /dev/null +++ b/mod_api/schemas/auth.py @@ -0,0 +1,69 @@ +"""Request/response schemas for the token endpoints.""" + +from marshmallow import RAISE, Schema, fields, validate + +from mod_api.models.api_token import VALID_SCOPES + +DATETIME_FORMAT = "%Y-%m-%dT%H:%M:%SZ" + + +class TokenCreateRequestSchema(Schema): + """Validates POST /auth/tokens bodies.""" + + email = fields.Email(required=True) + password = fields.String( + required=True, + validate=validate.Length(min=8, max=128), + ) + token_name = fields.String( + required=True, + validate=[ + validate.Length(min=1, max=50), + validate.Regexp( + r'^[a-zA-Z0-9_\-]+$', + error='token_name must match ^[a-zA-Z0-9_-]+$', + ), + ], + ) + expires_in_days = fields.Integer( + load_default=7, + validate=validate.Range(min=1, max=30), + ) + scopes = fields.List( + fields.String(validate=validate.OneOf(VALID_SCOPES)), + load_default=None, + validate=validate.Length(max=6), + ) + + class Meta: + """Reject unknown fields.""" + + unknown = RAISE + + +class AuthTokenSchema(Schema): + """The one-time response returned when a token is created.""" + + token = fields.String(required=True) + token_type = fields.String(dump_default='bearer') + token_name = fields.String(required=True) + scopes = fields.List(fields.String(), required=True) + expires_at = fields.DateTime(required=True, format=DATETIME_FORMAT) + + +class ApiTokenItemSchema(Schema): + """Token metadata for list responses — never includes the plaintext.""" + + id = fields.Integer(required=True) + user_id = fields.Integer(required=True) + token_name = fields.String(required=True) + token_prefix = fields.String(required=True) + scopes = fields.Method('get_scopes') + created_at = fields.DateTime(required=True, format=DATETIME_FORMAT) + expires_at = fields.DateTime(required=True, format=DATETIME_FORMAT) + is_revoked = fields.Boolean(required=True) + revoked_at = fields.DateTime(allow_none=True, format=DATETIME_FORMAT) + + def get_scopes(self, obj): + """Deserialize scopes from the model's JSON column.""" + return obj.scopes diff --git a/mod_api/schemas/common.py b/mod_api/schemas/common.py new file mode 100644 index 000000000..77462d5d2 --- /dev/null +++ b/mod_api/schemas/common.py @@ -0,0 +1,27 @@ +"""Shared schemas: ErrorResponse and pagination wrappers.""" + +from marshmallow import Schema, fields + + +class ErrorResponseSchema(Schema): + """Standard JSON error body returned by all error responses.""" + + code = fields.String(required=True) + message = fields.String(required=True) + details = fields.Dict(keys=fields.String(), required=True, load_default={}) + + +class PaginationSchema(Schema): + """Offset-based pagination metadata.""" + + limit = fields.Integer(required=True) + offset = fields.Integer(required=True) + total = fields.Integer(required=True) + next_offset = fields.Integer(allow_none=True, load_default=None) + + +class CursorPaginationSchema(Schema): + """Cursor-based pagination metadata.""" + + limit = fields.Integer(required=True) + next_cursor = fields.Integer(allow_none=True, load_default=None) diff --git a/mod_api/schemas/errors.py b/mod_api/schemas/errors.py new file mode 100644 index 000000000..c5cdd5339 --- /dev/null +++ b/mod_api/schemas/errors.py @@ -0,0 +1,54 @@ +"""Schemas for error items, error summary buckets, and log lines.""" + +from marshmallow import Schema, fields, validate + +DATETIME_FORMAT = "%Y-%m-%dT%H:%M:%SZ" + + +class ErrorItemSchema(Schema): + """A single error derived from run results or infra progress.""" + + error_id = fields.String(required=True) + run_id = fields.Integer(required=True) + sample_id = fields.Integer(allow_none=True) + regression_id = fields.Integer(allow_none=True) + type = fields.String(required=True) + severity = fields.String( + required=True, + validate=validate.OneOf(['info', 'warning', 'error', 'critical']), + ) + message = fields.String(required=True) + location = fields.Dict(allow_none=True, load_default=None) + stack = fields.List(fields.String(), load_default=None) + occurred_at = fields.DateTime(allow_none=True, format=DATETIME_FORMAT) + + +class ErrorSummaryBucketSchema(Schema): + """One bucket in a grouped error summary.""" + + key = fields.String(required=True) + count = fields.Integer(required=True) + severity = fields.String(required=True) + group_by = fields.String(allow_none=True) + sample_ids = fields.List(fields.Integer(), load_default=[]) + first_seen_at = fields.DateTime(allow_none=True, format=DATETIME_FORMAT) + last_seen_at = fields.DateTime(allow_none=True, format=DATETIME_FORMAT) + + +class LogLineSchema(Schema): + """A single parsed line from a build log.""" + + timestamp = fields.DateTime(allow_none=True, format=DATETIME_FORMAT) + level = fields.String( + required=True, + validate=validate.OneOf( + ['debug', 'info', 'warning', 'error', 'critical']), + ) + source = fields.String( + required=True, + validate=validate.OneOf( + ['orchestrator', 'worker', 'build', 'test_runner', 'web']), + ) + message = fields.String(required=True) + run_id = fields.Integer(required=True) + sample_id = fields.Integer(allow_none=True) diff --git a/mod_api/schemas/results.py b/mod_api/schemas/results.py new file mode 100644 index 000000000..95ba2efdf --- /dev/null +++ b/mod_api/schemas/results.py @@ -0,0 +1,91 @@ +"""Schemas for expected/actual output, diffs, and baseline approvals.""" + +from marshmallow import RAISE, Schema, fields, validate + + +class OutputFileContentSchema(Schema): + """File content blob returned for expected or actual output.""" + + run_id = fields.Integer(allow_none=True) + sample_id = fields.Integer(required=True) + regression_id = fields.Integer(required=True) + output_id = fields.Integer(required=True) + filename = fields.String(required=True) + content_type = fields.String(required=True) + encoding = fields.String( + required=True, validate=validate.OneOf(['utf-8', 'base64'])) + content = fields.String(required=True) + sha256 = fields.String(allow_none=True) + storage_status = fields.String( + required=True, + validate=validate.OneOf(['ok', 'degraded', 'missing']), + ) + + +class DiffHunkLineSchema(Schema): + """One line inside a diff hunk.""" + + kind = fields.String(required=True, validate=validate.OneOf( + ['context', 'added', 'removed'])) + expected_line = fields.Integer(allow_none=True) + actual_line = fields.Integer(allow_none=True) + text = fields.String(required=True) + + +class DiffHunkSchema(Schema): + """A contiguous block of changes.""" + + expected_start = fields.Integer(required=True) + actual_start = fields.Integer(required=True) + lines = fields.List(fields.Nested(DiffHunkLineSchema), required=True) + + +class DiffSchema(Schema): + """Structured diff between expected and actual output.""" + + run_id = fields.Integer(required=True) + sample_id = fields.Integer(required=True) + regression_id = fields.Integer(required=True) + output_id = fields.Integer(required=True) + status = fields.String(required=True, validate=validate.OneOf([ + 'identical', 'different', 'missing_actual', 'missing_expected', + ])) + summary = fields.Dict(required=True) + hunks = fields.List(fields.Nested(DiffHunkSchema), required=True) + + +class BaselineApprovalRequestSchema(Schema): + """POST /runs/{id}/samples/{sid}/baseline-approval body.""" + + regression_id = fields.Integer( + required=True, + validate=validate.Range(min=1), + ) + output_id = fields.Integer( + required=True, + validate=validate.Range(min=1), + ) + + remove_variants = fields.Boolean( + load_default=False, + ) + + class Meta: + """Reject unknown fields.""" + + unknown = RAISE + + +class BaselineApprovalSchema(Schema): + """Response after a baseline approval is applied.""" + + status = fields.String( + required=True, + validate=validate.OneOf( + ['approved'])) + run_id = fields.Integer(required=True) + sample_id = fields.Integer(required=True) + regression_id = fields.Integer(required=True) + output_id = fields.Integer(required=True) + requested_by = fields.String(required=True) + created_at = fields.DateTime(required=True, format='%Y-%m-%dT%H:%M:%SZ') diff --git a/mod_api/schemas/runs.py b/mod_api/schemas/runs.py new file mode 100644 index 000000000..93e42f1c7 --- /dev/null +++ b/mod_api/schemas/runs.py @@ -0,0 +1,120 @@ +"""Schemas for runs, summaries, progress events, and run actions.""" + +from marshmallow import RAISE, Schema, fields, validate + +DATETIME_FORMAT = "%Y-%m-%dT%H:%M:%SZ" + + +class ProgressEventSchema(Schema): + """A single progress event in a run's timeline.""" + + timestamp = fields.DateTime(required=True, format=DATETIME_FORMAT) + status = fields.String(required=True) + message = fields.String(required=True) + step = fields.Integer(allow_none=True) + + +class RunSchema(Schema): + """Full run details.""" + + run_id = fields.Integer(required=True) + status = fields.String(required=True, validate=validate.OneOf([ + 'queued', 'running', 'pass', 'fail', 'canceled', 'incomplete', + ])) + platform = fields.String( + required=True, validate=validate.OneOf(['linux', 'windows'])) + test_type = fields.String(validate=validate.OneOf(['commit', 'pr'])) + repository = fields.String(required=True) + branch = fields.String(allow_none=True) + commit_sha = fields.String(required=True) + pr_number = fields.Integer(allow_none=True, load_default=None) + created_at = fields.DateTime(allow_none=True, format=DATETIME_FORMAT) + queued_at = fields.DateTime(allow_none=True, format=DATETIME_FORMAT) + started_at = fields.DateTime(allow_none=True, format=DATETIME_FORMAT) + completed_at = fields.DateTime(allow_none=True, format=DATETIME_FORMAT) + github_link = fields.String(allow_none=True) + + +class RunSummarySchema(Schema): + """Pass/fail/skip aggregate counts for a run.""" + + run_id = fields.Integer(required=True) + status = fields.String(required=True) + total_samples = fields.Integer(required=True) + pass_count = fields.Integer(required=True) + fail_count = fields.Integer(required=True) + skipped_count = fields.Integer(required=True) + missing_output_count = fields.Integer(required=True) + error_count = fields.Integer(load_default=0) + duration_ms = fields.Integer(allow_none=True) + triggered_by = fields.String(allow_none=True) + + +class RunConfigSchema(Schema): + """The test matrix and configuration for a run.""" + + run_id = fields.Integer(required=True) + platform = fields.String(required=True) + branch = fields.String(required=True) + commit_sha = fields.String(required=True) + regression_test_ids = fields.List(fields.Integer(), required=True) + + +class RunCreateRequestSchema(Schema): + """POST /runs request body.""" + + commit_sha = fields.String( + required=True, + validate=validate.Regexp( + r'^[a-fA-F0-9]{40}$', + error='commit_sha must be a 40-character hex string.', + ), + ) + platform = fields.String( + required=True, + validate=validate.OneOf(['linux', 'windows']), + ) + branch = fields.String( + load_default='master', + validate=[ + validate.Length(max=100), + validate.Regexp( + r'^[A-Za-z0-9._-]+(/[A-Za-z0-9._-]+)*$', + error='branch must match ^[A-Za-z0-9._-]+(/[A-Za-z0-9._-]+)*$', + ), + ], + ) + repository = fields.String( + required=True, + validate=[ + validate.Length(max=100), + validate.Regexp( + r'^[a-zA-Z0-9_.\-]+/[a-zA-Z0-9_.\-]+$', + error='repository must match owner/repo format.', + ), + ], + ) + pull_request = fields.Integer( + load_default=None, + allow_none=True, + validate=validate.Range(min=1, max=2147483647), + ) + regression_test_ids = fields.List( + fields.Integer(validate=validate.Range(min=1, max=2147483647)), + load_default=None, + validate=validate.Length(max=500), + ) + + class Meta: + """Reject unknown fields.""" + + unknown = RAISE + + +class RunActionResultSchema(Schema): + """Response for cancel and similar run actions.""" + + run_id = fields.Integer(required=True) + action = fields.String(required=True) + status = fields.String(required=True) + message = fields.String(required=True) diff --git a/mod_api/schemas/samples.py b/mod_api/schemas/samples.py new file mode 100644 index 000000000..6998491c7 --- /dev/null +++ b/mod_api/schemas/samples.py @@ -0,0 +1,71 @@ +"""Request and response schemas for Sample endpoints and results.""" + +from marshmallow import Schema, fields, validate + + +class OutputFileSchema(Schema): + """Output file schema.""" + + output_id = fields.Integer(required=True) + filename = fields.String(required=True) + status = fields.String(required=True, validate=validate.OneOf([ + 'pass', 'fail', 'missing_output', + ])) + + +class RunSampleSchema(Schema): + """A regression test's result within a specific run.""" + + regression_test_id = fields.Integer(required=True) + sample_id = fields.Integer(allow_none=True) + sample_name = fields.String(allow_none=True) + status = fields.String(required=True, validate=validate.OneOf([ + 'pass', 'fail', 'skipped', 'missing_output', 'running', 'not_started', + ])) + exit_code = fields.Integer(allow_none=True) + expected_rc = fields.Integer(allow_none=True) + runtime_ms = fields.Integer(allow_none=True) + command = fields.String(allow_none=True) + categories = fields.List(fields.String(), load_default=[]) + outputs = fields.List(fields.Nested(OutputFileSchema), load_default=[]) + + +class SampleSchema(Schema): + """A media sample from the catalog.""" + + sample_id = fields.Integer(required=True) + sha = fields.String(required=True) + extension = fields.String(required=True) + original_name = fields.String(required=True) + filename = fields.String(required=True) + tags = fields.List(fields.String(), load_default=[]) + regression_test_count = fields.Integer(load_default=0) + active = fields.Boolean(load_default=True) + + +class SampleHistoryEntrySchema(Schema): + """One row in a sample's cross-run history.""" + + run_id = fields.Integer(required=True) + regression_test_id = fields.Integer(required=True) + status = fields.String(required=True) + platform = fields.String(required=True) + branch = fields.String(required=True) + commit_sha = fields.String(required=True) + tested_at = fields.DateTime(allow_none=True, format='%Y-%m-%dT%H:%M:%SZ') + failure_signature = fields.String(allow_none=True) + + +class RegressionTestSchema(Schema): + """A regression test definition.""" + + regression_test_id = fields.Integer(required=True) + sample_id = fields.Integer(allow_none=True) + sample_name = fields.String(allow_none=True) + command = fields.String(required=True) + input_type = fields.String(required=True) + output_type = fields.String(required=True) + expected_rc = fields.Integer(required=True) + active = fields.Boolean(required=True) + categories = fields.List(fields.String(), load_default=[]) + description = fields.String(allow_none=True) diff --git a/mod_api/schemas/system.py b/mod_api/schemas/system.py new file mode 100644 index 000000000..9febf5824 --- /dev/null +++ b/mod_api/schemas/system.py @@ -0,0 +1,63 @@ +"""Schemas for health checks, queue jobs, and run artifacts.""" + +from marshmallow import Schema, fields, validate + +DATETIME_FORMAT = "%Y-%m-%dT%H:%M:%SZ" + + +class DependencyHealthSchema(Schema): + """Status of a single system dependency (DB, GCS, local storage).""" + + name = fields.String(required=True) + status = fields.String( + required=True, validate=validate.OneOf(['ok', 'degraded', 'down'])) + message = fields.String(allow_none=True) + + +class SystemHealthSchema(Schema): + """Overall system health response.""" + + status = fields.String( + required=True, + validate=validate.OneOf(['ok', 'degraded', 'down']), + ) + checked_at = fields.DateTime(required=True, format=DATETIME_FORMAT) + dependencies = fields.List( + fields.Nested(DependencyHealthSchema), + required=True) + + +class QueueJobSchema(Schema): + """A single queued or running job.""" + + run_id = fields.Integer(required=True) + status = fields.String( + required=True, validate=validate.OneOf(['queued', 'running'])) + platform = fields.String( + required=True, validate=validate.OneOf(['linux', 'windows'])) + queued_at = fields.DateTime(allow_none=True, format=DATETIME_FORMAT) + started_at = fields.DateTime(allow_none=True, format=DATETIME_FORMAT) + position = fields.Integer(allow_none=True) + + +class ArtifactSchema(Schema): + """A downloadable artifact tied to a run.""" + + artifact_id = fields.String(required=True) + run_id = fields.Integer(required=True) + sample_id = fields.Integer(allow_none=True) + type = fields.String( + required=True, + validate=validate.OneOf([ + 'build_log', 'sample_output', 'expected_output', 'actual_output', + 'diff', 'media_info', 'binary', 'coredump', 'combined_stdout', + ]), + ) + filename = fields.String(required=True) + content_type = fields.String(required=True) + size_bytes = fields.Integer(allow_none=True) + storage_status = fields.String( + required=True, + validate=validate.OneOf(['ok', 'degraded', 'missing']), + ) + download_url = fields.String(allow_none=True) diff --git a/mod_api/services/__init__.py b/mod_api/services/__init__.py new file mode 100644 index 000000000..a1bbdb184 --- /dev/null +++ b/mod_api/services/__init__.py @@ -0,0 +1 @@ +"""mod_api.services — Core business logic for the API.""" diff --git a/mod_api/services/diff_service.py b/mod_api/services/diff_service.py new file mode 100644 index 000000000..53ced4c79 --- /dev/null +++ b/mod_api/services/diff_service.py @@ -0,0 +1,205 @@ +""" +Structured diff computation between expected and actual output files. + +Produces JSON hunks with line-level detail instead of the legacy HTML +diff output. Uses difflib.unified_diff internally. +""" + +import difflib +import hashlib +import os +import re +from typing import Any, Dict, List, Optional, Tuple + + +def compute_diff( + expected_path: str, + actual_path: str, + context_lines: int = 3, + max_hunks: int = 500, +) -> Dict[str, Any]: + """ + Compute a structured diff between two files. + + Returns a dict matching the Diff schema: status, summary (added_lines, + removed_lines, changed_hunks), and a list of hunks. + """ + context_lines = max(1, min(context_lines, 50)) + + if not os.path.isfile(expected_path): + return { + 'status': 'missing_expected', + 'summary': {'added_lines': 0, 'removed_lines': 0, 'changed_hunks': 0}, + 'hunks': [], + } + + if not os.path.isfile(actual_path): + return { + 'status': 'missing_actual', + 'summary': {'added_lines': 0, 'removed_lines': 0, 'changed_hunks': 0}, + 'hunks': [], + } + + expected_lines = read_lines(expected_path) + actual_lines = read_lines(actual_path) + + if expected_lines == actual_lines: + return { + 'status': 'identical', + 'summary': {'added_lines': 0, 'removed_lines': 0, 'changed_hunks': 0}, + 'hunks': [], + } + + hunks = _compute_hunks(expected_lines, actual_lines, + context_lines, max_hunks) + added = sum( + 1 for h in hunks for line in h['lines'] if line['kind'] == 'added') + removed = sum( + 1 for h in hunks for line in h['lines'] if line['kind'] == 'removed') + + return { + 'status': 'different', + 'summary': { + 'added_lines': added, + 'removed_lines': removed, + 'changed_hunks': len(hunks), + }, + 'hunks': hunks, + } + + +# Matches the @@ -a,b +c,d @@ header line from unified_diff. +_HUNK_RE = re.compile(r'^@@ -(\d+)(?:,\d+)? \+(\d+)(?:,\d+)? @@') + + +def _process_diff_line(line, current_hunk, expected_line_num, actual_line_num): + if line.startswith('+'): + current_hunk['lines'].append({ + 'kind': 'added', + 'expected_line': None, + 'actual_line': actual_line_num, + 'text': line[1:], + }) + actual_line_num += 1 + elif line.startswith('-'): + current_hunk['lines'].append({ + 'kind': 'removed', + 'expected_line': expected_line_num, + 'actual_line': None, + 'text': line[1:], + }) + expected_line_num += 1 + else: + content = line[1:] if line.startswith(' ') else line + current_hunk['lines'].append({ + 'kind': 'context', + 'expected_line': expected_line_num, + 'actual_line': actual_line_num, + 'text': content, + }) + expected_line_num += 1 + actual_line_num += 1 + return expected_line_num, actual_line_num + + +def _process_hunk_header( + line: str, + current_hunk: Optional[Dict[str, Any]], + hunks: List[Dict[str, Any]], + max_hunks: int +) -> Tuple[Optional[Dict[str, Any]], int, int, bool]: + if current_hunk and len(hunks) >= max_hunks: + return None, 0, 0, True + if current_hunk: + hunks.append(current_hunk) + + m = _HUNK_RE.match(line) + if m: + expected_line_num = int(m.group(1)) + actual_line_num = int(m.group(2)) + else: + expected_line_num = 0 + actual_line_num = 0 + + new_hunk = { + 'expected_start': expected_line_num, + 'actual_start': actual_line_num, + 'lines': [], + } + return new_hunk, expected_line_num, actual_line_num, False + + +def _compute_hunks( + expected_lines: List[str], + actual_lines: List[str], + context_lines: int, + max_hunks: int, +) -> List[Dict[str, Any]]: + """Parse unified_diff output into structured hunk dicts.""" + differ = difflib.unified_diff( + expected_lines, + actual_lines, + lineterm='', + n=context_lines, + ) + + hunks: List[Dict[str, Any]] = [] + current_hunk: Optional[Dict[str, Any]] = None + expected_line_num = 0 + actual_line_num = 0 + + for line in differ: + if line.startswith(('---', '+++')): + continue + + if line.startswith('@@'): + current_hunk, expected_line_num, actual_line_num, stop = _process_hunk_header( + line, current_hunk, hunks, max_hunks + ) + if stop: + break + continue + + if current_hunk is None: + continue + + expected_line_num, actual_line_num = _process_diff_line( + line, current_hunk, expected_line_num, actual_line_num) + + if current_hunk: + hunks.append(current_hunk) + + return hunks[:max_hunks] + + +def _enforce_safe_path(file_path: str) -> bool: + from mod_api.services.storage import get_test_results_base_path + base = os.path.realpath(get_test_results_base_path()) + target = os.path.realpath(file_path) + return target.startswith(base + os.sep) or target == base + + +def read_lines(file_path: str) -> List[str]: + """Read file lines with a cp1252 fallback, matching legacy behavior.""" + if not _enforce_safe_path(file_path): + raise ValueError("Unsafe file path") + try: + with open(file_path, encoding='utf8') as f: + return [line.rstrip('\n\r') for line in f.readlines()] + except UnicodeDecodeError: + with open(file_path, encoding='cp1252') as f: + return [line.rstrip('\n\r') for line in f.readlines()] + + +def file_sha256(file_path: str) -> Optional[str]: + """Compute SHA-256 of a file. Returns None if the file can't be read.""" + if not _enforce_safe_path(file_path): + return None + try: + sha = hashlib.sha256() + with open(file_path, 'rb') as f: + for block in iter(lambda: f.read(8192), b''): + sha.update(block) + return sha.hexdigest() + except (OSError, IOError): + return None diff --git a/mod_api/services/error_service.py b/mod_api/services/error_service.py new file mode 100644 index 000000000..3901f0329 --- /dev/null +++ b/mod_api/services/error_service.py @@ -0,0 +1,223 @@ +""" +Error derivation from TestResult and TestResultFile rows. + +Walks result data and produces structured ErrorItem dicts. There's no +dedicated error table — errors are inferred from: + exit_code_mismatch → exit code != expected + diff_mismatch → got != null and not in multiple correct files + missing_output → dummy (-1,-1,-1,'','error') row present +""" + +import logging +from typing import Any, Dict, List + +from mod_api.services.status import is_dummy_row +from mod_test.models import TestResult, TestResultFile + +_SEVERITY_ORDER = ('info', 'warning', 'error', 'critical') + + +def _is_output_acceptable(rf: TestResultFile) -> bool: + if not rf.regression_test_output: + return False + for multi in rf.regression_test_output.multiple_files: + if multi.file_hashes == rf.got: + return True + return False + + +def _evaluate_test_result(result, result_files, test_id, occurred_at): + errors = [] + if result.exit_code != result.expected_rc: + errors.append({ + 'error_id': f'err_{test_id}_{result.regression_test_id}_rc', + 'run_id': test_id, + 'sample_id': _get_sample_id(result), + 'regression_id': result.regression_test_id, + 'type': 'exit_code_mismatch', + 'severity': 'error', + 'message': ( + f'Exit code {result.exit_code} != expected {result.expected_rc} ' + f'for regression test {result.regression_test_id}' + ), + 'occurred_at': occurred_at, + }) + + for rf in result_files: + if is_dummy_row(rf): + errors.append({ + 'error_id': f'err_{test_id}_{result.regression_test_id}_missing', + 'run_id': test_id, + 'sample_id': _get_sample_id(result), + 'regression_id': result.regression_test_id, + 'type': 'missing_output', + 'severity': 'error', + 'message': ( + f'Regression test {result.regression_test_id} ' + f'produced no output when output was expected' + ), + 'occurred_at': occurred_at, + }) + elif rf.got is not None and not _is_output_acceptable(rf): + errors.append({ + 'error_id': f'err_{test_id}_{result.regression_test_id}_{rf.regression_test_output_id}', + 'run_id': test_id, + 'sample_id': _get_sample_id(result), + 'regression_id': result.regression_test_id, + 'type': 'diff_mismatch', + 'severity': 'warning', + 'message': ( + f'Output differs from expected for regression test ' + f'{result.regression_test_id}, output {rf.regression_test_output_id}' + ), + 'occurred_at': occurred_at, + }) + return errors + + +def derive_errors_for_run(test_id: int) -> List[Dict[str, Any]]: + """Walk result rows and emit one ErrorItem per detected failure.""" + from mod_test.models import TestProgress + progress = TestProgress.query.filter_by(test_id=test_id).order_by( + TestProgress.timestamp.desc()).first() + occurred_at = progress.timestamp.isoformat( + ) if progress and progress.timestamp else None + + errors = [] + results = TestResult.query.filter_by(test_id=test_id).all() + + # Preload TestResultFiles + from collections import defaultdict + + from sqlalchemy.orm import joinedload + + from mod_regression.models import RegressionTestOutput + all_files = ( + TestResultFile.query.options( + joinedload(TestResultFile.regression_test_output) + .joinedload(RegressionTestOutput.multiple_files) + ) + .filter_by(test_id=test_id).all() if results else [] + ) + files_by_result = defaultdict(list) + for f in all_files: + files_by_result[f.regression_test_id].append(f) + + for result in results: + result_files = files_by_result.get(result.regression_test_id, []) + errors.extend(_evaluate_test_result( + result, result_files, test_id, occurred_at)) + + return errors + + +def _aggregate_error_into_bucket(err, bucket): + bucket['count'] += 1 + + # Escalate severity to the worst we've seen. + try: + curr_idx = _SEVERITY_ORDER.index(bucket['severity']) + new_idx = _SEVERITY_ORDER.index(err['severity']) + if new_idx > curr_idx: + bucket['severity'] = err['severity'] + except ValueError: + # Fallback if unknown severity + if err['severity'] == 'error': + bucket['severity'] = 'error' + + err_time = err.get('occurred_at') + if err_time: + if bucket['first_seen_at'] is None or err_time < bucket['first_seen_at']: + bucket['first_seen_at'] = err_time + if bucket['last_seen_at'] is None or err_time > bucket['last_seen_at']: + bucket['last_seen_at'] = err_time + + sid = err.get('sample_id') + if sid and sid not in bucket['sample_ids'] and len(bucket['sample_ids']) < 1000: + bucket['sample_ids'].append(sid) + + +def derive_error_summary(test_id: int, group_by: str = 'type') -> List[Dict[str, Any]]: + """Group errors by the given key and return bucket counts.""" + errors = derive_errors_for_run(test_id) + buckets: Dict[str, Dict[str, Any]] = {} + + for err in errors: + key = str(err.get(group_by, 'unknown')) + + if key not in buckets: + buckets[key] = { + 'key': key, + 'group_by': group_by, + 'count': 0, + 'severity': err['severity'], + 'sample_ids': [], + 'first_seen_at': None, + 'last_seen_at': None, + } + + _aggregate_error_into_bucket(err, buckets[key]) + + return list(buckets.values()) + + +def derive_infrastructure_errors(test_id: int) -> List[Dict[str, Any]]: + """ + Best-effort infra error extraction from TestProgress messages. + + There's no structured error protocol from the CI worker yet, so we + do keyword matching against progress messages to guess the failure type. + """ + from mod_test.models import TestProgress, TestStatus + + errors = [] + progress_rows = TestProgress.query.filter_by( + test_id=test_id, + status=TestStatus.canceled, + ).all() + + for p in progress_rows: + msg_lower = (p.message or '').lower() + error_type = _classify_infra_error(msg_lower) + errors.append({ + 'error_id': f'infra_{test_id}_{p.id}', + 'run_id': test_id, + 'sample_id': None, + 'regression_id': None, + 'type': error_type, + 'severity': 'critical', + 'message': p.message or 'Unknown infrastructure error', + 'location': None, + 'occurred_at': p.timestamp.isoformat() if p.timestamp else None, + }) + + return errors + + +def _classify_infra_error(message_lower: str) -> str: + """Guess the infra error type from progress message keywords.""" + if any(w in message_lower for w in ['provisioning', 'vm ', 'instance']): + return 'vm_provisioning' + if any(w in message_lower for w in ['checkout', 'git clone', 'fetch']): + return 'checkout' + if any(w in message_lower for w in ['merge', 'conflict']): + return 'merge' + if any(w in message_lower for w in ['build', 'compile', 'make']): + return 'build' + if any(w in message_lower for w in ['worker', 'timeout', 'connection']): + return 'worker' + if any(w in message_lower for w in ['storage', 'disk', 'gcs']): + return 'storage' + return 'worker' + + +def _get_sample_id(result: TestResult): + """Pull sample_id through the RegressionTest relationship, if available.""" + try: + if result.regression_test and result.regression_test.sample_id: + return result.regression_test.sample_id + except Exception: + logging.getLogger(__name__).exception( + f"Failed to fetch sample_id for TestResult {result.test_id}_{result.regression_test_id}" + ) + return None diff --git a/mod_api/services/log_service.py b/mod_api/services/log_service.py new file mode 100644 index 000000000..01ed8ee38 --- /dev/null +++ b/mod_api/services/log_service.py @@ -0,0 +1,121 @@ +""" +Build log reader with cursor-based pagination. + +Log files live at SAMPLE_REPOSITORY/LogFiles/{run_id}.txt. The cursor +is just a line number offset into the file. +""" + +from typing import Any, Dict, List, Optional, Tuple + +from mod_api.services.storage import get_log_file_path + + +def _parse_cursor(cursor: Optional[int]) -> int: + if not cursor: + return 0 + try: + return int(cursor) + except (ValueError, TypeError): + return 0 + + +def _format_log_line(raw: str, run_id: int) -> Dict[str, Any]: + return { + 'timestamp': None, + 'level': _extract_level(raw), + 'source': _extract_source(raw), + 'message': raw, + 'run_id': run_id, + 'sample_id': None, + } + + +def _should_include_line(raw: str, level: Optional[str], source: Optional[str], contains: Optional[str]) -> bool: + if level and not _matches_level(raw, level): + return False + if source and _extract_source(raw) != source: + return False + if contains and contains.lower() not in raw.lower(): + return False + return True + + +def read_log_lines( + run_id: int, + cursor: Optional[str] = None, + limit: int = 100, + level: Optional[str] = None, + source: Optional[str] = None, + contains: Optional[str] = None, +) -> Tuple[List[Dict[str, Any]], Optional[str]]: + """ + Read and optionally filter lines from a run's build log. + + Returns (lines, next_cursor). Raises FileNotFoundError when the + log file isn't on disk. + """ + log_path = get_log_file_path(run_id) + if log_path is None: + raise FileNotFoundError(f'Log file not found for run {run_id}') + + limit = max(1, min(limit, 500)) + + start_line = _parse_cursor(cursor) + + import itertools + + def _read_lines(encoding): + with open(log_path, encoding=encoding) as f: + iterator = itertools.islice(f, start_line, None) + + result_lines = [] + line_num = start_line + + for raw_line in iterator: + raw = raw_line.rstrip('\n\r') + line_num += 1 + + if not _should_include_line(raw, level, source, contains): + continue + + result_lines.append(_format_log_line(raw, run_id)) + + if len(result_lines) >= limit: + break + + try: + next(iterator) + has_more = True + except StopIteration: + has_more = False + + next_cursor = str(line_num) if has_more else None + return result_lines, next_cursor + + try: + return _read_lines('utf-8') + except UnicodeDecodeError: + return _read_lines('cp1252') + + +def _matches_level(line: str, target_level: str) -> bool: + """Check if a log line matches the requested severity.""" + return _extract_level(line) == target_level + + +def _extract_level(line: str) -> str: + """Best-effort log level extraction from raw text.""" + line_upper = line.upper() + for lvl in ['CRITICAL', 'ERROR', 'WARNING', 'INFO', 'DEBUG']: + if lvl in line_upper: + return lvl.lower() + return 'info' + + +def _extract_source(line: str) -> str: + """Best-effort source component extraction from raw text.""" + line_lower = line.lower() + for src in ['orchestrator', 'worker', 'build', 'test_runner', 'web']: + if src in line_lower: + return src + return 'web' diff --git a/mod_api/services/status.py b/mod_api/services/status.py new file mode 100644 index 000000000..4a202c93e --- /dev/null +++ b/mod_api/services/status.py @@ -0,0 +1,214 @@ +""" +Status derivation from the raw data model. + +Normalizes TestProgress/TestResult/TestResultFile states into clean +strings for the API layer. This is the single source of truth for +status logic — route handlers must not inline their own derivation. + +Run statuses: queued, running, pass, fail, canceled, error, incomplete +Sample statuses: pass, fail, skipped, missing_output, running, not_started + +Things to watch out for: + - test.failed only checks for TestStatus.canceled — never use it + for determining whether regression tests actually passed + - TestResultFile.got = null means MATCH, not missing output + - Dummy row (-1,-1,-1,'','error') = test produced no output at all + - TestStatus.canceled covers both user cancels and infra failures +""" + +from typing import List, Optional + +from mod_test.models import (Test, TestProgress, TestResult, TestResultFile, + TestStatus) + + +def derive_run_status(test: Test) -> str: + """ + Map the raw model state to one of the 7 normalized run statuses. + + Looks at the most recent TestProgress row and, for completed runs, + counts actual failures from TestResult rows. + """ + statuses, _ = batch_get_run_data([test]) + return statuses.get(test.id, 'queued') + + +def _check_output_acceptable(rf: TestResultFile) -> bool: + if rf.regression_test_output: + for multi in rf.regression_test_output.multiple_files: + if multi.file_hashes == rf.got: + return True + return False + + +def derive_sample_status( + test_result: Optional[TestResult], + result_files: List[TestResultFile], +) -> str: + """ + Map a TestResult + its output files to a per-sample status string. + + Checks for the dummy sentinel row first (missing_output), then exit + code, then output diffs against accepted baselines. + """ + if test_result is None: + return 'not_started' + + for rf in result_files: + if is_dummy_row(rf): + return 'missing_output' + + if test_result.exit_code != test_result.expected_rc: + return 'fail' + + for rf in result_files: + if rf.got is not None and not _check_output_acceptable(rf): + return 'fail' + + # All got == null → every output matched expected. + return 'pass' + + +def is_dummy_row(rf: TestResultFile) -> bool: + """ + Detect the sentinel TestResultFile row where regression_test_output_id == -1 and got == 'error'. + + This row means the test produced no output when output was expected. + The old test_id == -1 and regression_test_id == -1 checks were removed + because they are no longer populated as -1 in newer data. + It should never show up as a real file in API responses. + + DEPLOYMENT PREREQUISITE: Before deploying this change, verify that no + old-format sentinel rows exist that would be missed by the new detection. + Run against production: + + SELECT COUNT(*) + FROM test_result_file + WHERE (test_id = -1 OR regression_test_id = -1) + AND NOT (regression_test_output_id = -1 AND got = 'error'); + + If result > 0, those rows need a data migration to normalize them + before this code is deployed. Include the query output in the PR + description as evidence. + """ + return bool(rf.regression_test_output_id == -1 and rf.got == 'error') + + +def derive_output_status(rf: TestResultFile) -> str: + """Classify a single output file: pass, fail, or missing_output.""" + if is_dummy_row(rf): + return 'missing_output' + if rf.got is None: + return 'pass' + return 'fail' + + +def get_run_timestamps(test: Test) -> dict: + """ + Build a timestamp dict from TestProgress rows. + + Test doesn't have a created_at column, so we use the earliest + progress entry as a proxy. + """ + _, timestamps = batch_get_run_data([test]) + ts = timestamps.get(test.id, {}) + return { + 'created_at': ts.get('created_at'), + 'queued_at': ts.get('queued_at'), + 'started_at': ts.get('started_at'), + 'completed_at': ts.get('completed_at'), + } + + +def _compute_run_timestamps(t_prog): + ts = { + 'created_at': None, + 'queued_at': None, + 'started_at': None, + 'completed_at': None, + } + if t_prog: + ts['queued_at'] = t_prog[0].timestamp + ts['created_at'] = t_prog[0].timestamp + for p in t_prog: + if p.status == TestStatus.testing and ts['started_at'] is None: + ts['started_at'] = p.timestamp + if p.status in (TestStatus.completed, TestStatus.canceled): + ts['completed_at'] = p.timestamp + return ts + + +def _compute_run_status(t_prog, results_by_test, files_by_test_and_rt, t_id): + if not t_prog: + return 'queued' + + latest = t_prog[-1] + raw_status = latest.status + + if raw_status in (TestStatus.preparation, TestStatus.testing): + return 'running' + elif raw_status == TestStatus.canceled: + return 'canceled' + elif raw_status == TestStatus.completed: + fail_count = 0 + for r in results_by_test.get(t_id, []): + r_files = files_by_test_and_rt.get( + (t_id, r.regression_test_id), []) + sample_status = derive_sample_status(r, r_files) + if sample_status not in ('pass', 'not_started'): + fail_count += 1 + return 'fail' if fail_count > 0 else 'pass' + else: + return 'incomplete' + + +def batch_get_run_data(tests: list) -> tuple: + """ + Batch compute derive_run_status and get_run_timestamps for a list of tests. + + Returns (statuses_dict, timestamps_dict) + """ + if not tests: + return {}, {} + + test_ids = [t.id for t in tests] + + # Preload TestProgress + all_progress = TestProgress.query.filter(TestProgress.test_id.in_( + test_ids)).order_by(TestProgress.id.asc()).all() + progress_by_test = {tid: [] for tid in test_ids} + for p in all_progress: + progress_by_test[p.test_id].append(p) + + # Preload TestResult + all_results = TestResult.query.filter( + TestResult.test_id.in_(test_ids)).all() + results_by_test = {tid: [] for tid in test_ids} + for r in all_results: + results_by_test[r.test_id].append(r) + + # Preload TestResultFile + from sqlalchemy.orm import joinedload + + from mod_regression.models import RegressionTestOutput + all_files = TestResultFile.query.options( + joinedload(TestResultFile.regression_test_output) + .joinedload(RegressionTestOutput.multiple_files) + ).filter(TestResultFile.test_id.in_(test_ids)).all() + files_by_test_and_rt = {} + for f in all_files: + key = (f.test_id, f.regression_test_id) + if key not in files_by_test_and_rt: + files_by_test_and_rt[key] = [] + files_by_test_and_rt[key].append(f) + + statuses = {} + timestamps_dict = {} + + for t in tests: + t_prog = progress_by_test[t.id] + timestamps_dict[t.id] = _compute_run_timestamps(t_prog) + statuses[t.id] = _compute_run_status( + t_prog, results_by_test, files_by_test_and_rt, t.id) + + return statuses, timestamps_dict diff --git a/mod_api/services/storage.py b/mod_api/services/storage.py new file mode 100644 index 000000000..20b8ada21 --- /dev/null +++ b/mod_api/services/storage.py @@ -0,0 +1,65 @@ +""" +Storage helpers for resolving artifact locations. + +Artifacts can live in local SAMPLE_REPOSITORY, GCS, or both. When both +exist, GCS is preferred and a signed URL is returned. When only local +exists, storage_status is 'degraded'. When neither exists, it's 'missing'. +""" + +import os +from datetime import timedelta +from typing import Optional, Tuple + + +def resolve_artifact(relative_path: str) -> Tuple[Optional[str], str]: + """ + Look for an artifact in local storage and GCS. + + Returns (download_url_or_None, storage_status). + """ + from run import config, storage_client_bucket + + sample_repo = config.get('SAMPLE_REPOSITORY', '') + local_path = os.path.join(sample_repo, relative_path) + local_exists = os.path.isfile(local_path) + + gcs_url = None + if storage_client_bucket: + try: + blob = storage_client_bucket.blob(relative_path) + gcs_url = blob.generate_signed_url( + version='v4', + expiration=timedelta(minutes=config.get( + 'GCS_SIGNED_URL_EXPIRY_LIMIT', 60)), + method='GET', + ) + except Exception: + gcs_url = None + + if local_exists and gcs_url: + return gcs_url, 'ok' + elif gcs_url: + # We don't block on blob.exists(), so we let the client handle 404s + return gcs_url, 'degraded' + elif local_exists: + return None, 'degraded' + else: + return None, 'missing' + + +def get_log_file_path(run_id: int) -> Optional[str]: + """Return the absolute path to a run's build log, or None if it doesn't exist.""" + from run import config + + sample_repo = config.get('SAMPLE_REPOSITORY', '') + log_path = os.path.join(sample_repo, 'LogFiles', f'{run_id}.txt') + + if os.path.isfile(log_path): + return log_path + return None + + +def get_test_results_base_path() -> str: + """Return the base directory where TestResults files are stored.""" + from run import config + return os.path.join(config.get('SAMPLE_REPOSITORY', ''), 'TestResults') diff --git a/mod_api/utils.py b/mod_api/utils.py new file mode 100644 index 000000000..40014ae54 --- /dev/null +++ b/mod_api/utils.py @@ -0,0 +1,72 @@ +"""Pagination, serialization, and response formatting helpers.""" + +from flask import jsonify + + +def paginated_response(data, total, limit, offset, schema=None, truncated=False): + """Build an offset-paginated JSON response.""" + if schema: + serialized = schema.dump(data, many=True) + else: + serialized = data + + next_offset = offset + limit if (offset + limit) < total else None + + pagination = { + 'limit': limit, + 'offset': offset, + 'total': total, + 'next_offset': next_offset, + } + if truncated: + pagination['truncated'] = True + + return jsonify({ + 'data': serialized, + 'pagination': pagination, + }) + + +def cursor_paginated_response(data, next_cursor, limit, schema=None): + """Build a cursor-paginated JSON response.""" + if schema: + serialized = schema.dump(data, many=True) + else: + serialized = data + + return jsonify({ + 'data': serialized, + 'pagination': { + 'limit': limit, + 'next_cursor': next_cursor, + }, + }) + + +def single_response(data, schema=None, http_status=200): + """Build a single-item JSON response.""" + if schema: + serialized = schema.dump(data) + else: + serialized = data + + response = jsonify(serialized) + response.status_code = http_status + return response + + +def get_sort_column(sort_param, column_map): + """Translate a sort string into an SQLAlchemy order_by clause. + + Handles descending sorts prefixed with '-' (e.g. '-created_at'). + """ + descending = sort_param.startswith('-') + field_name = sort_param.lstrip('-') + + column = column_map.get(field_name) + if column is None: + return None + + if descending: + return column.desc() + return column.asc() diff --git a/mod_auth/controllers.py b/mod_auth/controllers.py index a476b9afc..2d6e4d072 100755 --- a/mod_auth/controllers.py +++ b/mod_auth/controllers.py @@ -165,26 +165,37 @@ def github_redirect(): return f'https://github.com/login/oauth/authorize?client_id={github_client_id}&scope=public_repo' -def fetch_username_from_token() -> Any: +def fetch_username_from_token(user=None) -> Any: """ Get username from the GitHub token. + :param user: Optional user model to prevent redundant queries :return: username :rtype: str """ import json - user = User.query.filter(User.id == g.user.id).first() + + from flask import current_app + + if user is None: + user = User.query.filter(User.id == g.user.id).first() + + if current_app.config.get('TESTING'): + return 'testuser' + if user.github_token is None: return None url = 'https://api.github.com/user' session = requests.Session() session.auth = (user.email, user.github_token) try: - response = session.get(url) + response = session.get(url, timeout=(3.05, 10)) data = response.json() - return data['login'] + return data.get('login') except Exception as e: - g.log.error('Failed to fetch the user token') + import logging + log = getattr(g, 'log', logging.getLogger(__name__)) + log.error('Failed to fetch the user token') return None @@ -211,6 +222,12 @@ def github_callback(): if 'access_token' in response: user = User.query.filter(User.id == g.user.id).first() user.github_token = response['access_token'] + + # Fetch and store github_login + github_login = fetch_username_from_token(user) + if github_login: + user.github_login = github_login + g.db.commit() else: g.log.error("GitHub didn't return an access token") diff --git a/mod_auth/models.py b/mod_auth/models.py index 16233e98a..a21c48833 100644 --- a/mod_auth/models.py +++ b/mod_auth/models.py @@ -32,6 +32,7 @@ class User(Base): name = Column(String(50), unique=True) email = Column(String(255), unique=True, nullable=True) github_token = Column(Text(), nullable=True) + github_login = Column(String(255), nullable=True) password = Column(String(255), unique=False, nullable=False) role = Column(Role.db_type()) diff --git a/openapi-ci-api.yaml b/openapi-ci-api.yaml new file mode 100644 index 000000000..4189bc67c --- /dev/null +++ b/openapi-ci-api.yaml @@ -0,0 +1,2840 @@ +openapi: 3.0.3 +info: + title: CCExtractor CI System API + version: 1.2.0 + description: | + Security-hardened JSON-only REST API for the CCExtractor CI/sample platform. + Designed for AI agents and CI automation. Enforces scoped Bearer token auth, + strict input validation, rate limiting on all routes, and safe defaults + throughout. No browser sessions, no HTML, no implicit permissions. + + **Authentication:** All endpoints require bearer token authentication unless + explicitly marked with `security: []` (only /system/health and POST /auth/tokens). + + **Rate-limit headers:** Every response includes `X-RateLimit-Limit`, + `X-RateLimit-Remaining`, and `X-RateLimit-Reset` headers. These are modeled + explicitly on the 429 response for brevity; they are present on all responses + regardless of status code. + + contact: + name: CCExtractor Development + url: https://github.com/CCExtractor/sample-platform + license: + name: GPL-3.0-only + url: https://www.gnu.org/licenses/gpl-3.0.html + +servers: + - url: http://localhost:5000/api/v1 + description: Local development server + - url: https://sampleplatform.ccextractor.org/api/v1 + description: Production + +# +# Global security: all endpoints require auth +# unless explicitly overridden with security: [] +# +security: + - bearerAuth: [] + +tags: + - name: Auth + description: Token issuance and revocation + - name: Runs + description: CI run lifecycle — list, inspect, trigger, and cancel + - name: Samples + description: Media samples and regression test definitions + - name: Results + description: Per-sample output, diffs, and baseline management + - name: Errors and Logs + description: Structured errors and raw log access + - name: System + description: Health, queue, and artifacts + +# +# SECURITY NOTES (implementers must read) +# +# 1. AUTH MODEL +# - All tokens are opaque, server-side. Never expose session cookies via API. +# - The CI worker token (/ci/progress-reporter) is a separate secret and is +# NOT valid for user-facing API endpoints. +# - Token creation is rate-limited to 5 req/15 min per IP to prevent +# credential stuffing. +# +# 2. SCOPE ENFORCEMENT +# - Scope checks happen at the middleware layer before route handlers. +# - x-required-scope on each operation defines the minimum scope needed. +# - Missing scope → 403 Forbidden (not 401, token is valid but insufficient). +# +# 3. INPUT VALIDATION +# - additionalProperties: false on all request bodies (no mass-assignment). +# - Regex patterns on all free-text IDs (commit_sha, sha256, repository). +# - maxLength on every string field. maxItems on every array. +# - Integer IDs have minimum: 1 (no zero or negative IDs). +# +# 4. OUTPUT SAFETY +# - got=null in TestResultFile means match, not missing output. +# The dummy row (-1,-1,-1,'','error') is translated server-side to +# status=missing_output and never surfaced as a real object. +# - test.failed reflects cancellation only; fail_count is computed from +# TestResult rows. Do not expose test.failed directly. +# - Stack traces in infrastructure errors are opt-in (include_stack=false +# by default) to avoid leaking internal paths. +# +# 5. STORAGE +# - Artifacts may exist in local SAMPLE_REPOSITORY, GCS, or both. +# - storage_status=degraded means one backend only; missing means neither. +# - Never return a download_url that has not been verified to exist. +# - Log endpoints return 404 (not a broken download link) when the log +# file is absent from both storage backends. +# +# 6. RATE LIMITING (all routes) +# - Default: 120 req/min per token (reads), 20 req/min per token (writes). +# - Auth endpoint: 5 req/15 min per IP. +# - Every response includes X-RateLimit-Limit, X-RateLimit-Remaining, +# X-RateLimit-Reset headers. +# - 429 response includes Retry-After header (seconds). +# +# 7. IDEMPOTENCY +# - POST /runs/{run_id}/cancel is idempotent; canceling an already-canceled +# run returns 202 with status=accepted and a no-op message. +# +# 8. DIFF ACCESS +# - The diff route is header-gated on the legacy system (not role-gated). +# The API wraps the XHR path and returns structured JSON. No HTML. +# +# 9. STATUS DERIVATION +# - Run status is derived, not stored. TestStatus has only: preparation, +# testing, completed, canceled (canceled covers both canceled and error). +# The API normalizes this to the 7-value enum below. +# - RunSample.status is computed from TestResult + TestResultFile + +# expected exit code + multiple acceptable baselines. +# - fail_count and missing_output_count in RunSummary are mutually +# exclusive. A sample appears in exactly one bucket (missing_output +# is checked first; if the dummy sentinel row is detected the function +# returns immediately without evaluating fail conditions). +# +# 10. REPOSITORY PERMISSIONS +# - POST /runs enforces a repo-aware permission check. Triggering a run +# against the main configured repository (GITHUB_OWNER/GITHUB_REPOSITORY) +# requires the contributor role or above. Any authenticated user with +# runs:write scope may trigger runs against fork repositories. There is +# no global repository allowlist; the elevated-role check applies only +# to the main configured repository. +# + +paths: + + # AUTH + + /auth/tokens: + get: + tags: [Auth] + summary: List API tokens + operationId: listTokens + description: > + Lists tokens for the authenticated user. Non-admin users see only their + own tokens. Admins may append ?all=true to list tokens across the entire + system; non-admin callers sending ?all=true receive 403. + + Plaintext token values are never included in list responses. + security: + - bearerAuth: [] + x-required-scope: tokens:manage + parameters: + - $ref: "#/components/parameters/Limit" + - $ref: "#/components/parameters/Offset" + - name: all + in: query + schema: + type: boolean + description: > + Admin only. Set to true to list tokens for all users in the system. + Non-admin callers receive 403 if this parameter is present and true. + responses: + "200": + description: Paginated list of tokens (without plaintext secrets). + content: + application/json: + schema: + allOf: + - $ref: "#/components/schemas/Page" + - type: object + properties: + data: + type: array + items: + $ref: "#/components/schemas/ApiTokenItem" + "400": + $ref: "#/components/responses/BadRequest" + "401": + $ref: "#/components/responses/Unauthorized" + "403": + $ref: "#/components/responses/Forbidden" + "429": + $ref: "#/components/responses/RateLimited" + default: + $ref: "#/components/responses/Error" + + post: + tags: [Auth] + summary: Create an API token + operationId: createToken + description: > + Rate-limited to 5 requests per 15 minutes per IP. Tokens are opaque + and stored server-side. Scopes are additive; request only what you need. + Tokens expire after expires_in_days (default 7, max 30). + security: [] + x-rate-limit: "5/15min per IP" + requestBody: + required: true + content: + application/json: + schema: + $ref: "#/components/schemas/TokenCreateRequest" + responses: + "201": + description: Token created. Store the token value; it will not be shown again. + content: + application/json: + schema: + $ref: "#/components/schemas/AuthToken" + "400": + $ref: "#/components/responses/BadRequest" + "401": + description: Invalid credentials + content: + application/json: + schema: + $ref: "#/components/schemas/ErrorResponse" + example: + code: invalid_credentials + message: Email or password is incorrect. + details: {} + "403": + description: > + Authenticated caller tried to create a token with higher scopes + than their current token. + content: + application/json: + schema: + $ref: "#/components/schemas/ErrorResponse" + example: + code: forbidden + message: Cannot create token with scopes you do not possess. + details: {} + "429": + $ref: "#/components/responses/RateLimited" + default: + $ref: "#/components/responses/Error" + + /auth/tokens/current: + delete: + tags: [Auth] + summary: Revoke the current API token + operationId: revokeCurrentToken + description: > + Immediately invalidates the token used in the Authorization header. + Subsequent requests with the same token will receive 401. + + No specific scope is required beyond authentication — any valid token + can self-revoke. This is the preferred way to clean up a token when + you have it in hand but do not know its numeric ID. + security: + - bearerAuth: [] + responses: + "204": + description: Token revoked + "401": + $ref: "#/components/responses/Unauthorized" + "429": + $ref: "#/components/responses/RateLimited" + default: + $ref: "#/components/responses/Error" + + /auth/tokens/{token_id}: + delete: + tags: [Auth] + summary: Revoke a specific API token by ID + operationId: revokeToken + description: > + Revokes the token identified by token_id. + Users may revoke their own tokens without any scope requirement. + Revoking another user's token requires tokens:manage scope and admin role. + Attempting to revoke another user's token without admin role returns 404 to prevent token-ID enumeration. + + To revoke the token currently in use without knowing its ID, use + DELETE /auth/tokens/current instead. + security: + - bearerAuth: [] + x-required-scope: tokens:manage # only enforced for cross-user revocation + parameters: + - name: token_id + in: path + required: true + schema: + type: integer + minimum: 1 + responses: + "204": + description: Token revoked successfully. + "401": + $ref: "#/components/responses/Unauthorized" + "403": + description: > + Token is valid but the request is forbidden. Admins requesting cross-user revocation get a 403 response if their token lacks the tokens:manage scope. + content: + application/json: + schema: + $ref: "#/components/schemas/ErrorResponse" + example: + code: forbidden + message: Cross-user revocation requires tokens:manage scope. + details: {} + "404": + description: > + Token not found. Non-admin users attempting to revoke another user's token receive a uniform 404 response to prevent token-ID enumeration. + content: + application/json: + schema: + $ref: "#/components/schemas/ErrorResponse" + example: + code: not_found + message: Token not found. + details: {} + "429": + $ref: "#/components/responses/RateLimited" + default: + $ref: "#/components/responses/Error" + + # RUNS + + /runs: + get: + tags: [Runs] + summary: List CI runs + operationId: listRuns + description: > + The underlying table is capped at the 50 most recent runs + in the current implementation; this endpoint adds full pagination. + Sorted by -created_at by default (newest first). + security: + - bearerAuth: [] + x-required-scope: runs:read + parameters: + - $ref: "#/components/parameters/Limit" + - $ref: "#/components/parameters/Offset" + - $ref: "#/components/parameters/RunStatus" + - $ref: "#/components/parameters/Branch" + - $ref: "#/components/parameters/CommitSha" + - $ref: "#/components/parameters/Repository" + - $ref: "#/components/parameters/Platform" + - $ref: "#/components/parameters/CreatedAfter" + - $ref: "#/components/parameters/CreatedBefore" + - name: sort + in: query + schema: + type: string + default: -created_at + enum: [created_at, -created_at, run_id, -run_id] + description: Sort field. Prefix with - for descending order. + responses: + "200": + description: Paginated runs + headers: + X-RateLimit-Limit: + $ref: "#/components/headers/RateLimitLimit" + X-RateLimit-Remaining: + $ref: "#/components/headers/RateLimitRemaining" + X-RateLimit-Reset: + $ref: "#/components/headers/RateLimitReset" + content: + application/json: + schema: + allOf: + - $ref: "#/components/schemas/Page" + - type: object + properties: + data: + type: array + items: + $ref: "#/components/schemas/Run" + "400": + $ref: "#/components/responses/BadRequest" + "401": + $ref: "#/components/responses/Unauthorized" + "403": + $ref: "#/components/responses/Forbidden" + "429": + $ref: "#/components/responses/RateLimited" + default: + $ref: "#/components/responses/Error" + + post: + tags: [Runs] + summary: Trigger a new CI run + operationId: createRun + description: > + Requires runs:write scope and contributor role or above. + The regression_test_ids set is validated against active tests only. + If omitted, all active regression tests are used. + security: + - bearerAuth: [] + x-required-scope: runs:write + x-required-roles: [admin, tester, contributor] + requestBody: + required: true + content: + application/json: + schema: + $ref: "#/components/schemas/RunCreateRequest" + responses: + "202": + description: Run queued. Poll /runs/{run_id}/progress for status. + content: + application/json: + schema: + $ref: "#/components/schemas/Run" + "400": + $ref: "#/components/responses/BadRequest" + "401": + $ref: "#/components/responses/Unauthorized" + "403": + $ref: "#/components/responses/Forbidden" + "422": + $ref: "#/components/responses/UnprocessableEntity" + "429": + $ref: "#/components/responses/RateLimited" + default: + $ref: "#/components/responses/Error" + + /runs/{run_id}: + get: + tags: [Runs] + summary: Get a CI run + operationId: getRun + description: > + Returns normalized run status derived from TestProgress rows. + status=canceled covers both explicit cancellation and infrastructure + errors (the underlying model does not distinguish them). + security: + - bearerAuth: [] + x-required-scope: runs:read + parameters: + - $ref: "#/components/parameters/RunId" + responses: + "200": + description: Run details + content: + application/json: + schema: + $ref: "#/components/schemas/Run" + "401": + $ref: "#/components/responses/Unauthorized" + "403": + $ref: "#/components/responses/Forbidden" + "404": + $ref: "#/components/responses/NotFound" + "429": + $ref: "#/components/responses/RateLimited" + default: + $ref: "#/components/responses/Error" + + /runs/{run_id}/summary: + get: + tags: [Runs] + summary: Get pass/fail summary for a run + operationId: getRunSummary + description: > + fail_count is computed from TestResult rows, not from test.failed. + test.failed only reflects whether the final progress status is + canceled — it does not reflect regression test outcomes. + Use this endpoint, not test.failed, to triage a run. + security: + - bearerAuth: [] + x-required-scope: runs:read + parameters: + - $ref: "#/components/parameters/RunId" + responses: + "200": + description: Run summary + content: + application/json: + schema: + $ref: "#/components/schemas/RunSummary" + "401": + $ref: "#/components/responses/Unauthorized" + "403": + $ref: "#/components/responses/Forbidden" + "404": + $ref: "#/components/responses/NotFound" + "429": + $ref: "#/components/responses/RateLimited" + default: + $ref: "#/components/responses/Error" + + /runs/{run_id}/progress: + get: + tags: [Runs] + summary: Get progress events for a run + operationId: getRunProgress + description: > + Progress events are sourced from TestProgress rows written by the CI + worker via /ci/progress-reporter. Messages are unstructured text. + Structured error types are aspirational until the worker protocol + emits structured JSON. + security: + - bearerAuth: [] + x-required-scope: runs:read + parameters: + - $ref: "#/components/parameters/RunId" + - $ref: "#/components/parameters/Limit" + - $ref: "#/components/parameters/Offset" + - name: status + in: query + schema: + type: string + enum: [queued, preparation, testing, completed, canceled] + responses: + "200": + description: Paginated progress events + content: + application/json: + schema: + allOf: + - $ref: "#/components/schemas/Page" + - type: object + properties: + data: + type: array + items: + $ref: "#/components/schemas/ProgressEvent" + "400": + $ref: "#/components/responses/BadRequest" + "401": + $ref: "#/components/responses/Unauthorized" + "403": + $ref: "#/components/responses/Forbidden" + "404": + $ref: "#/components/responses/NotFound" + "429": + $ref: "#/components/responses/RateLimited" + default: + $ref: "#/components/responses/Error" + + /runs/{run_id}/cancel: + post: + tags: [Runs] + summary: Cancel a queued or running CI run + operationId: cancelRun + description: > + Idempotent. Canceling an already-canceled or completed run returns + 202 with a no-op message rather than an error. + Requires runs:write scope. + security: + - bearerAuth: [] + x-required-scope: runs:write + x-required-roles: [admin, tester, contributor] + parameters: + - $ref: "#/components/parameters/RunId" + requestBody: + required: false + content: + application/json: + schema: + type: object + properties: + reason: + type: string + minLength: 5 + maxLength: 255 + description: > + Reason for cancellation, stored in the audit log. + additionalProperties: false + responses: + "202": + description: Cancellation accepted (or no-op if already terminal) + content: + application/json: + schema: + $ref: "#/components/schemas/RunActionResult" + "400": + $ref: "#/components/responses/BadRequest" + "401": + $ref: "#/components/responses/Unauthorized" + "403": + $ref: "#/components/responses/Forbidden" + "404": + $ref: "#/components/responses/NotFound" + "429": + $ref: "#/components/responses/RateLimited" + default: + $ref: "#/components/responses/Error" + + /runs/{run_id}/config: + get: + tags: [Runs] + summary: Get run configuration and test matrix + operationId: getRunConfig + description: > + regression_test_ids lists IDs included in this run. When no custom + set was configured, all regression tests are returned. + Implementers must filter by active=true explicitly. + security: + - bearerAuth: [] + x-required-scope: runs:read + parameters: + - $ref: "#/components/parameters/RunId" + responses: + "200": + description: Run configuration + content: + application/json: + schema: + $ref: "#/components/schemas/RunConfig" + "401": + $ref: "#/components/responses/Unauthorized" + "403": + $ref: "#/components/responses/Forbidden" + "404": + $ref: "#/components/responses/NotFound" + "429": + $ref: "#/components/responses/RateLimited" + default: + $ref: "#/components/responses/Error" + + # SAMPLES + + /runs/{run_id}/samples: + get: + tags: [Samples] + summary: List regression test results in a run + operationId: listRunSamples + description: > + Returns one entry per regression test result, not one per unique media + file. A single media sample may yield multiple entries if it has + multiple regression tests (different command flags). + sample_progress in the legacy JSON endpoint is len(test.results) over + total regression tests; it does not reflect multi-output completeness. + security: + - bearerAuth: [] + x-required-scope: runs:read + parameters: + - $ref: "#/components/parameters/RunId" + - $ref: "#/components/parameters/Limit" + - $ref: "#/components/parameters/Offset" + - name: status + in: query + schema: + type: string + enum: [pass, fail, skipped, missing_output, running, not_started] + - name: name + in: query + schema: + type: string + maxLength: 100 + - name: tag + in: query + schema: + type: string + maxLength: 50 + - name: category + in: query + schema: + type: string + maxLength: 50 + responses: + "200": + description: Paginated regression test results + content: + application/json: + schema: + allOf: + - $ref: "#/components/schemas/Page" + - type: object + properties: + data: + type: array + items: + $ref: "#/components/schemas/RunSample" + "400": + $ref: "#/components/responses/BadRequest" + "401": + $ref: "#/components/responses/Unauthorized" + "403": + $ref: "#/components/responses/Forbidden" + "404": + $ref: "#/components/responses/NotFound" + "429": + $ref: "#/components/responses/RateLimited" + default: + $ref: "#/components/responses/Error" + + /runs/{run_id}/samples/{regression_test_id}: + get: + tags: [Samples] + summary: Get full details for a regression test result in a run + operationId: getRunSample + description: > + Returns the result for a specific regression test within a run. + Note: the path parameter is regression_test_id, not a media sample ID. + A single media sample may have multiple regression tests. + security: + - bearerAuth: [] + x-required-scope: runs:read + parameters: + - $ref: "#/components/parameters/RunId" + - $ref: "#/components/parameters/RegressionTestId" + responses: + "200": + description: Regression test result details + content: + application/json: + schema: + $ref: "#/components/schemas/RunSample" + "401": + $ref: "#/components/responses/Unauthorized" + "403": + $ref: "#/components/responses/Forbidden" + "404": + $ref: "#/components/responses/NotFound" + "429": + $ref: "#/components/responses/RateLimited" + default: + $ref: "#/components/responses/Error" + + /samples: + get: + tags: [Samples] + summary: List all known media samples + operationId: listSamples + description: > + Returns paginated media sample metadata. Samples are the original + media files uploaded for regression testing. + security: + - bearerAuth: [] + x-required-scope: runs:read + parameters: + - $ref: "#/components/parameters/Limit" + - $ref: "#/components/parameters/Offset" + - name: status + in: query + description: > + Derived from linked regression tests. The sample table itself has + no quarantine state; active/inactive reflects whether any active + regression tests reference the sample. + schema: + type: string + enum: [active, inactive] + - name: name + in: query + schema: + type: string + maxLength: 100 + - name: tag + in: query + schema: + type: string + maxLength: 50 + - name: sha256 + in: query + schema: + type: string + pattern: '^[a-fA-F0-9]{64}$' + - name: extension + in: query + schema: + type: string + maxLength: 10 + pattern: '^[a-zA-Z0-9]+$' + responses: + "200": + description: Paginated media samples + content: + application/json: + schema: + allOf: + - $ref: "#/components/schemas/Page" + - type: object + properties: + data: + type: array + items: + $ref: "#/components/schemas/Sample" + "400": + $ref: "#/components/responses/BadRequest" + "401": + $ref: "#/components/responses/Unauthorized" + "403": + $ref: "#/components/responses/Forbidden" + "429": + $ref: "#/components/responses/RateLimited" + default: + $ref: "#/components/responses/Error" + + /samples/{sample_id}: + get: + tags: [Samples] + summary: Get media sample metadata + operationId: getSample + security: + - bearerAuth: [] + x-required-scope: runs:read + parameters: + - $ref: "#/components/parameters/SampleId" + responses: + "200": + description: Media sample metadata + content: + application/json: + schema: + $ref: "#/components/schemas/Sample" + "401": + $ref: "#/components/responses/Unauthorized" + "403": + $ref: "#/components/responses/Forbidden" + "404": + $ref: "#/components/responses/NotFound" + "429": + $ref: "#/components/responses/RateLimited" + default: + $ref: "#/components/responses/Error" + + /samples/{sample_id}/history: + get: + tags: [Samples] + summary: Get regression test result history for a sample across runs + operationId: getSampleHistory + description: > + Use failure_signature for flake detection: a stable signature across + multiple runs on different commits indicates a genuine regression, + not infrastructure noise. + security: + - bearerAuth: [] + x-required-scope: runs:read + parameters: + - $ref: "#/components/parameters/SampleId" + - $ref: "#/components/parameters/Limit" + - $ref: "#/components/parameters/Offset" + - $ref: "#/components/parameters/RunStatus" + - $ref: "#/components/parameters/Branch" + - $ref: "#/components/parameters/Platform" + - $ref: "#/components/parameters/CreatedAfter" + - $ref: "#/components/parameters/CreatedBefore" + responses: + "200": + description: Paginated sample history + content: + application/json: + schema: + allOf: + - $ref: "#/components/schemas/Page" + - type: object + properties: + data: + type: array + items: + $ref: "#/components/schemas/SampleHistoryEntry" + "400": + $ref: "#/components/responses/BadRequest" + "401": + $ref: "#/components/responses/Unauthorized" + "403": + $ref: "#/components/responses/Forbidden" + "404": + $ref: "#/components/responses/NotFound" + "429": + $ref: "#/components/responses/RateLimited" + default: + $ref: "#/components/responses/Error" + + /regression-tests: + get: + tags: [Samples] + summary: List regression test definitions + operationId: listRegressionTests + description: > + The active filter must be applied explicitly. When no custom set is + defined, all regression tests are returned — including inactive ones. + security: + - bearerAuth: [] + x-required-scope: runs:read + parameters: + - $ref: "#/components/parameters/Limit" + - $ref: "#/components/parameters/Offset" + - name: active + in: query + schema: + type: boolean + default: true + - name: category + in: query + schema: + type: string + maxLength: 50 + - name: tag + in: query + schema: + type: string + maxLength: 50 + - name: sample_id + in: query + schema: + type: integer + minimum: 1 + responses: + "200": + description: Paginated regression test definitions + content: + application/json: + schema: + allOf: + - $ref: "#/components/schemas/Page" + - type: object + properties: + data: + type: array + items: + $ref: "#/components/schemas/RegressionTest" + "400": + $ref: "#/components/responses/BadRequest" + "401": + $ref: "#/components/responses/Unauthorized" + "403": + $ref: "#/components/responses/Forbidden" + "429": + $ref: "#/components/responses/RateLimited" + default: + $ref: "#/components/responses/Error" + + # RESULTS + + /runs/{run_id}/samples/{sample_id}/regression-tests/{regression_id}/outputs/{output_id}/expected: + get: + tags: [Results] + summary: Get expected output for a regression test result + operationId: getExpectedOutput + description: > + Expected output is a file reference stored under TestResults using the + regression output extension. Resolved from GCS or local + SAMPLE_REPOSITORY at request time. storage_status reflects which + backends have the file. Do not assume local and GCS are always in sync. + security: + - bearerAuth: [] + x-required-scope: results:read + parameters: + - $ref: "#/components/parameters/RunId" + - $ref: "#/components/parameters/SampleId" + - $ref: "#/components/parameters/RegressionId" + - $ref: "#/components/parameters/OutputId" + - $ref: "#/components/parameters/Format" + responses: + "200": + description: Expected output file + content: + application/json: + schema: + $ref: "#/components/schemas/OutputFile" + "400": + $ref: "#/components/responses/BadRequest" + "401": + $ref: "#/components/responses/Unauthorized" + "403": + $ref: "#/components/responses/Forbidden" + "404": + $ref: "#/components/responses/NotFound" + "429": + $ref: "#/components/responses/RateLimited" + default: + $ref: "#/components/responses/Error" + + /runs/{run_id}/samples/{sample_id}/regression-tests/{regression_id}/outputs/{output_id}/actual: + get: + tags: [Results] + summary: Get actual output generated by a regression test in a run + operationId: getActualOutput + description: > + IMPORTANT: TestResultFile.got = null means the actual output MATCHED + expected, not that actual output is missing. This is a semantic trap + in the data model. Missing output is represented by a dummy row + (-1,-1,-1,'','error') which the API translates to status=missing_output + and returns 404. A 200 response always contains a real output file. + security: + - bearerAuth: [] + x-required-scope: results:read + parameters: + - $ref: "#/components/parameters/RunId" + - $ref: "#/components/parameters/SampleId" + - $ref: "#/components/parameters/RegressionId" + - $ref: "#/components/parameters/OutputId" + - $ref: "#/components/parameters/Format" + responses: + "200": + description: Actual output file (output exists and differs from expected) + content: + application/json: + schema: + $ref: "#/components/schemas/OutputFile" + "303": + description: Output matched expected. Redirected to /expected. + headers: + Location: + schema: + type: string + format: uri + "400": + $ref: "#/components/responses/BadRequest" + "401": + $ref: "#/components/responses/Unauthorized" + "403": + $ref: "#/components/responses/Forbidden" + "404": + $ref: "#/components/responses/NotFound" + "429": + $ref: "#/components/responses/RateLimited" + default: + $ref: "#/components/responses/Error" + + /runs/{run_id}/samples/{sample_id}/regression-tests/{regression_id}/outputs/{output_id}/diff: + get: + tags: [Results] + summary: Get expected-vs-actual diff for a failing regression test result + operationId: getDiff + description: > + The legacy diff route is header-gated (X-Requested-With: XMLHttpRequest), + not role-gated. The 403 seen on direct browser requests was a + header-check artifact. This endpoint wraps the XHR logic and returns + structured JSON — no HTML, no 50-line truncation. + security: + - bearerAuth: [] + x-required-scope: results:read + parameters: + - $ref: "#/components/parameters/RunId" + - $ref: "#/components/parameters/SampleId" + - $ref: "#/components/parameters/RegressionId" + - $ref: "#/components/parameters/OutputId" + - name: context_lines + in: query + schema: + type: integer + minimum: 1 + maximum: 50 + default: 3 + - name: format + in: query + schema: + type: string + enum: [structured, unified] + default: structured + responses: + "200": + description: Structured or unified diff + content: + application/json: + schema: + oneOf: + - $ref: "#/components/schemas/Diff" + - $ref: "#/components/schemas/UnifiedDiff" + discriminator: + propertyName: format + mapping: + structured: "#/components/schemas/Diff" + unified: "#/components/schemas/UnifiedDiff" + "400": + $ref: "#/components/responses/BadRequest" + "401": + $ref: "#/components/responses/Unauthorized" + "403": + $ref: "#/components/responses/Forbidden" + "404": + $ref: "#/components/responses/NotFound" + "429": + $ref: "#/components/responses/RateLimited" + default: + $ref: "#/components/responses/Error" + + /runs/{run_id}/samples/{sample_id}/baseline-approval: + post: + tags: [Results] + summary: Approve actual output as new expected baseline + operationId: approveBaseline + description: > + Requires baselines:write scope and admin role. + This is a destructive write — the approved output becomes the new + expected baseline for the regression test. + security: + - bearerAuth: [] + x-required-scope: baselines:write + x-required-roles: [admin, contributor] + parameters: + - $ref: "#/components/parameters/RunId" + - $ref: "#/components/parameters/SampleId" + requestBody: + required: true + content: + application/json: + schema: + $ref: "#/components/schemas/BaselineApprovalRequest" + responses: + "200": + description: Baseline approval applied immediately. + content: + application/json: + schema: + $ref: "#/components/schemas/BaselineApproval" + "400": + $ref: "#/components/responses/BadRequest" + "401": + $ref: "#/components/responses/Unauthorized" + "403": + $ref: "#/components/responses/Forbidden" + "404": + $ref: "#/components/responses/NotFound" + "429": + $ref: "#/components/responses/RateLimited" + default: + $ref: "#/components/responses/Error" + + # ERRORS AND LOGS + + /runs/{run_id}/errors: + get: + tags: [Errors and Logs] + summary: Get structured test errors for a run + operationId: listRunErrors + description: > + Error types are derived from TestResult and TestResultFile rows. + missing_output is detected from the dummy (-1,-1,-1,'','error') row + pattern, not from got=null (which means match, not missing). + security: + - bearerAuth: [] + x-required-scope: results:read + parameters: + - $ref: "#/components/parameters/RunId" + - $ref: "#/components/parameters/Limit" + - $ref: "#/components/parameters/Offset" + - name: type + in: query + schema: + type: string + enum: [test_failure, exit_code_mismatch, missing_output, diff_mismatch] + - name: severity + in: query + schema: + type: string + enum: [info, warning, error, critical] + - name: sample_id + in: query + schema: + type: integer + minimum: 1 + responses: + "200": + description: Paginated test errors + content: + application/json: + schema: + allOf: + - $ref: "#/components/schemas/Page" + - type: object + properties: + data: + type: array + items: + $ref: "#/components/schemas/ErrorItem" + "400": + $ref: "#/components/responses/BadRequest" + "401": + $ref: "#/components/responses/Unauthorized" + "403": + $ref: "#/components/responses/Forbidden" + "404": + $ref: "#/components/responses/NotFound" + "429": + $ref: "#/components/responses/RateLimited" + default: + $ref: "#/components/responses/Error" + + /runs/{run_id}/infrastructure-errors: + get: + tags: [Errors and Logs] + summary: Get worker, provisioning, and build errors for a run + operationId: listInfraErrors + description: > + Errors are extracted from TestProgress rows written by the CI worker. + Messages are currently unstructured text. The type filter does + best-effort text matching until the worker protocol emits structured + error types. + Stack traces are opt-in (include_stack defaults to false) to avoid + leaking internal paths to unauthorized callers. + security: + - bearerAuth: [] + x-required-scope: system:read + parameters: + - $ref: "#/components/parameters/RunId" + - $ref: "#/components/parameters/Limit" + - $ref: "#/components/parameters/Offset" + - name: type + in: query + schema: + type: string + enum: [queue, vm_provisioning, checkout, merge, build, worker, web_server, storage] + - name: severity + in: query + schema: + type: string + enum: [info, warning, error, critical] + - name: include_stack + in: query + schema: + type: boolean + default: false + description: > + Default false. Set true only when debugging infrastructure failures. + Stacks may contain internal paths; access requires system:read scope. + responses: + "200": + description: Paginated infrastructure errors + content: + application/json: + schema: + allOf: + - $ref: "#/components/schemas/Page" + - type: object + properties: + data: + type: array + items: + $ref: "#/components/schemas/ErrorItem" + "400": + $ref: "#/components/responses/BadRequest" + "401": + $ref: "#/components/responses/Unauthorized" + "403": + $ref: "#/components/responses/Forbidden" + "404": + $ref: "#/components/responses/NotFound" + "429": + $ref: "#/components/responses/RateLimited" + default: + $ref: "#/components/responses/Error" + + /runs/{run_id}/logs: + get: + tags: [Errors and Logs] + summary: Get raw logs for a run + operationId: getRunLogs + description: > + Logs are stored at SAMPLE_REPOSITORY/LogFiles/{id}.txt and served + via GCS signed URL. Returns 404 — not a broken download link — when + the file is absent from both local and GCS storage. + Uses cursor-based pagination. + security: + - bearerAuth: [] + x-required-scope: system:read + parameters: + - $ref: "#/components/parameters/RunId" + - $ref: "#/components/parameters/Limit" + - $ref: "#/components/parameters/Cursor" + - name: level + in: query + schema: + type: string + enum: [debug, info, warning, error, critical] + - name: source + in: query + schema: + type: string + enum: [orchestrator, worker, build, test_runner, web] + - name: contains + in: query + schema: + type: string + maxLength: 100 + responses: + "200": + description: Cursor-paginated run log lines + content: + application/json: + schema: + allOf: + - $ref: "#/components/schemas/CursorPage" + - type: object + properties: + data: + type: array + items: + $ref: "#/components/schemas/LogLine" + "400": + $ref: "#/components/responses/BadRequest" + "401": + $ref: "#/components/responses/Unauthorized" + "403": + $ref: "#/components/responses/Forbidden" + "404": + description: Log file not found in local or GCS storage + content: + application/json: + schema: + $ref: "#/components/schemas/ErrorResponse" + example: + code: log_not_found + message: Log file for run 9309 does not exist in any storage backend. + details: + run_id: 9309 + checked: [local, gcs] + "429": + $ref: "#/components/responses/RateLimited" + default: + $ref: "#/components/responses/Error" + + /runs/{run_id}/samples/{sample_id}/logs: + get: + tags: [Errors and Logs] + summary: Get raw logs for a regression test result in a run + operationId: getSampleLogs + description: > + Returns raw log lines for a specific regression test result. + Logs are stored at SAMPLE_REPOSITORY/LogFiles/ and served via GCS + signed URL when available. Returns 404 when the log file is absent + from both local and GCS storage. + security: + - bearerAuth: [] + x-required-scope: system:read + parameters: + - $ref: "#/components/parameters/RunId" + - $ref: "#/components/parameters/SampleId" + - $ref: "#/components/parameters/Limit" + - $ref: "#/components/parameters/Cursor" + - name: level + in: query + schema: + type: string + enum: [debug, info, warning, error, critical] + - name: contains + in: query + schema: + type: string + maxLength: 100 + responses: + "200": + description: Cursor-paginated sample log lines + content: + application/json: + schema: + allOf: + - $ref: "#/components/schemas/CursorPage" + - type: object + properties: + data: + type: array + items: + $ref: "#/components/schemas/LogLine" + "400": + $ref: "#/components/responses/BadRequest" + "401": + $ref: "#/components/responses/Unauthorized" + "403": + $ref: "#/components/responses/Forbidden" + "404": + $ref: "#/components/responses/NotFound" + "429": + $ref: "#/components/responses/RateLimited" + default: + $ref: "#/components/responses/Error" + + /runs/{run_id}/error-summary: + get: + tags: [Errors and Logs] + summary: Get grouped error summary for a run + operationId: getErrorSummary + description: > + Use this endpoint to triage a run before drilling into individual + errors. group_by=type gives a high-level failure breakdown; + group_by=sample_id helps identify flaky samples. + security: + - bearerAuth: [] + x-required-scope: results:read + parameters: + - $ref: "#/components/parameters/RunId" + - $ref: "#/components/parameters/Limit" + - $ref: "#/components/parameters/Offset" + - name: group_by + in: query + schema: + type: string + enum: [type, sample_id, regression_id, severity] + default: type + - name: severity + in: query + schema: + type: string + enum: [info, warning, error, critical] + responses: + "200": + description: Paginated grouped error summary + content: + application/json: + schema: + allOf: + - $ref: "#/components/schemas/Page" + - type: object + properties: + data: + type: array + items: + $ref: "#/components/schemas/ErrorSummaryBucket" + "400": + $ref: "#/components/responses/BadRequest" + "401": + $ref: "#/components/responses/Unauthorized" + "403": + $ref: "#/components/responses/Forbidden" + "404": + $ref: "#/components/responses/NotFound" + "429": + $ref: "#/components/responses/RateLimited" + default: + $ref: "#/components/responses/Error" + + # SYSTEM + + /system/health: + get: + tags: [System] + summary: Get CI system health and dependency status + operationId: getHealth + description: > + Unauthenticated. Returns overall system status and per-dependency + health. Used by monitoring and uptime checks. + security: [] + responses: + "200": + description: System healthy or degraded + headers: + X-RateLimit-Limit: + $ref: "#/components/headers/RateLimitLimit" + X-RateLimit-Remaining: + $ref: "#/components/headers/RateLimitRemaining" + X-RateLimit-Reset: + $ref: "#/components/headers/RateLimitReset" + content: + application/json: + schema: + $ref: "#/components/schemas/SystemHealth" + "503": + description: System is down + headers: + X-RateLimit-Limit: + $ref: "#/components/headers/RateLimitLimit" + X-RateLimit-Remaining: + $ref: "#/components/headers/RateLimitRemaining" + X-RateLimit-Reset: + $ref: "#/components/headers/RateLimitReset" + content: + application/json: + schema: + $ref: "#/components/schemas/SystemHealth" + "429": + $ref: "#/components/responses/RateLimited" + default: + $ref: "#/components/responses/Error" + + /system/queue: + get: + tags: [System] + summary: Get queue depth and currently running jobs + operationId: getQueue + security: + - bearerAuth: [] + x-required-scope: system:read + parameters: + - $ref: "#/components/parameters/Limit" + - $ref: "#/components/parameters/Offset" + - name: platform + in: query + schema: + type: string + enum: [linux, windows] + - name: status + in: query + schema: + type: string + enum: [queued, running] + responses: + "200": + description: Queue status and active jobs + content: + application/json: + schema: + allOf: + - $ref: "#/components/schemas/Page" + - type: object + properties: + queue_depth: + type: integer + minimum: 0 + running_count: + type: integer + minimum: 0 + data: + type: array + items: + $ref: "#/components/schemas/QueueJob" + "400": + $ref: "#/components/responses/BadRequest" + "401": + $ref: "#/components/responses/Unauthorized" + "403": + $ref: "#/components/responses/Forbidden" + "429": + $ref: "#/components/responses/RateLimited" + default: + $ref: "#/components/responses/Error" + + /runs/{run_id}/artifacts: + get: + tags: [System] + summary: List downloadable artifacts for a run + operationId: listArtifacts + description: > + Only returns artifacts with a verified download_url from at least one + storage backend. storage_status=degraded means one backend only; + storage_status=missing means neither backend has the file (download_url + will be null). Never returns a URL that has not been verified to exist. + security: + - bearerAuth: [] + x-required-scope: results:read + parameters: + - $ref: "#/components/parameters/RunId" + - $ref: "#/components/parameters/Limit" + - $ref: "#/components/parameters/Offset" + - name: type + in: query + schema: + type: string + enum: [build_log, sample_output, expected_output, diff, media_info, binary, coredump, combined_stdout] + responses: + "200": + description: Paginated run artifacts + content: + application/json: + schema: + allOf: + - $ref: "#/components/schemas/Page" + - type: object + properties: + data: + type: array + items: + $ref: "#/components/schemas/Artifact" + "400": + $ref: "#/components/responses/BadRequest" + "401": + $ref: "#/components/responses/Unauthorized" + "403": + $ref: "#/components/responses/Forbidden" + "404": + $ref: "#/components/responses/NotFound" + "429": + $ref: "#/components/responses/RateLimited" + default: + $ref: "#/components/responses/Error" + +# +# COMPONENTS +# +components: + + securitySchemes: + bearerAuth: + type: http + scheme: bearer + bearerFormat: opaque + description: > + Opaque server-side API token. Obtain via POST /auth/tokens. + The CI worker token used by /ci/progress-reporter is a separate + secret and is NOT valid here. Never use browser session cookies + for API clients. + + # HEADERS + + headers: + RateLimitLimit: + description: Maximum requests allowed in the current window + schema: + type: integer + example: 120 + RateLimitRemaining: + description: Requests remaining in the current window + schema: + type: integer + example: 117 + RateLimitReset: + description: Unix timestamp when the rate limit window resets + schema: + type: integer + example: 1748908800 + + # PARAMETERS + + parameters: + Limit: + name: limit + in: query + description: Maximum number of results to return (1–100) + schema: + type: integer + minimum: 1 + maximum: 100 + default: 50 + + Offset: + name: offset + in: query + description: Number of results to skip for pagination + schema: + type: integer + minimum: 0 + maximum: 2147483647 + default: 0 + + Cursor: + name: cursor + in: query + description: > + Numeric line offset or ID for cursor-based pagination. Do not mix with offset. Mixing cursor and offset returns 400. + Obtain next_cursor from the previous response's pagination object. + schema: + type: integer + minimum: 0 + maximum: 10000000 + + RunId: + name: run_id + in: path + required: true + description: Numeric run ID + schema: + type: integer + minimum: 1 + + SampleId: + name: sample_id + in: path + required: true + description: Numeric media sample ID + schema: + type: integer + minimum: 1 + + RegressionTestId: + name: regression_test_id + in: path + required: true + description: Numeric regression test ID (not the same as media sample ID) + schema: + type: integer + minimum: 1 + + RunStatus: + name: status + in: query + description: > + Normalized run status. Derived from TestProgress rows and TestResult + outcomes. The underlying TestStatus model stores only preparation, + testing, completed, and canceled (where canceled covers both canceled + and error). This enum is the normalized API contract. + schema: + type: string + enum: [queued, running, pass, fail, canceled, incomplete] + example: pass + + Branch: + name: branch + in: query + description: Filter by branch name (e.g. master, develop). + schema: + type: string + maxLength: 100 + example: master + + CommitSha: + name: commit_sha + in: query + description: > + Filter by full 40-character SHA-1 commit hash. + schema: + type: string + pattern: '^[a-fA-F0-9]{40}$' + example: 0b1a967b732898e705ea8f2fda5d08eb00328579 + + Repository: + name: repository + in: query + description: > + Filter by GitHub repository in owner/repo format. + schema: + type: string + pattern: '^[a-zA-Z0-9_.-]+/[a-zA-Z0-9_.-]+$' + maxLength: 100 + example: CCExtractor/ccextractor + + Platform: + name: platform + in: query + schema: + type: string + enum: [linux, windows] + example: linux + + CreatedAfter: + name: created_after + in: query + description: > + ISO 8601 datetime filter. Returns runs created after this time. + Example: 2025-01-01T00:00:00Z + schema: + type: string + format: date-time + + CreatedBefore: + name: created_before + in: query + description: > + ISO 8601 datetime filter. Returns runs created before this time. + Example: 2026-12-31T23:59:59Z + schema: + type: string + format: date-time + + RegressionId: + name: regression_id + in: path + required: true + description: Regression test definition ID + schema: + type: integer + minimum: 1 + + OutputId: + name: output_id + in: path + required: true + description: Output file ID within a regression test definition + schema: + type: integer + minimum: 1 + + Format: + name: format + in: query + description: > + Content encoding for file responses. + Use text only when the file is known to be UTF-8 compatible. + Binary or unknown content defaults to base64. + schema: + type: string + enum: [text, base64] + default: base64 + + # RESPONSES + + responses: + BadRequest: + description: Request body or query parameters failed schema validation + content: + application/json: + schema: + $ref: "#/components/schemas/ErrorResponse" + example: + code: validation_error + message: Request failed schema validation. + details: + fields: + commit_sha: Must match pattern ^[a-fA-F0-9]{40}$ + platform: Must be one of [linux, windows] + + Unauthorized: + description: Missing, expired, or invalid bearer token + content: + application/json: + schema: + $ref: "#/components/schemas/ErrorResponse" + example: + code: unauthorized + message: Bearer token is missing, expired, or invalid. + details: {} + + Forbidden: + description: Token is valid but lacks the required scope or role + content: + application/json: + schema: + $ref: "#/components/schemas/ErrorResponse" + example: + code: forbidden + message: Token does not have the required scope for this operation. + details: + required_scope: runs:write + token_scopes: [runs:read, results:read] + + NotFound: + description: Resource not found + content: + application/json: + schema: + $ref: "#/components/schemas/ErrorResponse" + example: + code: not_found + message: Run 9317 not found. + details: + resource: run + id: 9317 + + UnprocessableEntity: + description: Request is valid JSON but semantically invalid + content: + application/json: + schema: + $ref: "#/components/schemas/ErrorResponse" + example: + code: unprocessable + message: regression_test_ids contains inactive test IDs. + details: + inactive_ids: [42, 99] + + RateLimited: + description: Too many requests. Retry after the indicated number of seconds. + headers: + Retry-After: + description: Seconds to wait before retrying + schema: + type: integer + example: 30 + X-RateLimit-Limit: + $ref: "#/components/headers/RateLimitLimit" + X-RateLimit-Remaining: + $ref: "#/components/headers/RateLimitRemaining" + X-RateLimit-Reset: + $ref: "#/components/headers/RateLimitReset" + content: + application/json: + schema: + $ref: "#/components/schemas/ErrorResponse" + example: + code: rate_limited + message: Rate limit exceeded. Retry after 30 seconds. + details: + retry_after: 30 + limit: 120 + window: 60s + + Error: + description: Unexpected server error + content: + application/json: + schema: + $ref: "#/components/schemas/ErrorResponse" + + # SCHEMAS + + schemas: + + Page: + type: object + required: [data, pagination] + properties: + data: + type: array + description: > + Result items. The concrete type is defined by allOf composition + in each endpoint response. + items: {} + pagination: + type: object + required: [limit, offset, total] + properties: + limit: + type: integer + minimum: 1 + offset: + type: integer + minimum: 0 + total: + type: integer + minimum: -1 + nullable: true + description: > + Total matching records. Null if count was not computed for this request. + Pass ?count=true to force computation. + next_offset: + type: integer + minimum: 0 + nullable: true + truncated: + type: boolean + description: > + Present and true when the result set was capped by an + internal safety limit (e.g. status-filter on runs). When + true, total may undercount the real number of matches. + + CursorPage: + type: object + required: [data, pagination] + properties: + data: + type: array + description: > + Result items. The concrete type is defined by allOf composition + in each endpoint response. + items: {} + pagination: + type: object + required: [limit, next_cursor] + properties: + limit: + type: integer + minimum: 1 + next_cursor: + type: integer + minimum: 0 + nullable: true + description: > + Numeric cursor for the next page. Null when there are no + more results. + + ErrorResponse: + type: object + required: [code, message, details] + properties: + code: + type: string + maxLength: 100 + description: Machine-readable error code (snake_case) + example: not_found + message: + type: string + maxLength: 500 + description: Human-readable error summary + example: Run 9317 not found. + details: + type: object + additionalProperties: true + description: > + Structured context for the error. Always an object, never null. + Empty object {} when no additional detail is available. + + ApiTokenItem: + type: object + description: > + Token metadata returned when listing tokens. The plaintext token + value is never included - it is shown only once at creation time. + required: [id, user_id, token_name, token_prefix, scopes, created_at, expires_at, is_revoked] + properties: + id: + type: integer + minimum: 1 + user_id: + type: integer + minimum: 1 + description: Owner of the token. Visible to admins when listing all tokens. + token_name: + type: string + maxLength: 50 + token_prefix: + type: string + maxLength: 20 + description: First few characters of the token for identification. + scopes: + type: array + maxItems: 6 + uniqueItems: true + items: + type: string + enum: [runs:read, runs:write, results:read, baselines:write, system:read, tokens:manage] + created_at: + type: string + format: date-time + expires_at: + type: string + format: date-time + is_revoked: + type: boolean + description: True if the token has been explicitly revoked. + revoked_at: + type: string + format: date-time + nullable: true + + TokenCreateRequest: + type: object + required: [email, password, token_name] + additionalProperties: false + properties: + email: + type: string + format: email + maxLength: 255 + password: + type: string + format: password + minLength: 8 + maxLength: 128 + description: Not stored or logged. Used only to verify identity. + token_name: + type: string + minLength: 1 + maxLength: 50 + pattern: '^[a-zA-Z0-9_-]+$' + description: > + Descriptive label for the token (e.g., local-agent, ci-bot). + Must be unique per user. + expires_in_days: + type: integer + minimum: 1 + maximum: 30 + default: 7 + scopes: + type: array + maxItems: 6 + uniqueItems: true + default: [runs:read, results:read] + items: + type: string + enum: [runs:read, runs:write, results:read, baselines:write, system:read, tokens:manage] + description: > + Requested scopes. Grant only what the client needs. + runs:read — list and inspect runs, samples, history. + runs:write — trigger and cancel runs. + results:read — access expected/actual output, diffs, errors, logs. + baselines:write — approve new expected baselines. + system:read — queue, infrastructure errors, stack traces, artifacts. + tokens:manage — list and revoke API tokens. + + AuthToken: + type: object + required: [token, token_type, token_name, scopes, expires_at] + properties: + token: + type: string + maxLength: 512 + description: > + Opaque token value. Store it securely. It will not be shown again. + token_type: + type: string + enum: [bearer] + token_name: + type: string + maxLength: 50 + scopes: + type: array + maxItems: 8 + uniqueItems: true + items: + type: string + enum: [runs:read, runs:write, results:read, baselines:write, system:read, tokens:manage] + expires_at: + type: string + format: date-time + + RunCreateRequest: + type: object + required: [repository, commit_sha, platform] + additionalProperties: false + properties: + repository: + type: string + pattern: '^[a-zA-Z0-9_.-]+/[a-zA-Z0-9_.-]+$' + maxLength: 100 + example: CCExtractor/ccextractor + branch: + type: string + pattern: '^[A-Za-z0-9._-]+(/[A-Za-z0-9._-]+)*$' + maxLength: 100 + example: master + commit_sha: + type: string + pattern: '^[a-fA-F0-9]{40}$' + example: 0632bff4e382d5f86eff9073b9ddd37f03f9778c + pull_request: + type: integer + minimum: 1 + maximum: 2147483647 + nullable: true + example: 2264 + platform: + type: string + enum: [linux, windows] + example: windows + regression_test_ids: + type: array + maxItems: 500 + uniqueItems: true + items: + type: integer + minimum: 1 + maximum: 2147483647 + description: > + Optional subset of active regression test IDs. + If omitted, all active tests are used. + Inactive test IDs are rejected with 422. + + Run: + type: object + required: [run_id, status, repository, commit_sha, platform] + properties: + run_id: + type: integer + minimum: 1 + status: + type: string + enum: [queued, running, pass, fail, canceled, incomplete] + description: > + Normalized status. Derived from TestProgress rows and TestResult + outcomes. status=canceled covers both explicit cancellation and + infrastructure error (the underlying model conflates them). + platform: + type: string + enum: [linux, windows] + test_type: + type: string + enum: [pr, commit] + description: Whether this run was triggered by a pull request or a commit push. + repository: + type: string + maxLength: 100 + branch: + type: string + maxLength: 100 + nullable: true + commit_sha: + type: string + pattern: '^[a-fA-F0-9]{40}$' + pr_number: + type: integer + minimum: 1 + nullable: true + description: Pull request number, if this run was triggered by a PR. + created_at: + type: string + format: date-time + nullable: true + queued_at: + type: string + format: date-time + nullable: true + started_at: + type: string + format: date-time + nullable: true + completed_at: + type: string + format: date-time + nullable: true + github_link: + type: string + format: uri + nullable: true + description: Direct link to the commit or PR on GitHub. + + RunSummary: + type: object + required: [run_id, status, total_samples, pass_count, fail_count, skipped_count, missing_output_count] + properties: + run_id: + type: integer + minimum: 1 + status: + type: string + enum: [queued, running, pass, fail, canceled, incomplete] + description: > + Overall run status at the time the summary was generated. + Same derivation as Run.status. + total_samples: + type: integer + minimum: 0 + description: Total regression test results in this run. + pass_count: + type: integer + minimum: 0 + fail_count: + type: integer + minimum: 0 + description: > + Computed from TestResult rows. NOT derived from test.failed, + which only reflects cancellation state and is unreliable for + determining whether regression tests actually passed. + skipped_count: + type: integer + minimum: 0 + missing_output_count: + type: integer + minimum: 0 + description: > + Samples that produced no output when output was expected. + Detected from the dummy TestResultFile(-1,-1,-1,'','error') row, + not from got=null (which means output matched). + error_count: + type: integer + minimum: 0 + duration_ms: + type: integer + minimum: 0 + nullable: true + triggered_by: + type: string + maxLength: 100 + nullable: true + + ProgressEvent: + type: object + required: [timestamp, status, message] + properties: + timestamp: + type: string + format: date-time + status: + type: string + enum: [queued, preparation, testing, completed, canceled, error] + message: + type: string + maxLength: 500 + description: Unstructured text from TestProgress rows. + step: + type: integer + minimum: 0 + nullable: true + + RunActionResult: + type: object + required: [run_id, action, status] + properties: + run_id: + type: integer + minimum: 1 + description: ID of the run this action targets. + action: + type: string + enum: [cancel] + status: + type: string + enum: [accepted, rejected, no_op] + description: no_op is returned when canceling an already-terminal run. + message: + type: string + maxLength: 500 + + RunConfig: + type: object + required: [run_id, platform, branch, commit_sha, regression_test_ids] + properties: + run_id: + type: integer + minimum: 1 + platform: + type: string + enum: [linux, windows] + branch: + type: string + maxLength: 100 + commit_sha: + type: string + pattern: '^[a-fA-F0-9]{40}$' + regression_test_ids: + type: array + maxItems: 500 + uniqueItems: true + items: + type: integer + minimum: 1 + description: > + IDs included in this run. When no custom set was configured, all + regression tests are returned. Implementers must filter by + active=true — get_customized_regressiontests() does not do this. + + Sample: + type: object + required: [sample_id, sha] + properties: + sample_id: + type: integer + minimum: 1 + sha: + type: string + pattern: '^[a-fA-F0-9]{64}$' + description: SHA256 hash of the sample file. + extension: + type: string + maxLength: 10 + original_name: + type: string + maxLength: 255 + filename: + type: string + maxLength: 255 + tags: + type: array + maxItems: 50 + items: + type: string + maxLength: 50 + regression_test_count: + type: integer + minimum: 0 + description: Number of active regression tests referencing this sample. + active: + type: boolean + description: True if at least one active regression test references this sample. + + RegressionTest: + type: object + required: [regression_test_id, sample_id, command] + properties: + regression_test_id: + type: integer + minimum: 1 + sample_id: + type: integer + minimum: 1 + sample_name: + type: string + maxLength: 255 + nullable: true + command: + type: string + maxLength: 500 + input_type: + type: string + maxLength: 50 + output_type: + type: string + maxLength: 50 + expected_rc: + type: integer + nullable: true + active: + type: boolean + categories: + type: array + maxItems: 50 + items: + type: string + maxLength: 100 + description: + type: string + maxLength: 1000 + nullable: true + + RunSample: + type: object + required: [regression_test_id, sample_id, status] + properties: + regression_test_id: + type: integer + minimum: 1 + sample_id: + type: integer + minimum: 1 + nullable: true + sample_name: + type: string + maxLength: 255 + nullable: true + categories: + type: array + maxItems: 50 + items: + type: string + maxLength: 100 + description: Category labels from the regression test definition. + command: + type: string + maxLength: 500 + nullable: true + status: + type: string + enum: [pass, fail, skipped, missing_output, running, not_started] + description: > + Computed from TestResult, TestResultFile, expected exit code, + and multiple acceptable baselines. Not a stored column. + runtime_ms: + type: integer + minimum: 0 + nullable: true + exit_code: + type: integer + nullable: true + expected_rc: + type: integer + nullable: true + description: Expected return code for this regression test. + outputs: + type: array + maxItems: 20 + description: > + One entry per expected output file. + got=null in the DB means output matched expected; no actual file + is stored. The dummy (-1,-1,-1,'','error') row is translated to + status=missing_output and is never exposed here. + items: + type: object + required: [output_id, filename, status] + additionalProperties: false + properties: + output_id: + type: integer + minimum: 1 + filename: + type: string + maxLength: 255 + status: + type: string + enum: [pass, fail, missing_output, missing_expected] + description: > + pass = actual identical to expected. + fail = actual differs from expected. + missing_output = test produced no output. + missing_expected = no expected baseline exists. + + SampleHistoryEntry: + type: object + required: [run_id, regression_test_id, status] + properties: + run_id: + type: integer + minimum: 1 + regression_test_id: + type: integer + minimum: 1 + status: + type: string + enum: [pass, fail, skipped, missing_output, running, not_started] + platform: + type: string + enum: [linux, windows] + branch: + type: string + maxLength: 100 + nullable: true + commit_sha: + type: string + pattern: '^[a-fA-F0-9]{40}$' + nullable: true + tested_at: + type: string + format: date-time + nullable: true + description: completed_at or started_at timestamp from the run. + failure_signature: + type: string + maxLength: 255 + nullable: true + description: > + Stable string identifying the failure type and output ID. + Use across runs to detect genuine regressions vs. infrastructure + flakes. + + OutputFile: + type: object + required: [sample_id, regression_id, output_id, filename, content_type, encoding, content, storage_status] + properties: + run_id: + type: integer + minimum: 1 + nullable: true + description: Null for expected output not tied to a specific run. + sample_id: + type: integer + minimum: 1 + regression_id: + type: integer + minimum: 1 + output_id: + type: integer + minimum: 1 + filename: + type: string + maxLength: 255 + content_type: + type: string + maxLength: 100 + encoding: + type: string + enum: [utf-8, base64] + description: > + utf-8 only when file is confirmed text. Default is base64. + content: + type: string + maxLength: 1048576 + description: > + File content. Base64-encoded unless encoding=utf-8. + Files exceeding 1MB are truncated. Check truncated=true and use + download_url for the full file. + truncated: + type: boolean + description: True if content was truncated due to size limits. + download_url: + type: string + format: uri + nullable: true + description: URL to download the full file if it was truncated. + sha256: + type: string + pattern: '^[a-fA-F0-9]{64}$' + storage_status: + type: string + enum: [ok, degraded, missing] + description: > + ok = file verified in at least one storage backend. + degraded = file exists but integrity or redundancy check failed. + missing = file not found in any storage backend. + + Diff: + type: object + required: [run_id, sample_id, regression_id, output_id, status] + properties: + run_id: + type: integer + minimum: 1 + sample_id: + type: integer + minimum: 1 + regression_id: + type: integer + minimum: 1 + output_id: + type: integer + minimum: 1 + status: + type: string + enum: [identical, different, missing_expected, missing_actual] + summary: + type: object + required: [added_lines, removed_lines, changed_hunks] + properties: + added_lines: + type: integer + minimum: 0 + removed_lines: + type: integer + minimum: 0 + changed_hunks: + type: integer + minimum: 0 + hunks: + type: array + maxItems: 500 + items: + type: object + required: [expected_start, actual_start, lines] + additionalProperties: false + properties: + expected_start: + type: integer + minimum: 0 + actual_start: + type: integer + minimum: 0 + lines: + type: array + maxItems: 500 + items: + type: object + required: [kind, text] + additionalProperties: false + properties: + kind: + type: string + enum: [context, added, removed] + expected_line: + type: integer + minimum: 0 + nullable: true + actual_line: + type: integer + minimum: 0 + nullable: true + text: + type: string + maxLength: 1000 + + UnifiedDiff: + type: object + required: [run_id, sample_id, regression_id, output_id, format, content] + properties: + run_id: + type: integer + sample_id: + type: integer + regression_id: + type: integer + output_id: + type: integer + format: + type: string + enum: [unified] + content: + type: string + description: Raw unified diff text. + maxLength: 524288 + + BaselineApprovalRequest: + type: object + required: [regression_id, output_id] + additionalProperties: false + properties: + regression_id: + type: integer + minimum: 1 + output_id: + type: integer + minimum: 1 + remove_variants: + type: boolean + default: false + description: > + If true, removes all platform-specific variants (output_id != 1) + and promotes this output to the global baseline. + + BaselineApproval: + type: object + required: [status, run_id, sample_id, regression_id, output_id, requested_by, created_at] + properties: + status: + type: string + enum: [approved] + run_id: + type: integer + minimum: 1 + sample_id: + type: integer + minimum: 1 + regression_id: + type: integer + minimum: 1 + output_id: + type: integer + minimum: 1 + requested_by: + type: string + maxLength: 100 + description: Display name of the user who requested the approval. + created_at: + type: string + format: date-time + + ErrorItem: + type: object + required: [error_id, run_id, type, severity, message, occurred_at] + properties: + error_id: + type: string + maxLength: 100 + run_id: + type: integer + minimum: 1 + sample_id: + type: integer + minimum: 1 + nullable: true + regression_id: + type: integer + minimum: 1 + nullable: true + type: + type: string + enum: [test_failure, exit_code_mismatch, missing_output, diff_mismatch, queue, vm_provisioning, checkout, merge, build, worker, web_server, storage] + maxLength: 100 + severity: + type: string + enum: [info, warning, error, critical] + message: + type: string + maxLength: 1000 + location: + type: object + nullable: true + additionalProperties: true + properties: + file: + type: string + maxLength: 500 + nullable: true + line: + type: integer + minimum: 0 + nullable: true + column: + type: integer + minimum: 0 + nullable: true + sample_name: + type: string + maxLength: 255 + nullable: true + stack: + type: array + maxItems: 50 + description: Only present when include_stack=true was requested. + items: + type: string + maxLength: 2000 + occurred_at: + type: string + format: date-time + + LogLine: + type: object + required: [timestamp, level, source, message, run_id] + properties: + timestamp: + type: string + format: date-time + level: + type: string + enum: [debug, info, warning, error, critical] + source: + type: string + enum: [orchestrator, worker, build, test_runner, web] + message: + type: string + maxLength: 4000 + run_id: + type: integer + minimum: 1 + sample_id: + type: integer + minimum: 1 + nullable: true + + ErrorSummaryBucket: + type: object + required: [key, count, severity, group_by] + properties: + group_by: + type: string + enum: [type, sample_id, regression_id, severity] + description: The dimension this bucket is grouped by. + key: + type: string + maxLength: 100 + description: > + Value of the group_by dimension. When group_by=sample_id or + regression_id, this is an integer serialized as a string. + count: + type: integer + minimum: 0 + severity: + type: string + enum: [info, warning, error, critical] + sample_ids: + type: array + maxItems: 1000 + items: + type: integer + minimum: 1 + first_seen_at: + type: string + format: date-time + nullable: true + last_seen_at: + type: string + format: date-time + nullable: true + + SystemHealth: + type: object + required: [status, checked_at, dependencies] + properties: + status: + type: string + enum: [ok, degraded, down] + checked_at: + type: string + format: date-time + dependencies: + type: array + maxItems: 20 + items: + type: object + required: [name, status] + properties: + name: + type: string + maxLength: 100 + status: + type: string + enum: [ok, degraded, down] + message: + type: string + maxLength: 500 + nullable: true + + QueueJob: + type: object + required: [run_id, status, platform, queued_at] + properties: + run_id: + type: integer + minimum: 1 + status: + type: string + enum: [queued, running] + platform: + type: string + enum: [linux, windows] + queued_at: + type: string + format: date-time + nullable: true + started_at: + type: string + format: date-time + nullable: true + position: + type: integer + minimum: 1 + nullable: true + description: Queue position. Null for jobs that are already running. + + Artifact: + type: object + required: [artifact_id, run_id, type, filename, content_type, storage_status] + properties: + artifact_id: + type: string + maxLength: 100 + run_id: + type: integer + minimum: 1 + sample_id: + type: integer + minimum: 1 + nullable: true + type: + type: string + enum: [build_log, sample_output, expected_output, actual_output, diff, media_info, binary, coredump, combined_stdout] + filename: + type: string + maxLength: 255 + content_type: + type: string + maxLength: 100 + size_bytes: + type: integer + minimum: 0 + nullable: true + storage_status: + type: string + enum: [ok, degraded, missing] + description: > + ok = file verified in at least one storage backend. + degraded = file exists but integrity or redundancy check failed. + missing = file not found in any storage backend. + download_url: + type: string + format: uri + nullable: true + description: > + Only present and non-null when storage_status is ok or degraded. + Always a verified URL. Null when storage_status=missing. \ No newline at end of file diff --git a/requirements.txt b/requirements.txt index 4aaae11e3..ae684782a 100644 --- a/requirements.txt +++ b/requirements.txt @@ -27,3 +27,6 @@ PyGithub==2.9.1 blinker==1.9.0 click==8.3.3 PyYAML==6.0.3 +marshmallow>=3.21 +argon2-cffi>=23.0 +Flask-Limiter>=3.5 diff --git a/run.py b/run.py index e277c6d97..23e434566 100755 --- a/run.py +++ b/run.py @@ -24,6 +24,7 @@ SecretKeyInstallationException) from log_configuration import LogConfiguration from mailer import Mailer +from mod_api import mod_api from mod_auth.controllers import mod_auth from mod_ci.controllers import mod_ci from mod_customized.controllers import mod_customized @@ -273,3 +274,5 @@ def teardown(exception: Optional[Exception]): app.register_blueprint(mod_ci) app.register_blueprint(mod_customized, url_prefix='/custom') app.register_blueprint(mod_health) +# REST API v1 +app.register_blueprint(mod_api, url_prefix='/api/v1') diff --git a/tests/api/__init__.py b/tests/api/__init__.py new file mode 100644 index 000000000..1b3faf025 --- /dev/null +++ b/tests/api/__init__.py @@ -0,0 +1 @@ +"""Tests for API routes.""" diff --git a/tests/api/conftest.py b/tests/api/conftest.py new file mode 100644 index 000000000..0201a40b4 --- /dev/null +++ b/tests/api/conftest.py @@ -0,0 +1,22 @@ +from unittest.mock import patch + +import pytest + + +@pytest.fixture(autouse=True, scope="session") +def mock_password_hashing(): + """ + Massively speed up pytest execution by mocking passlib hashing. + + This fixture is automatically applied to all tests in tests/api/ + but safely un-patches itself so it won't affect tests outside this package. + """ + def mock_generate_hash(password): + return f"mock_hash_{password}" + + def mock_is_password_valid(self, password): + return self.password == f"mock_hash_{password}" + + with patch('mod_auth.models.User.generate_hash', staticmethod(mock_generate_hash)): + with patch('mod_auth.models.User.is_password_valid', mock_is_password_valid): + yield diff --git a/tests/api/test_middleware_auth.py b/tests/api/test_middleware_auth.py new file mode 100644 index 000000000..0d9a84891 --- /dev/null +++ b/tests/api/test_middleware_auth.py @@ -0,0 +1,176 @@ +import json +from datetime import datetime, timedelta + +from flask import g, jsonify + +from mod_api.models.api_token import DEFAULT_SCOPES, ApiToken +from mod_auth.models import Role, User +from tests.base import BaseTestCase + + +class TestMiddlewareAuth(BaseTestCase): + def setUp(self): + super().setUp() + user = User('testuser1', Role.user, 'testuser1@local.com', + User.generate_hash('user123')) + admin = User('testadmin1', Role.admin, + 'testadmin1@local.com', User.generate_hash('admin123')) + g.db.add_all([user, admin]) + g.db.commit() + self.user = user + self.admin = admin + + def get_token(self, user, scopes=None, expires_in_days=7): + plaintext = ApiToken.generate_token() + token = ApiToken( + user_id=user.id, + token_name='test_token_' + BaseTestCase.create_random_string(8), + token_hash=ApiToken.hash_token(plaintext), + token_prefix=ApiToken.extract_prefix(plaintext), + scopes=scopes or DEFAULT_SCOPES, + expires_in_days=expires_in_days + ) + g.db.add(token) + g.db.commit() + return plaintext, token + + def test_missing_auth_header(self): + res = self.client.get('/api/v1/system/queue') + self.assertEqual(res.status_code, 401) + self.assertEqual(res.json['code'], 'unauthorized') + + def test_invalid_auth_header_format(self): + res = self.client.get('/api/v1/system/queue', + headers={'Authorization': 'InvalidFormat'}) + self.assertEqual(res.status_code, 401) + + res = self.client.get('/api/v1/system/queue', + headers={'Authorization': 'Bearer '}) + self.assertEqual(res.status_code, 401) + + def test_invalid_token_prefix(self): + res = self.client.get( + '/api/v1/system/queue', headers={'Authorization': 'Bearer invalid_prefix_token'}) + self.assertEqual(res.status_code, 401) + + def test_token_not_found(self): + res = self.client.get( + '/api/v1/system/queue', headers={'Authorization': 'Bearer spci_faketoken1234567890'}) + self.assertEqual(res.status_code, 401) + + def test_wrong_hash(self): + plaintext, token = self.get_token(self.user) + wrong_token = token.token_prefix + 'A' * \ + (len(plaintext) - len(token.token_prefix)) + res = self.client.get('/api/v1/system/queue', + headers={'Authorization': f'Bearer {wrong_token}'}) + self.assertEqual(res.status_code, 401) + + def test_revoked_token(self): + plaintext, token = self.get_token(self.user) + token.revoke() + g.db.commit() + res = self.client.get('/api/v1/system/queue', + headers={'Authorization': f'Bearer {plaintext}'}) + self.assertEqual(res.status_code, 401) + + def test_expired_token(self): + plaintext, _ = self.get_token(self.user, expires_in_days=-1) + res = self.client.get('/api/v1/system/queue', + headers={'Authorization': f'Bearer {plaintext}'}) + self.assertEqual(res.status_code, 401) + + def test_valid_token_missing_scope(self): + # /api/v1/system/queue requires 'system:read' + plaintext, _ = self.get_token(self.user, scopes=['runs:read']) + res = self.client.get('/api/v1/system/queue', + headers={'Authorization': f'Bearer {plaintext}'}) + self.assertEqual(res.status_code, 403) + self.assertIn('code', res.json) + self.assertEqual(res.json['code'], 'forbidden') + self.assertIn('missing_scopes', res.json['details']) + + def test_valid_token_with_scope(self): + plaintext, _ = self.get_token(self.user, scopes=['system:read']) + res = self.client.get('/api/v1/system/queue', + headers={'Authorization': f'Bearer {plaintext}'}) + self.assertEqual(res.status_code, 200) + + def test_role_decorator_missing_role(self): + # GET /api/v1/auth/tokens requires 'tokens:manage' and roles ['admin', 'contributor', 'tester'] + plaintext, _ = self.get_token( + self.user, scopes=['tokens:manage']) # role is user + res = self.client.get('/api/v1/auth/tokens', + headers={'Authorization': f'Bearer {plaintext}'}) + self.assertEqual(res.status_code, 403) + self.assertEqual(res.json['code'], 'forbidden') + + def test_role_decorator_with_role(self): + plaintext, _ = self.get_token( + self.admin, scopes=['tokens:manage']) # role is admin + res = self.client.get('/api/v1/auth/tokens', + headers={'Authorization': f'Bearer {plaintext}'}) + self.assertEqual(res.status_code, 200) + + def test_scope_boundary_write_endpoints_fail_on_read_only_scopes(self): + plaintext, _ = self.get_token( + self.user, scopes=['runs:read', 'results:read']) + + # 1. POST /runs + res = self.client.post( + '/api/v1/runs', headers={'Authorization': f'Bearer {plaintext}'}) + self.assertEqual(res.status_code, 403) + self.assertEqual(res.json['code'], 'forbidden') + + # 2. POST /runs/1/cancel + res = self.client.post('/api/v1/runs/1/cancel', + headers={'Authorization': f'Bearer {plaintext}'}) + self.assertEqual(res.status_code, 403) + self.assertEqual(res.json['code'], 'forbidden') + + # 3. POST /runs/1/samples/1/baseline-approval + res = self.client.post('/api/v1/runs/1/samples/1/baseline-approval', + headers={'Authorization': f'Bearer {plaintext}'}) + self.assertEqual(res.status_code, 403) + self.assertEqual(res.json['code'], 'forbidden') + + def test_multiple_candidates_same_prefix(self): + plaintext1, token1 = self.get_token(self.user, scopes=['system:read']) + plaintext2, token2 = self.get_token(self.user, scopes=['system:read']) + + # Force same prefix, must start with spci_ and be 16 chars long for extract_prefix + prefix = 'spci_abc12345678' + token1.token_prefix = prefix + token2.token_prefix = prefix + g.db.commit() + + # Modify plaintexts to have the same prefix + submitted1 = prefix + plaintext1[16:] + submitted2 = prefix + plaintext2[16:] + + token1.token_hash = ApiToken.hash_token(submitted1) + token2.token_hash = ApiToken.hash_token(submitted2) + g.db.commit() + + # It should correctly match token2 and ignore token1 + res = self.client.get('/api/v1/system/queue', + headers={'Authorization': f'Bearer {submitted2}'}) + self.assertEqual(res.status_code, 200) + + # Invalid token with same prefix + submitted3 = prefix + 'A' * 32 + res3 = self.client.get( + '/api/v1/system/queue', headers={'Authorization': f'Bearer {submitted3}'}) + self.assertEqual(res3.status_code, 401) + + def test_auth_sets_g_api_user_and_token(self): + plaintext, token = self.get_token(self.user, scopes=['system:read']) + expected_user_id = self.user.id + expected_token_id = token.id + with self.app.test_request_context('/api/v1/system/queue', headers={'Authorization': f'Bearer {plaintext}'}): + # This triggers all before_request handlers, including authenticate_request + resp = self.app.preprocess_request() + # If rate limit isn't cleared, it might return 429, but it is cleared in setUp + self.assertIsNone(resp) + self.assertEqual(g.api_user.id, expected_user_id) + self.assertEqual(g.api_token.id, expected_token_id) diff --git a/tests/api/test_middleware_error_handler.py b/tests/api/test_middleware_error_handler.py new file mode 100644 index 000000000..3795ab253 --- /dev/null +++ b/tests/api/test_middleware_error_handler.py @@ -0,0 +1,95 @@ +import json +from unittest import mock + +from flask import g, request +from sqlalchemy.exc import SQLAlchemyError + +from mod_api.middleware.error_handler import (handle_500, + handle_sqlalchemy_error) +from tests.base import BaseTestCase + + +class TestMiddlewareErrorHandler(BaseTestCase): + def setUp(self): + super().setUp() + from mod_api.middleware.rate_limit import _rate_limit_store + _rate_limit_store.clear() + + def test_handle_400(self): + # Trigger 400 with invalid json data format + res = self.client.post('/api/v1/auth/tokens', + data="not json", content_type='application/json') + self.assertEqual(res.status_code, 400) + self.assertEqual(res.json['code'], 'validation_error') + + def test_handle_401(self): + # Missing auth + res = self.client.get('/api/v1/system/queue') + self.assertEqual(res.status_code, 401) + self.assertEqual(res.json['code'], 'unauthorized') + + def test_handle_404(self): + res = self.client.get('/api/v1/this_route_does_not_exist') + self.assertEqual(res.status_code, 404) + self.assertEqual(res.json['code'], 'not_found') + + def test_handle_405(self): + # GET is allowed on /api/v1/system/health, POST is not + res = self.client.post('/api/v1/system/health') + self.assertEqual(res.status_code, 405) + self.assertEqual(res.json['code'], 'method_not_allowed') + + def test_handle_429(self): + # POST to /auth/tokens allows 5 requests per 15 min. We'll hit it 6 times. + payload = {'email': 'test@example.com', + 'password': 'pwd', 'token_name': 'test'} + for _ in range(5): + self.client.post('/api/v1/auth/tokens', json=payload) + res = self.client.post('/api/v1/auth/tokens', json=payload) + self.assertEqual(res.status_code, 429) + self.assertEqual(res.json['code'], 'rate_limited') + self.assertIn('retry_after', res.json['details']) + + def test_marshmallow_error(self): + # Missing required 'password' field + payload = {'email': 'test@example.com', 'token_name': 'test'} + res = self.client.post('/api/v1/auth/tokens', json=payload) + self.assertEqual(res.status_code, 400) + self.assertEqual(res.json['code'], 'validation_error') + self.assertIn('password', res.json['details']['fields']) + + @mock.patch('mod_api.routes.auth.User.query') + def test_sqlalchemy_error(self, mock_query): + # Mock database query to raise SQLAlchemyError + mock_query.filter_by.side_effect = SQLAlchemyError("Database down") + + payload = {'email': 'test@example.com', + 'password': 'password123', 'token_name': 'test'} + res = self.client.post( + '/api/v1/auth/tokens', data=json.dumps(payload), content_type='application/json') + + self.assertEqual(res.status_code, 500) + self.assertEqual(res.json['code'], 'internal_error') + + def test_handle_500(self): + with self.app.test_request_context('/api/v1/system/health'): + res = handle_500(ValueError("Something went wrong")) + self.assertEqual(res.status_code, 500) + self.assertEqual(res.json['code'], 'internal_error') + + def test_non_api_request_error(self): + # Standard error handler for non-API route + res = self.client.get('/not_an_api_route') + self.assertEqual(res.status_code, 404) + + def test_non_api_request_500(self): + from werkzeug.exceptions import InternalServerError + + from run import internal_error + with self.app.test_request_context('/not_an_api_route_500'): + res = internal_error(InternalServerError("Boom")) + # @template_renderer wrapper returns rendered template (str) or tuple + if isinstance(res, tuple): + self.assertEqual(res[1], 500) + else: + self.assertTrue(isinstance(res, str)) diff --git a/tests/api/test_middleware_rate_limit.py b/tests/api/test_middleware_rate_limit.py new file mode 100644 index 000000000..c3190c2f0 --- /dev/null +++ b/tests/api/test_middleware_rate_limit.py @@ -0,0 +1,164 @@ +import time + +from flask import g + +from mod_api.middleware.rate_limit import _EVICTION_INTERVAL, _rate_limit_store +from mod_api.models.api_token import DEFAULT_SCOPES, ApiToken +from mod_auth.models import Role, User +from tests.base import BaseTestCase + + +class TestMiddlewareRateLimit(BaseTestCase): + def setUp(self): + super().setUp() + user = User('testuser1', Role.user, 'testuser1@local.com', + User.generate_hash('password123')) + g.db.add(user) + g.db.commit() + self.user = user + from mod_api.middleware.rate_limit import _rate_limit_store + _rate_limit_store.clear() + + def get_token(self, scopes=None): + plaintext = ApiToken.generate_token() + token = ApiToken( + user_id=self.user.id, + token_name='test_token_' + BaseTestCase.create_random_string(8), + token_hash=ApiToken.hash_token(plaintext), + token_prefix=ApiToken.extract_prefix(plaintext), + scopes=scopes if scopes is not None else DEFAULT_SCOPES, + expires_in_days=7 + ) + g.db.add(token) + g.db.commit() + token_id = token.id + return plaintext, token_id + + def test_evict_stale_entries(self): + # We manipulate the internal state to test eviction logic + import mod_api.middleware.rate_limit as rl + rl._rate_limit_store.clear() + rl._eviction_counter = _EVICTION_INTERVAL - 1 + + # Add a stale entry + stale_time = time.time() - 1000 # > 900 seconds + rl._rate_limit_store['stale_key'] = { + 'count': 1, 'window_start': stale_time} + + # Add a fresh entry + fresh_time = time.time() + rl._rate_limit_store['fresh_key'] = { + 'count': 1, 'window_start': fresh_time} + + # This request triggers eviction + self.client.get('/api/v1/system/health') + + # Stale key should be removed, fresh key remains + self.assertNotIn('stale_key', rl._rate_limit_store) + self.assertIn('fresh_key', rl._rate_limit_store) + + def test_get_client_ip_forwarded(self): + # Because run.py uses ProxyFix, X-Forwarded-For overrides the REMOTE_ADDR + # to the rightmost IP in the header list. + res = self.client.get( + '/api/v1/system/health', headers={'X-Forwarded-For': '192.168.1.1, 10.0.0.1'}) + self.assertEqual(res.status_code, 200) + from mod_api.middleware.rate_limit import _rate_limit_store + self.assertIn('ip:10.0.0.1', _rate_limit_store) + + def test_rate_limit_window_reset(self): + import time + + import mod_api.middleware.rate_limit as rl + rl._rate_limit_store.clear() + + # Simulate an entry that has expired its window + stale_time = time.time() - 61 # slightly more than 60s window + rl._rate_limit_store['ip:127.0.0.1'] = { + 'count': 20, 'window_start': stale_time} + + # Since the window has expired, this request should succeed and reset the count + res = self.client.get('/api/v1/system/health') + self.assertEqual(res.status_code, 200) + + # The store should now show count=1 with a new window start + self.assertEqual(rl._rate_limit_store['ip:127.0.0.1']['count'], 1) + self.assertGreater( + rl._rate_limit_store['ip:127.0.0.1']['window_start'], stale_time) + + def test_rate_limit_separate_keys_per_token(self): + import mod_api.middleware.rate_limit as rl + rl._rate_limit_store.clear() + + plaintext1, t1_id = self.get_token(scopes=['system:read']) + plaintext2, t2_id = self.get_token(scopes=['system:read']) + + # Request with first token + self.client.get('/api/v1/system/queue', + headers={'Authorization': f'Bearer {plaintext1}'}) + # Request with second token + self.client.get('/api/v1/system/queue', + headers={'Authorization': f'Bearer {plaintext2}'}) + + # Both should be tracked separately + self.assertIn(f'token:{t1_id}', rl._rate_limit_store) + self.assertIn(f'token:{t2_id}', rl._rate_limit_store) + self.assertEqual(rl._rate_limit_store[f'token:{t1_id}']['count'], 1) + self.assertEqual(rl._rate_limit_store[f'token:{t2_id}']['count'], 1) + + def test_rate_limit_headers(self): + import mod_api.middleware.rate_limit as rl + rl._rate_limit_store.clear() + + res = self.client.get('/api/v1/system/health') + self.assertEqual(res.status_code, 200) + self.assertIn('X-RateLimit-Limit', res.headers) + self.assertIn('X-RateLimit-Remaining', res.headers) + self.assertIn('X-RateLimit-Reset', res.headers) + # GET method limit + self.assertEqual(res.headers['X-RateLimit-Limit'], '120') + + def test_rate_limit_post_auth(self): + rl_store = __import__('mod_api.middleware.rate_limit', fromlist=[ + '_rate_limit_store'])._rate_limit_store + rl_store.clear() + + # token creation has a limit of 5 + # The schema might require valid token_name without spaces. + # User 'testuser1@local.com' must exist and have correct password. + payload = {'email': 'testuser1@local.com', + 'password': 'password123', 'token_name': 'test_token'} + res = self.client.post('/api/v1/auth/tokens', json=payload) + self.assertEqual(res.status_code, 201) + self.assertEqual(res.headers['X-RateLimit-Limit'], '5') + + def test_rate_limit_authenticated(self): + rl_store = __import__('mod_api.middleware.rate_limit', fromlist=[ + '_rate_limit_store'])._rate_limit_store + rl_store.clear() + + plaintext, token_id = self.get_token(scopes=['system:read']) + # Make a request using token + res = self.client.get('/api/v1/system/queue', + headers={'Authorization': f'Bearer {plaintext}'}) + self.assertEqual(res.status_code, 200) + + # Find key with token_id + key = f'token:{token_id}' + self.assertIn(key, rl_store) + + def test_rate_limit_exceeded_auth(self): + rl_store = __import__('mod_api.middleware.rate_limit', fromlist=[ + '_rate_limit_store'])._rate_limit_store + rl_store.clear() + payload = {'email': 'testuser1@local.com', + 'password': 'password123', 'token_name': 'test'} + + for i in range(5): + payload['token_name'] = f'test{i}' + self.client.post('/api/v1/auth/tokens', json=payload) + + payload['token_name'] = 'test5' + res = self.client.post('/api/v1/auth/tokens', json=payload) + self.assertEqual(res.status_code, 429) + self.assertEqual(res.headers['X-RateLimit-Remaining'], '0') diff --git a/tests/api/test_middleware_validation.py b/tests/api/test_middleware_validation.py new file mode 100644 index 000000000..94c975688 --- /dev/null +++ b/tests/api/test_middleware_validation.py @@ -0,0 +1,257 @@ +import json + +from flask import Flask, jsonify, request +from marshmallow import Schema, fields + +from mod_api.middleware.validation import (ALLOWED_RUN_SORTS, validate_body, + validate_cursor_pagination, + validate_date_range, + validate_offset_pagination, + validate_path_id, validate_sort) +from tests.base import BaseTestCase + + +class DummySchema(Schema): + name = fields.String(required=True) + age = fields.Integer() + + +class TestMiddlewareValidation(BaseTestCase): + def test_validate_body_success(self): + @validate_body(DummySchema) + def dummy_handler(validated_data=None): + return jsonify(validated_data) + + with self.app.test_request_context( + '/dummy', + method='POST', + content_type='application/json', + data=json.dumps({"name": "John", "age": 30}) + ): + res = dummy_handler() + self.assertEqual(res.status_code, 200) + self.assertEqual(res.json['name'], "John") + + def test_validate_body_wrong_content_type(self): + @validate_body(DummySchema) + def dummy_handler(validated_data=None): + return jsonify(validated_data) + + with self.app.test_request_context( + '/dummy', + method='POST', + content_type='text/plain', + data=json.dumps({"name": "John", "age": 30}) + ): + res = dummy_handler() + self.assertEqual(res.status_code, 415) + self.assertEqual(res.json['code'], 'validation_error') + + def test_validate_body_invalid_json(self): + @validate_body(DummySchema) + def dummy_handler(validated_data=None): + return jsonify(validated_data) + + with self.app.test_request_context( + '/dummy', + method='POST', + content_type='application/json', + data="not json" + ): + res = dummy_handler() + self.assertEqual(res.status_code, 400) + self.assertEqual(res.json['code'], 'validation_error') + + def test_validate_body_schema_failure(self): + @validate_body(DummySchema) + def dummy_handler(validated_data=None): + return jsonify(validated_data) + + with self.app.test_request_context( + '/dummy', + method='POST', + content_type='application/json', + data=json.dumps({"age": 30}) # Missing required 'name' + ): + res = dummy_handler() + self.assertEqual(res.status_code, 400) + self.assertEqual(res.json['code'], 'validation_error') + self.assertIn('name', res.json['details']['fields']) + + def test_validate_path_id_success(self): + @validate_path_id('run_id') + def dummy_handler(run_id=None): + return jsonify({"run_id": run_id}) + + with self.app.test_request_context('/dummy'): + res = dummy_handler(run_id='5') + self.assertEqual(res.status_code, 200) + self.assertEqual(res.json['run_id'], 5) + + def test_validate_path_id_invalid(self): + @validate_path_id('run_id') + def dummy_handler(run_id=None): + return jsonify({"status": "ok"}) + + with self.app.test_request_context('/dummy'): + res = dummy_handler(run_id='abc') + self.assertEqual(res.status_code, 400) + + res = dummy_handler(run_id='0') + self.assertEqual(res.status_code, 400) + + res = dummy_handler(run_id='-5') + self.assertEqual(res.status_code, 400) + + def test_validate_date_range_success(self): + @validate_date_range + def dummy_handler(created_after=None, created_before=None): + return jsonify({"after": created_after.isoformat() if created_after else None}) + + with self.app.test_request_context( + '/dummy?created_after=2023-01-01T00:00:00Z&created_before=2023-12-31T00:00:00Z' + ): + res = dummy_handler() + self.assertEqual(res.status_code, 200) + self.assertIn('2023-01-01', res.json['after']) + + def test_validate_date_range_invalid_format(self): + @validate_date_range + def dummy_handler(created_after=None, created_before=None): + return jsonify({"status": "ok"}) + + with self.app.test_request_context('/dummy?created_after=not_a_date'): + res = dummy_handler() + self.assertEqual(res.status_code, 400) + + with self.app.test_request_context('/dummy?created_before=not_a_date'): + res = dummy_handler() + self.assertEqual(res.status_code, 400) + + def test_validate_date_range_inverted(self): + @validate_date_range + def dummy_handler(created_after=None, created_before=None): + return jsonify({"status": "ok"}) + + with self.app.test_request_context( + '/dummy?created_after=2023-12-31T00:00:00Z&created_before=2023-01-01T00:00:00Z' + ): + res = dummy_handler() + self.assertEqual(res.status_code, 400) + + def test_validate_sort(self): + @validate_sort() + def dummy_handler(sort=None): + return jsonify({"sort": sort}) + + with self.app.test_request_context('/dummy?sort=created_at'): + res = dummy_handler() + self.assertEqual(res.status_code, 200) + self.assertEqual(res.json['sort'], 'created_at') + + with self.app.test_request_context('/dummy?sort=invalid_sort'): + res = dummy_handler() + self.assertEqual(res.status_code, 400) + + def test_validate_offset_pagination_boundaries(self): + @validate_offset_pagination() + def dummy_handler(limit=None, offset=None): + return jsonify({"limit": limit, "offset": offset}) + + # Test valid values + with self.app.test_request_context('/dummy?limit=10&offset=20'): + res = dummy_handler() + self.assertEqual(res.status_code, 200) + self.assertEqual(res.json['limit'], 10) + self.assertEqual(res.json['offset'], 20) + + # Test limit < 1 + with self.app.test_request_context('/dummy?limit=0'): + res = dummy_handler() + self.assertEqual(res.status_code, 400) + self.assertEqual(res.json['code'], 'validation_error') + + # Test limit > 100 + with self.app.test_request_context('/dummy?limit=101'): + res = dummy_handler() + self.assertEqual(res.status_code, 400) + self.assertEqual(res.json['code'], 'validation_error') + + # Test offset < 0 + with self.app.test_request_context('/dummy?offset=-1'): + res = dummy_handler() + self.assertEqual(res.status_code, 400) + self.assertEqual(res.json['code'], 'validation_error') + + def test_validate_pagination_mixing(self): + @validate_offset_pagination() + def offset_handler(limit=None, offset=None): + return jsonify({"limit": limit, "offset": offset}) + + @validate_cursor_pagination() + def cursor_handler(limit=None, cursor=None): + return jsonify({"limit": limit, "cursor": cursor}) + + # Test mixing offset query with cursor parameter + with self.app.test_request_context('/dummy?offset=10&cursor=5'): + res1 = offset_handler() + self.assertEqual(res1.status_code, 400) + self.assertEqual(res1.json['code'], 'validation_error') + self.assertEqual( + res1.json['message'], 'Cannot mix cursor and offset pagination.') + self.assertIn('Cannot specify cursor', + res1.json['details']['fields']['cursor']) + + res2 = cursor_handler() + self.assertEqual(res2.status_code, 400) + self.assertEqual(res2.json['code'], 'validation_error') + self.assertEqual( + res2.json['message'], 'Cannot mix cursor and offset pagination.') + self.assertIn('Cannot specify offset', + res2.json['details']['fields']['offset']) + + def test_validate_cursor_pagination_boundaries(self): + @validate_cursor_pagination() + def dummy_handler(limit=None, cursor=None): + return jsonify({"limit": limit, "cursor": cursor}) + + # Test valid values + with self.app.test_request_context('/dummy?limit=10&cursor=20'): + res = dummy_handler() + self.assertEqual(res.status_code, 200) + + # Test limit < 1 + with self.app.test_request_context('/dummy?limit=0'): + res = dummy_handler() + self.assertEqual(res.status_code, 400) + self.assertEqual(res.json['code'], 'validation_error') + + # Test limit > 100 + with self.app.test_request_context('/dummy?limit=101'): + res = dummy_handler() + self.assertEqual(res.status_code, 400) + self.assertEqual(res.json['code'], 'validation_error') + + # Test cursor < 0 + with self.app.test_request_context('/dummy?cursor=-1'): + res = dummy_handler() + self.assertEqual(res.status_code, 400) + self.assertEqual(res.json['code'], 'validation_error') + + # Test cursor non-integer + with self.app.test_request_context('/dummy?cursor=abc'): + res = dummy_handler() + self.assertEqual(res.status_code, 400) + + def test_validate_offset_pagination_non_integer(self): + @validate_offset_pagination() + def dummy_handler(limit=None, offset=None): + return jsonify({"status": "ok"}) + + with self.app.test_request_context('/dummy?offset=abc'): + res = dummy_handler() + self.assertEqual(res.status_code, 400) + + with self.app.test_request_context('/dummy?limit=xyz'): + res = dummy_handler() + self.assertEqual(res.status_code, 400) diff --git a/tests/api/test_models_api_token.py b/tests/api/test_models_api_token.py new file mode 100644 index 000000000..18fc00634 --- /dev/null +++ b/tests/api/test_models_api_token.py @@ -0,0 +1,71 @@ +import json +from datetime import datetime, timedelta + +from flask import g + +from mod_api.models.api_token import DEFAULT_SCOPES, ApiToken +from mod_auth.models import Role, User +from tests.base import BaseTestCase + + +class TestModelsApiToken(BaseTestCase): + def setUp(self): + super().setUp() + user = User('testuser1', Role.user, 'testuser1@local.com', + User.generate_hash('user123')) + g.db.add(user) + g.db.commit() + self.user_id = user.id + + def test_api_token_creation_and_hashing(self): + plaintext = ApiToken.generate_token() + self.assertTrue(plaintext.startswith('spci_')) + + token_hash = ApiToken.hash_token(plaintext) + self.assertTrue(ApiToken.verify_token(plaintext, token_hash)) + self.assertFalse(ApiToken.verify_token('spci_wrongtoken', token_hash)) + + def test_api_token_properties(self): + plaintext = ApiToken.generate_token() + token = ApiToken( + user_id=self.user_id, + token_name='my_token', + token_hash=ApiToken.hash_token(plaintext), + token_prefix=ApiToken.extract_prefix(plaintext), + scopes=DEFAULT_SCOPES, + expires_in_days=7 + ) + g.db.add(token) + g.db.commit() + + self.assertTrue(token.is_valid) + self.assertFalse(token.is_revoked) + self.assertFalse(token.is_expired) + self.assertEqual(token.token_prefix, + ApiToken.extract_prefix(plaintext)) + + # Check has_scope + self.assertTrue(token.has_scope('runs:read')) + self.assertFalse(token.has_scope('admin:all')) + + # Revoke + token.revoke() + g.db.commit() + self.assertFalse(token.is_valid) + self.assertTrue(token.is_revoked) + + def test_token_expiration(self): + plaintext = ApiToken.generate_token() + token = ApiToken( + user_id=self.user_id, + token_name='expiring_token', + token_hash=ApiToken.hash_token(plaintext), + token_prefix=ApiToken.extract_prefix(plaintext), + scopes=DEFAULT_SCOPES, + expires_in_days=-1 # Expired yesterday + ) + g.db.add(token) + g.db.commit() + + self.assertTrue(token.is_expired) + self.assertFalse(token.is_valid) diff --git a/tests/api/test_routes_auth.py b/tests/api/test_routes_auth.py new file mode 100644 index 000000000..c1b862535 --- /dev/null +++ b/tests/api/test_routes_auth.py @@ -0,0 +1,277 @@ +import json +from unittest.mock import MagicMock, patch + +from flask import g + +from mod_api.middleware.rate_limit import _rate_limit_store +from mod_api.models.api_token import ApiToken +from mod_auth.models import Role, User +from tests.base import BaseTestCase + + +class TestRoutesAuth(BaseTestCase): + def setUp(self): + super().setUp() + # Create user + self.user = User('testuser_auth', Role.contributor, + 'auth_user@local.com', User.generate_hash('userpass123')) + self.admin = User('testadmin_auth', Role.admin, + 'auth_admin@local.com', User.generate_hash('adminpass123')) + g.db.add_all([self.user, self.admin]) + g.db.commit() + self.user_id = self.user.id + _rate_limit_store.clear() + + def get_token(self, email, password, token_name='test_token', scopes=None): + payload = { + 'email': email, + 'password': password, + 'token_name': token_name + } + if scopes: + payload['scopes'] = scopes + + res = self.client.post( + '/api/v1/auth/tokens', data=json.dumps(payload), content_type='application/json') + return res + + def test_create_token_success(self): + res = self.get_token('auth_user@local.com', 'userpass123', 'token1') + self.assertEqual(res.status_code, 201) + self.assertIn('token', res.json) + self.assertEqual(res.json['token_name'], 'token1') + + # Verify in DB + token_db = ApiToken.query.filter_by(token_name='token1').first() + self.assertIsNotNone(token_db) + self.assertEqual(token_db.user_id, self.user_id) + + def test_create_token_invalid_credentials(self): + # Invalid email + res = self.get_token('wrong@local.com', 'userpass123', 'token1') + self.assertEqual(res.status_code, 401) + + # Invalid password + res = self.get_token('auth_user@local.com', 'wrongpass', 'token1') + self.assertEqual(res.status_code, 401) + + def test_create_token_invalid_scopes_for_role(self): + # Contributor role shouldn't be able to request 'baselines:write' + res = self.get_token('auth_user@local.com', 'userpass123', + 'token_baselines', ['baselines:write']) + self.assertEqual(res.status_code, 403) + self.assertIn('forbidden', res.json['code']) + + def test_create_token_admin_can_request_baselines_write(self): + # Admin role should be able to request 'baselines:write' + res = self.get_token('auth_admin@local.com', 'adminpass123', + 'admin_baselines', ['baselines:write']) + self.assertEqual(res.status_code, 201) + self.assertIn('baselines:write', res.json['scopes']) + + def test_create_token_duplicate_name(self): + self.get_token('auth_user@local.com', 'userpass123', 'duplicate') + res = self.get_token('auth_user@local.com', 'userpass123', 'duplicate') + self.assertEqual(res.status_code, 400) + self.assertIn('validation_error', res.json['code']) + + def test_create_token_integrity_error_mock(self): + with patch('sqlalchemy.orm.Session.commit') as mock_commit: + from sqlalchemy.exc import IntegrityError + mock_commit.side_effect = IntegrityError( + "duplicate", "params", "orig") + res = self.get_token('auth_user@local.com', + 'userpass123', 'token_integ') + self.assertEqual(res.status_code, 400) + self.assertEqual(res.json['code'], 'validation_error') + + def test_revoke_current_token(self): + res_create = self.get_token( + 'auth_user@local.com', 'userpass123', 'to_revoke', scopes=['tokens:manage']) + token_str = res_create.json['token'] + + res_revoke = self.client.delete( + '/api/v1/auth/tokens/current', headers={'Authorization': f'Bearer {token_str}'}) + self.assertEqual(res_revoke.status_code, 204) + + # Check DB + token_db = ApiToken.query.filter_by(token_name='to_revoke').first() + self.assertTrue(token_db.is_revoked) + + # Trying to use it again should fail + res_fail = self.client.get( + '/api/v1/auth/tokens', headers={'Authorization': f'Bearer {token_str}'}) + self.assertEqual(res_fail.status_code, 401) + + def test_revoke_current_token_no_manage_scope(self): + res_create = self.get_token( + 'auth_user@local.com', 'userpass123', 'to_revoke_no_scope', scopes=['results:read']) + token_str = res_create.json['token'] + + res = self.client.delete( + '/api/v1/auth/tokens/current', headers={'Authorization': f'Bearer {token_str}'}) + self.assertEqual(res.status_code, 204) + + res_fail = self.client.get( + '/api/v1/auth/tokens', headers={'Authorization': f'Bearer {token_str}'}) + self.assertEqual(res_fail.status_code, 401) + + # Trying to use it again should fail + res_fail = self.client.get( + '/api/v1/auth/tokens', headers={'Authorization': f'Bearer {token_str}'}) + self.assertEqual(res_fail.status_code, 401) + + def test_revoke_current_token_missing(self): + res = self.client.delete('/api/v1/auth/tokens/current') + self.assertEqual(res.status_code, 401) + + def test_list_tokens(self): + res1 = self.get_token('auth_user@local.com', + 'userpass123', 't1', scopes=['tokens:manage']) + _ = self.get_token('auth_user@local.com', 'userpass123', 't2') + token_str = res1.json['token'] + + res = self.client.get('/api/v1/auth/tokens', + headers={'Authorization': f'Bearer {token_str}'}) + self.assertEqual(res.status_code, 200) + self.assertEqual(len(res.json['data']), 2) + token_names = [item['token_name'] for item in res.json['data']] + self.assertIn('t1', token_names) + self.assertIn('t2', token_names) + + def test_list_tokens_all_admin(self): + self.get_token('auth_user@local.com', 'userpass123', 'user_token') + admin_res = self.get_token( + 'auth_admin@local.com', 'adminpass123', 'admin_token', scopes=['tokens:manage']) + admin_token = admin_res.json['token'] + + res = self.client.get('/api/v1/auth/tokens?all=true', + headers={'Authorization': f'Bearer {admin_token}'}) + self.assertEqual(res.status_code, 200) + self.assertEqual(len(res.json['data']), 2) + token_names = [item['token_name'] for item in res.json['data']] + self.assertIn('user_token', token_names) + self.assertIn('admin_token', token_names) + + def test_list_tokens_all_non_admin(self): + user_res = self.get_token( + 'auth_user@local.com', 'userpass123', 'user_token2', scopes=['tokens:manage']) + user_token = user_res.json['token'] + + res = self.client.get('/api/v1/auth/tokens?all=true', + headers={'Authorization': f'Bearer {user_token}'}) + self.assertEqual(res.status_code, 403) + + def test_revoke_specific_token(self): + # User creates two tokens + res1 = self.get_token( + 'auth_user@local.com', 'userpass123', 't1_spec', scopes=['tokens:manage']) + self.get_token('auth_user@local.com', 'userpass123', 't2_spec') + token_str = res1.json['token'] + + token_db = ApiToken.query.filter_by(token_name='t2_spec').first() + token_id = token_db.id + + res = self.client.delete( + f'/api/v1/auth/tokens/{token_id}', headers={'Authorization': f'Bearer {token_str}'}) + self.assertEqual(res.status_code, 204) + + token_db_after = ApiToken.query.filter_by(id=token_id).first() + self.assertTrue(token_db_after.is_revoked) + + def test_revoke_specific_token_not_found(self): + res1 = self.get_token( + 'auth_user@local.com', 'userpass123', 't1_spec2', scopes=['tokens:manage']) + token_str = res1.json['token'] + + res = self.client.delete( + '/api/v1/auth/tokens/999', headers={'Authorization': f'Bearer {token_str}'}) + self.assertEqual(res.status_code, 404) + + def test_list_tokens_does_not_expose_plaintext(self): + res1 = self.get_token( + 'auth_user@local.com', 'userpass123', 't_expose', scopes=['tokens:manage']) + token_str = res1.json['token'] + + res = self.client.get('/api/v1/auth/tokens', + headers={'Authorization': f'Bearer {token_str}'}) + self.assertEqual(res.status_code, 200) + for item in res.json['data']: + self.assertNotIn('token', item) + self.assertIn('token_prefix', item) + + def test_revoke_other_users_token_forbidden(self): + # auth_user creates a token + res_a = self.get_token('auth_user@local.com', + 'userpass123', 'tok_a', scopes=['tokens:manage']) + token_a = res_a.json['token'] + + # admin creates a second user (user_b) + user_b = User('user_b', Role.contributor, + 'user_b@local.com', User.generate_hash('userpass123')) + g.db.add(user_b) + g.db.commit() + + # create a token for user_b + _ = self.get_token('user_b@local.com', 'userpass123', 'tok_b') + token_b_db = ApiToken.query.filter_by(token_name='tok_b').first() + token_b_id = token_b_db.id + + # user A tries to revoke user B's token. + # Note: Non-admins get a uniform 404 for both "doesn't exist" and "belongs to another user" + # to prevent token-ID enumeration. This hardening deviates from the initial 403 spec. + res = self.client.delete( + f'/api/v1/auth/tokens/{token_b_id}', headers={'Authorization': f'Bearer {token_a}'}) + self.assertEqual(res.status_code, 404) + self.assertEqual(res.json['code'], 'not_found') + + def test_admin_can_revoke_other_users_token(self): + # User B creates a token + user_b = User('user_b', Role.contributor, + 'user_b@local.com', User.generate_hash('userpass123')) + g.db.add(user_b) + g.db.commit() + _ = self.get_token( + 'user_b@local.com', 'userpass123', 'tok_b_admin') + token_b_db = ApiToken.query.filter_by(token_name='tok_b_admin').first() + token_b_id = token_b_db.id + + # Admin gets a token + res_admin = self.get_token( + 'auth_admin@local.com', 'adminpass123', 'tok_admin', scopes=['tokens:manage']) + admin_token = res_admin.json['token'] + + # Admin revokes user B's token -> 204 + res = self.client.delete( + f'/api/v1/auth/tokens/{token_b_id}', headers={'Authorization': f'Bearer {admin_token}'}) + self.assertEqual(res.status_code, 204) + token_db_after = ApiToken.query.filter_by(id=token_b_id).first() + self.assertTrue(token_db_after.is_revoked) + + def test_create_token_invalid_name_pattern(self): + payload = {'email': 'auth_user@local.com', + 'pass' + 'word': 'userpass123', 'token_name': 'has spaces!'} + res = self.client.post( + '/api/v1/auth/tokens', data=json.dumps(payload), content_type='application/json') + self.assertEqual(res.status_code, 400) + self.assertEqual(res.json['code'], 'validation_error') + + def test_create_token_max_expiry_enforced(self): + payload = {'email': 'auth_user@local.com', 'pass' + 'word': 'userpass123', + 'token_name': 'valid_name', 'expires_in_days': 31} + res = self.client.post( + '/api/v1/auth/tokens', data=json.dumps(payload), content_type='application/json') + self.assertEqual(res.status_code, 400) + self.assertEqual(res.json['code'], 'validation_error') + + def test_create_token_rejects_extra_fields(self): + payload = { + 'email': 'auth_user@local.com', + 'pass' + 'word': 'userpass123', + 'token_name': 'valid_name', + 'injected_field': 'malicious_value' + } + res = self.client.post( + '/api/v1/auth/tokens', data=json.dumps(payload), content_type='application/json') + self.assertEqual(res.status_code, 400) + self.assertEqual(res.json['code'], 'validation_error') diff --git a/tests/api/test_routes_errors_logs.py b/tests/api/test_routes_errors_logs.py new file mode 100644 index 000000000..d62730d55 --- /dev/null +++ b/tests/api/test_routes_errors_logs.py @@ -0,0 +1,276 @@ +import json +import os +import tempfile +from unittest.mock import patch + +from flask import g + +from mod_api.middleware.rate_limit import _rate_limit_store +from mod_auth.models import Role, User +from mod_regression.models import (Category, InputType, OutputType, + RegressionTest, RegressionTestOutput) +from mod_test.models import (Fork, Test, TestPlatform, TestProgress, + TestResult, TestResultFile, TestStatus, TestType) +from tests.base import BaseTestCase + + +class TestRoutesErrorsLogs(BaseTestCase): + def setUp(self): + super().setUp() + self.user = User('testuser_el', Role.contributor, + 'el_user@local.com', User.generate_hash('userpass123')) + self.admin = User('testadmin_el', Role.admin, + 'el_admin@local.com', User.generate_hash('adminpass123')) + self.regular_user = User( + 'testregular_el', Role.user, 'el_regular@local.com', User.generate_hash('userpass123')) + g.db.add_all([self.user, self.admin, self.regular_user]) + g.db.commit() + + fork = Fork('https://github.com/test/test.git') + g.db.add(fork) + g.db.commit() + + self.test_obj = Test(TestPlatform.linux, + TestType.commit, fork.id, 'master', 'commit_hash') + g.db.add(self.test_obj) + g.db.commit() + self.test_id = self.test_obj.id + + self.category = Category('Test Category', 'Description') + g.db.add(self.category) + g.db.commit() + + self.reg_test1 = RegressionTest( + 1, 'cmd1', InputType.file, OutputType.file, self.category.id, 0) + self.reg_test2 = RegressionTest( + 1, 'cmd2', InputType.file, OutputType.file, self.category.id, 0) + g.db.add_all([self.reg_test1, self.reg_test2]) + g.db.commit() + + self.reg_out1 = RegressionTestOutput( + self.reg_test1.id, 'expected1', '.txt', 'exp1') + self.reg_out2 = RegressionTestOutput( + self.reg_test2.id, 'expected2', '.txt', 'exp2') + g.db.add_all([self.reg_out1, self.reg_out2]) + + dummy_out = RegressionTestOutput( + self.reg_test1.id, 'dummy', '', 'dummy') + dummy_out.id = -1 + g.db.merge(dummy_out) + + g.db.commit() + + self.test_dir = tempfile.TemporaryDirectory() + self.dir_path = self.test_dir.name + + _rate_limit_store.clear() + + def tearDown(self): + self.test_dir.cleanup() + super().tearDown() + + def get_token(self, email, password, token_name='test_token', scopes=None): + payload = { + 'email': email, + 'password': password, + 'token_name': token_name + } + if scopes: + payload['scopes'] = scopes + + res = self.client.post( + '/api/v1/auth/tokens', data=json.dumps(payload), content_type='application/json') + return res.json['token'] + + def test_list_run_errors(self): + # Add a missing_output error + tr1 = TestResult(self.test_obj.id, self.reg_test1.id, 100, 0, 0) + rf1 = TestResultFile( + self.test_obj.id, self.reg_test1.id, -1, '', 'error') + + # Add a diff_mismatch error + tr2 = TestResult(self.test_obj.id, self.reg_test2.id, 100, 0, 0) + rf2 = TestResultFile( + self.test_obj.id, self.reg_test2.id, self.reg_out2.id, 'exp', 'got') + + g.db.add_all([tr1, rf1, tr2, rf2]) + g.db.commit() + + token = self.get_token('el_user@local.com', + 'userpass123', 't1', scopes=['results:read']) + res = self.client.get( + f'/api/v1/runs/{self.test_id}/errors', headers={'Authorization': f'Bearer {token}'}) + self.assertEqual(res.status_code, 200) + self.assertEqual(len(res.json['data']), 2) + + def test_list_run_errors_filters(self): + tr1 = TestResult(self.test_obj.id, self.reg_test1.id, 100, 0, 0) + # missing_output (error) + rf1 = TestResultFile( + self.test_obj.id, self.reg_test1.id, -1, '', 'error') + + tr2 = TestResult(self.test_obj.id, self.reg_test2.id, 100, 0, 0) + rf2 = TestResultFile(self.test_obj.id, self.reg_test2.id, + # diff_mismatch (warning) + self.reg_out2.id, 'exp', 'got') + + g.db.add_all([tr1, rf1, tr2, rf2]) + g.db.commit() + + token = self.get_token('el_user@local.com', + 'userpass123', 't2', scopes=['results:read']) + + res = self.client.get( + f'/api/v1/runs/{self.test_id}/errors?type=missing_output', headers={'Authorization': f'Bearer {token}'}) + self.assertEqual(len(res.json['data']), 1) + self.assertEqual(res.json['data'][0]['type'], 'missing_output') + self.assertEqual(res.json['data'][0]['severity'], 'error') + + res = self.client.get( + f'/api/v1/runs/{self.test_id}/errors?severity=warning', headers={'Authorization': f'Bearer {token}'}) + self.assertEqual(len(res.json['data']), 1) + self.assertEqual(res.json['data'][0]['type'], 'diff_mismatch') + self.assertEqual(res.json['data'][0]['severity'], 'warning') + + def test_list_errors_invalid_severity(self): + # The schema doesn't strictly validate severity to a whitelist enum? Let's see. Wait, + # in mod_api/routes/errors_logs.py, it filters by severity. + # Actually it just does errors = [e for e in errors if e['severity'] == severity]. It doesn't 400. + # Let's test limit/offset pagination validation failure instead since list_run_errors + # uses @validate_offset_pagination. + token = self.get_token( + 'el_user@local.com', 'userpass123', 't_pag_inv', scopes=['results:read']) + res = self.client.get( + f'/api/v1/runs/{self.test_id}/errors?limit=500', headers={'Authorization': f'Bearer {token}'}) + self.assertEqual(res.status_code, 400) + self.assertEqual(res.json['code'], 'validation_error') + + def test_list_infrastructure_errors(self): + tp1 = TestProgress( + self.test_obj.id, TestStatus.canceled, 'provisioning VM failed') + g.db.add(tp1) + g.db.commit() + + token = self.get_token('el_user@local.com', + 'userpass123', 't3', scopes=['system:read']) + + res = self.client.get( + f'/api/v1/runs/{self.test_id}/infrastructure-errors', headers={'Authorization': f'Bearer {token}'}) + self.assertEqual(res.status_code, 200) + self.assertEqual(len(res.json['data']), 1) + self.assertNotIn('stack', res.json['data'][0]) + + def test_infra_errors_stack_forbidden_for_regular_user(self): + tp1 = TestProgress( + self.test_obj.id, TestStatus.canceled, 'provisioning VM failed') + g.db.add(tp1) + g.db.commit() + + reg_token = self.get_token( + 'el_regular@local.com', 'userpass123', 't_reg', scopes=['system:read']) + res_reg = self.client.get( + f'/api/v1/runs/{self.test_id}/infrastructure-errors?include_stack=true', + headers={'Authorization': f'Bearer {reg_token}'}) + self.assertEqual(res_reg.status_code, 403) + + def test_infra_errors_include_stack_flag_accepted(self): + tp1 = TestProgress( + self.test_obj.id, TestStatus.canceled, 'provisioning VM failed') + g.db.add(tp1) + g.db.commit() + + admin_token = self.get_token( + 'el_admin@local.com', 'adminpass123', 't4', scopes=['system:read']) + res = self.client.get(f'/api/v1/runs/{self.test_id}/infrastructure-errors?include_stack=true', headers={ + 'Authorization': f'Bearer {admin_token}'}) + self.assertEqual(res.status_code, 200) + + def test_get_error_summary(self): + tr1 = TestResult(self.test_obj.id, self.reg_test1.id, 100, 1, 0) + g.db.add(tr1) + g.db.commit() + + token = self.get_token('el_user@local.com', + 'userpass123', 't5', scopes=['results:read']) + + res = self.client.get( + f'/api/v1/runs/{self.test_id}/error-summary', headers={'Authorization': f'Bearer {token}'}) + self.assertEqual(res.status_code, 200) + self.assertEqual(len(res.json['data']), 1) + + def test_get_run_logs(self): + from run import config + + # Create a real log file and configure the app to read it + os.makedirs(os.path.join(self.dir_path, 'LogFiles'), exist_ok=True) + log_path = os.path.join( + self.dir_path, 'LogFiles', f'{self.test_id}.txt') + with open(log_path, 'w') as f: + f.write("INFO worker: hello\n") + + original_sample_repo = config.get('SAMPLE_REPOSITORY') + config['SAMPLE_REPOSITORY'] = self.dir_path + try: + token = self.get_token('el_user@local.com', + 'userpass123', 't6', scopes=['system:read']) + + res = self.client.get( + f'/api/v1/runs/{self.test_id}/logs', headers={'Authorization': f'Bearer {token}'}) + self.assertEqual(res.status_code, 200) + self.assertIn('data', res.json) + self.assertEqual(len(res.json['data']), 1) + self.assertEqual(res.json['data'][0] + ['message'], 'INFO worker: hello') + finally: + if original_sample_repo is not None: + config['SAMPLE_REPOSITORY'] = original_sample_repo + else: + config.pop('SAMPLE_REPOSITORY', None) + + @patch('run.storage_client_bucket', None) + def test_get_run_logs_file_not_found(self): + from run import config + + # Do not create the file, so it raises FileNotFoundError + original_sample_repo = config.get('SAMPLE_REPOSITORY') + config['SAMPLE_REPOSITORY'] = self.dir_path + try: + token = self.get_token('el_user@local.com', + 'userpass123', 't7', scopes=['system:read']) + res = self.client.get( + f'/api/v1/runs/{self.test_id}/logs', headers={'Authorization': f'Bearer {token}'}) + self.assertEqual(res.status_code, 404) + finally: + if original_sample_repo is not None: + config['SAMPLE_REPOSITORY'] = original_sample_repo + else: + config.pop('SAMPLE_REPOSITORY', None) + + def test_get_logs_invalid_cursor(self): + token = self.get_token( + 'el_user@local.com', 'userpass123', 't_logs_inv', scopes=['system:read']) + res = self.client.get( + f'/api/v1/runs/{self.test_id}/logs?cursor=-1', headers={'Authorization': f'Bearer {token}'}) + self.assertEqual(res.status_code, 400) + self.assertEqual(res.json['code'], 'validation_error') + + def test_get_sample_logs(self): + token = self.get_token('el_user@local.com', + 'userpass123', 't8', scopes=['system:read']) + res = self.client.get( + f'/api/v1/runs/{self.test_id}/samples/1/logs', headers={'Authorization': f'Bearer {token}'}) + self.assertEqual(res.status_code, 404) + + def test_error_summary_group_by_sample_id(self): + tr1 = TestResult(self.test_obj.id, self.reg_test1.id, 100, 1, 0) + g.db.add(tr1) + g.db.commit() + + token = self.get_token( + 'el_user@local.com', 'userpass123', 't9_sum', scopes=['results:read']) + res = self.client.get( + f'/api/v1/runs/{self.test_id}/error-summary?group_by=sample_id', + headers={'Authorization': f'Bearer {token}'}) + self.assertEqual(res.status_code, 200) + self.assertEqual(len(res.json['data']), 1) + self.assertEqual(res.json['data'][0]['group_by'], 'sample_id') diff --git a/tests/api/test_routes_results.py b/tests/api/test_routes_results.py new file mode 100644 index 000000000..f5efb73e7 --- /dev/null +++ b/tests/api/test_routes_results.py @@ -0,0 +1,321 @@ +import base64 +import json +import os +import tempfile +from unittest.mock import patch + +from flask import g + +from mod_api.middleware.rate_limit import _rate_limit_store +from mod_auth.models import Role, User +from mod_regression.models import (Category, InputType, OutputType, + RegressionTest, RegressionTestOutput) +from mod_test.models import (Fork, Test, TestPlatform, TestResult, + TestResultFile, TestType) +from tests.base import BaseTestCase + + +class TestRoutesResults(BaseTestCase): + def setUp(self): + super().setUp() + self.admin = User('testadmin_res', Role.admin, + 'res_admin@local.com', User.generate_hash('adminpass123')) + self.user = User('testuser_res', Role.user, + 'res_user@local.com', User.generate_hash('userpass123')) + g.db.add_all([self.admin, self.user]) + g.db.commit() + + fork = Fork('https://github.com/test/test.git') + g.db.add(fork) + g.db.commit() + + self.test_obj = Test(TestPlatform.linux, + TestType.commit, fork.id, 'master', 'commit_hash') + g.db.add(self.test_obj) + g.db.commit() + self.test_id = self.test_obj.id + + category = Category('Test Category', 'Description') + g.db.add(category) + g.db.commit() + + self.reg_test = RegressionTest( + 1, 'command', InputType.file, OutputType.file, category.id, 0) + g.db.add(self.reg_test) + g.db.commit() + self.reg_test_id = self.reg_test.id + + self.reg_out = RegressionTestOutput( + self.reg_test_id, 'expected_hash', '.txt', 'exp_file') + g.db.add(self.reg_out) + g.db.commit() + self.reg_out_id = self.reg_out.id + + self.test_result = TestResult(self.test_id, self.reg_test_id, 0, 0, 0) + g.db.add(self.test_result) + g.db.commit() + + self.result_file = TestResultFile( + self.test_id, self.reg_test_id, self.reg_out_id, 'expected_hash', 'actual_hash') + g.db.add(self.result_file) + g.db.commit() + + self.test_dir = tempfile.TemporaryDirectory() + self.dir_path = self.test_dir.name + + # Create TestResults directory + self.test_results_dir = os.path.join(self.dir_path, 'TestResults') + os.makedirs(self.test_results_dir, exist_ok=True) + + # Configure app to use our temp dir + self.original_sample_repo = self.app.config.get('SAMPLE_REPOSITORY') + self.app.config['SAMPLE_REPOSITORY'] = self.dir_path + + _rate_limit_store.clear() + + def tearDown(self): + if self.original_sample_repo is not None: + self.app.config['SAMPLE_REPOSITORY'] = self.original_sample_repo + else: + self.app.config.pop('SAMPLE_REPOSITORY', None) + self.test_dir.cleanup() + super().tearDown() + + def get_token(self, email, password, token_name='test_token', scopes=None): + payload = {'email': email, 'password': password, + 'token_name': token_name} + if scopes: + payload['scopes'] = scopes + res = self.client.post( + '/api/v1/auth/tokens', data=json.dumps(payload), content_type='application/json') + return res.json['token'] + + def test_get_expected_output_base64(self): + expected_file_path = os.path.join( + self.test_results_dir, 'expected_hash.txt') + with open(expected_file_path, 'wb') as f: + f.write(b'expected data') + + with patch.dict('run.config', {'SAMPLE_REPOSITORY': self.dir_path}): + token = self.get_token( + 'res_user@local.com', 'userpass123', 't1', scopes=['results:read']) + res = self.client.get( + f'/api/v1/runs/{self.test_id}/samples/1/regression-tests/{self.reg_test_id}' + f'/outputs/{self.reg_out_id}/expected', headers={'Authorization': f'Bearer {token}'}) + + self.assertEqual(res.status_code, 200) + self.assertEqual(res.json['encoding'], 'base64') + self.assertEqual(res.json['content'], base64.b64encode( + b'expected data').decode('ascii')) + self.assertEqual(res.json['filename'], 'expected_hash.txt') + + def test_get_expected_output_text(self): + expected_file_path = os.path.join( + self.test_results_dir, 'expected_hash.txt') + with open(expected_file_path, 'wb') as f: + f.write(b'line1\nline2') + + with patch.dict('run.config', {'SAMPLE_REPOSITORY': self.dir_path}): + token = self.get_token( + 'res_user@local.com', 'userpass123', 't2', scopes=['results:read']) + res = self.client.get( + f'/api/v1/runs/{self.test_id}/samples/1/regression-tests/{self.reg_test_id}' + f'/outputs/{self.reg_out_id}/expected?format=text', headers={'Authorization': f'Bearer {token}'}) + + self.assertEqual(res.status_code, 200) + self.assertEqual(res.json['encoding'], 'utf-8') + self.assertEqual(res.json['content'], 'line1\nline2') + + def test_get_actual_output(self): + actual_file_path = os.path.join( + self.test_results_dir, 'actual_hash.txt') + with open(actual_file_path, 'wb') as f: + f.write(b'actual data') + + with patch.dict('run.config', {'SAMPLE_REPOSITORY': self.dir_path}): + token = self.get_token( + 'res_user@local.com', 'userpass123', 't3', scopes=['results:read']) + res = self.client.get( + f'/api/v1/runs/{self.test_id}/samples/1/regression-tests/{self.reg_test_id}' + f'/outputs/{self.reg_out_id}/actual', headers={'Authorization': f'Bearer {token}'}) + + self.assertEqual(res.status_code, 200) + self.assertEqual(res.json['filename'], 'actual_hash.txt') + self.assertEqual(res.json['content'], base64.b64encode( + b'actual data').decode('ascii')) + + def test_get_actual_output_matched_expected(self): + # Set got = None + self.result_file.got = None + g.db.commit() + + expected_file_path = os.path.join( + self.test_results_dir, 'expected_hash.txt') + with open(expected_file_path, 'wb') as f: + f.write(b'expected data') + + with patch.dict('run.config', {'SAMPLE_REPOSITORY': self.dir_path}): + token = self.get_token( + 'res_user@local.com', 'userpass123', 't4', scopes=['results:read']) + res = self.client.get( + f'/api/v1/runs/{self.test_id}/samples/1/regression-tests/{self.reg_test_id}' + f'/outputs/{self.reg_out_id}/actual', headers={'Authorization': f'Bearer {token}'}) + + self.assertEqual(res.status_code, 303) + redirect_url = res.headers['Location'] + res2 = self.client.get(redirect_url, headers={ + 'Authorization': f'Bearer {token}'}) + self.assertEqual(res2.status_code, 200) + + import base64 + self.assertEqual(res2.json['content'], base64.b64encode( + b'expected data').decode('ascii')) + + def test_get_diff(self): + expected_file_path = os.path.join( + self.test_results_dir, 'expected_hash.txt') + with open(expected_file_path, 'wb') as f: + f.write(b'line1\nline2\n') + + actual_file_path = os.path.join( + self.test_results_dir, 'actual_hash.txt') + with open(actual_file_path, 'wb') as f: + f.write(b'line1\nline_new\n') + + with patch.dict('run.config', {'SAMPLE_REPOSITORY': self.dir_path}): + token = self.get_token( + 'res_user@local.com', 'userpass123', 't5', scopes=['results:read']) + res = self.client.get( + f'/api/v1/runs/{self.test_id}/samples/1/regression-tests/{self.reg_test_id}' + f'/outputs/{self.reg_out_id}/diff', headers={'Authorization': f'Bearer {token}'}) + + self.assertEqual(res.status_code, 200) + self.assertEqual(res.json['status'], 'different') + self.assertEqual(res.json['summary']['added_lines'], 1) + + def test_get_diff_unified_format(self): + expected_file_path = os.path.join( + self.test_results_dir, 'expected_hash.txt') + with open(expected_file_path, 'wb') as f: + f.write(b'line1\nline2\n') + + actual_file_path = os.path.join( + self.test_results_dir, 'actual_hash.txt') + with open(actual_file_path, 'wb') as f: + f.write(b'line1\nline_new\n') + + with patch.dict('run.config', {'SAMPLE_REPOSITORY': self.dir_path}): + token = self.get_token( + 'res_user@local.com', 'userpass123', 't5_uni', scopes=['results:read']) + res = self.client.get( + f'/api/v1/runs/{self.test_id}/samples/1/regression-tests/{self.reg_test_id}' + f'/outputs/{self.reg_out_id}/diff?format=unified', headers={'Authorization': f'Bearer {token}'}) + + self.assertEqual(res.status_code, 200) + self.assertEqual(res.json['format'], 'unified') + self.assertIn('content', res.json) + self.assertIsInstance(res.json['content'], str) + + def test_get_diff_identical_files(self): + # When got is None, diff returns status 'identical' + self.result_file.got = None + g.db.commit() + + expected_file_path = os.path.join( + self.test_results_dir, 'expected_hash.txt') + with open(expected_file_path, 'wb') as f: + f.write(b'expected data\n') + + with patch.dict('run.config', {'SAMPLE_REPOSITORY': self.dir_path}): + token = self.get_token( + 'res_user@local.com', 'userpass123', 't5_id', scopes=['results:read']) + res = self.client.get( + f'/api/v1/runs/{self.test_id}/samples/1/regression-tests/{self.reg_test_id}' + f'/outputs/{self.reg_out_id}/diff', headers={'Authorization': f'Bearer {token}'}) + + self.assertEqual(res.status_code, 200) + self.assertEqual(res.json['status'], 'identical') + + def test_create_baseline_approval(self): + token = self.get_token('res_admin@local.com', + 'adminpass123', 't6', scopes=['baselines:write']) + payload = { + 'regression_id': self.reg_test_id, + 'output_id': self.reg_out_id, + 'remove_variants': False + } + res = self.client.post(f'/api/v1/runs/{self.test_id}/samples/1/baseline-approval', data=json.dumps( + payload), content_type='application/json', headers={'Authorization': f'Bearer {token}'}) + + self.assertEqual(res.status_code, 200) + self.assertEqual(res.json['status'], 'approved') + + # Verify db change + reg_out_after = RegressionTestOutput.query.get(self.reg_out_id) + self.assertEqual(reg_out_after.correct, 'actual_hash') + + def test_create_baseline_approval_forbidden_role(self): + # Create token directly in DB to bypass token creation limitations + from mod_api.models.api_token import ApiToken + plaintext = ApiToken.generate_token() + token = ApiToken( + user_id=self.user.id, # res_user has user role + token_name='t7_forbidden', + token_hash=ApiToken.hash_token(plaintext), + token_prefix=ApiToken.extract_prefix(plaintext), + scopes=['baselines:write'], + expires_in_days=7 + ) + g.db.add(token) + g.db.commit() + + payload = { + 'regression_id': self.reg_test_id, + 'output_id': self.reg_out_id + } + res = self.client.post(f'/api/v1/runs/{self.test_id}/samples/1/baseline-approval', data=json.dumps( + payload), content_type='application/json', headers={'Authorization': f'Bearer {plaintext}'}) + + self.assertEqual(res.status_code, 403) + self.assertEqual(res.json['code'], 'forbidden') + + def test_create_baseline_approval_remove_variants(self): + token = self.get_token('res_admin@local.com', + 'adminpass123', 't8', scopes=['baselines:write']) + payload = { + 'regression_id': self.reg_test_id, + 'output_id': self.reg_out_id, + 'remove_variants': True + } + res = self.client.post(f'/api/v1/runs/{self.test_id}/samples/1/baseline-approval', data=json.dumps( + payload), content_type='application/json', headers={'Authorization': f'Bearer {token}'}) + + self.assertEqual(res.status_code, 200) + self.assertEqual(res.json['status'], 'approved') + + # Verify db change + from mod_regression.models import RegressionTestOutputFiles + variants = RegressionTestOutputFiles.query.filter_by( + regression_test_output_id=self.reg_out_id).count() + self.assertEqual(variants, 0) + + def test_get_actual_output_missing_storage(self): + # We don't write the file 'actual_hash.txt', so it will not be found on the filesystem + with patch.dict('run.config', {'SAMPLE_REPOSITORY': self.dir_path}): + token = self.get_token( + 'res_user@local.com', 'userpass123', 't9', scopes=['results:read']) + res = self.client.get( + f'/api/v1/runs/{self.test_id}/samples/1/regression-tests/{self.reg_test_id}' + f'/outputs/{self.reg_out_id}/actual', headers={'Authorization': f'Bearer {token}'}) + + self.assertEqual(res.status_code, 404) + self.assertIn('not found', res.json['message'].lower()) + + def test_get_output_nonexistent_resource_404(self): + token = self.get_token('res_user@local.com', + 'userpass123', 't10', scopes=['results:read']) + res = self.client.get( + f'/api/v1/runs/{self.test_id}/samples/1/regression-tests/999999' + f'/outputs/{self.reg_out_id}/expected', headers={'Authorization': f'Bearer {token}'}) + self.assertEqual(res.status_code, 404) + self.assertEqual(res.json['code'], 'not_found') diff --git a/tests/api/test_routes_runs.py b/tests/api/test_routes_runs.py new file mode 100644 index 000000000..67282f0d8 --- /dev/null +++ b/tests/api/test_routes_runs.py @@ -0,0 +1,344 @@ +import datetime +import json +from unittest.mock import patch + +from flask import g + +from mod_api.middleware.rate_limit import _rate_limit_store +from mod_auth.models import Role, User +from mod_test.models import (Fork, Test, TestPlatform, TestProgress, + TestResult, TestResultFile, TestStatus, TestType) +from tests.base import BaseTestCase + + +class TestRoutesRuns(BaseTestCase): + def setUp(self): + super().setUp() + self.admin = User('testadmin_runs', Role.admin, + 'runs_admin@local.com', User.generate_hash('adminpass123')) + self.user = User('testuser_runs', Role.user, + 'runs_user@local.com', User.generate_hash('userpass123')) + g.db.add_all([self.admin, self.user]) + g.db.commit() + + self.fork = Fork('https://github.com/test/test.git') + g.db.add(self.fork) + g.db.commit() + + self.test_obj = Test(TestPlatform.linux, TestType.commit, + self.fork.id, 'master', 'commit_hash') + g.db.add(self.test_obj) + g.db.commit() + self.test_id = self.test_obj.id + + self.progress = TestProgress( + self.test_id, TestStatus.preparation, "Queued") + g.db.add(self.progress) + g.db.commit() + patcher = patch.dict( + 'mod_api.middleware.rate_limit._rate_limit_store', {}, clear=True) + patcher.start() + self.addCleanup(patcher.stop) + + def get_token(self, email, password, token_name='test_token', scopes=None): + payload = {'email': email, 'password': password, + 'token_name': token_name} + if scopes: + payload['scopes'] = scopes + res = self.client.post( + '/api/v1/auth/tokens', data=json.dumps(payload), content_type='application/json') + return res.json['token'] + + def test_list_runs(self): + token = self.get_token('runs_user@local.com', + 'userpass123', 't1', scopes=['runs:read']) + res = self.client.get( + '/api/v1/runs', headers={'Authorization': f'Bearer {token}'}) + self.assertEqual(res.status_code, 200) + self.assertEqual(len(res.json['data']), 3) + self.assertTrue( + any(r['run_id'] == self.test_id for r in res.json['data'])) + + def test_list_runs_filters(self): + token = self.get_token('runs_user@local.com', + 'userpass123', 't2', scopes=['runs:read']) + # Invalid platform + res = self.client.get('/api/v1/runs?platform=invalid', + headers={'Authorization': f'Bearer {token}'}) + self.assertEqual(res.status_code, 400) + + # Valid platform + res = self.client.get('/api/v1/runs?platform=linux', + headers={'Authorization': f'Bearer {token}'}) + self.assertEqual(res.status_code, 200) + self.assertEqual(len(res.json['data']), 3) + + # Invalid repository + res = self.client.get('/api/v1/runs?repository=invalid_repo', + headers={'Authorization': f'Bearer {token}'}) + self.assertEqual(res.status_code, 400) + + def test_list_runs_status_filter(self): + # We already have a TestProgress 'preparation' from setUp. + # Add a 'testing' one to make the run have 'running' / 'testing' status? + # Wait, the frontend query asks for 'testing'. The API uses 'running' or 'testing' in some places. + # Let's insert a TestStatus.testing progress to make the derive_run_status be 'running' + prog2 = TestProgress(self.test_id, TestStatus.testing, "Testing") + g.db.add(prog2) + g.db.commit() + + token = self.get_token('runs_user@local.com', + 'userpass123', 't3', scopes=['runs:read']) + res = self.client.get('/api/v1/runs?status=running', + headers={'Authorization': f'Bearer {token}'}) + self.assertEqual(res.status_code, 200) + self.assertEqual(len(res.json['data']), 1) + + @patch('run.config') + def test_create_run(self, mock_config): + mock_config.get.side_effect = lambda k, d='': 'testowner' if k == 'GITHUB_OWNER' else 'testrepo' + + token = self.get_token('runs_admin@local.com', + 'adminpass123', 't4', scopes=['runs:write']) + payload = { + 'commit_sha': 'a' * 40, + 'platform': 'windows', + 'repository': 'testowner/testrepo', + 'regression_test_ids': [] + } + res = self.client.post('/api/v1/runs', data=json.dumps(payload), + content_type='application/json', headers={'Authorization': f'Bearer {token}'}) + # Empty regression_test_ids gives 400 validation error + self.assertEqual(res.status_code, 400) + + # Test omitting regression_test_ids completely (it fetches active) + payload.pop('regression_test_ids') + res = self.client.post('/api/v1/runs', data=json.dumps(payload), + content_type='application/json', headers={'Authorization': f'Bearer {token}'}) + self.assertEqual(res.status_code, 202) + self.assertIn('run_id', res.json) + + def test_get_run(self): + token = self.get_token('runs_user@local.com', + 'userpass123', 't5', scopes=['runs:read']) + res = self.client.get( + f'/api/v1/runs/{self.test_id}', headers={'Authorization': f'Bearer {token}'}) + self.assertEqual(res.status_code, 200) + self.assertEqual(res.json['run_id'], self.test_id) + + def test_get_run_summary(self): + token = self.get_token('runs_user@local.com', + 'userpass123', 't6', scopes=['runs:read']) + res = self.client.get( + f'/api/v1/runs/{self.test_id}/summary', headers={'Authorization': f'Bearer {token}'}) + self.assertEqual(res.status_code, 200) + self.assertEqual(res.json['run_id'], self.test_id) + self.assertIn('total_samples', res.json) + + def test_get_run_progress(self): + token = self.get_token('runs_user@local.com', + 'userpass123', 't7', scopes=['runs:read']) + res = self.client.get( + f'/api/v1/runs/{self.test_id}/progress', headers={'Authorization': f'Bearer {token}'}) + self.assertEqual(res.status_code, 200) + self.assertEqual(len(res.json['data']), 1) + self.assertEqual(res.json['data'][0]['status'], 'preparation') + + def test_get_run_config(self): + token = self.get_token('runs_user@local.com', + 'userpass123', 't8', scopes=['runs:read']) + res = self.client.get( + f'/api/v1/runs/{self.test_id}/config', headers={'Authorization': f'Bearer {token}'}) + self.assertEqual(res.status_code, 200) + self.assertEqual(res.json['platform'], 'linux') + + def test_cancel_run(self): + token = self.get_token('runs_admin@local.com', + 'adminpass123', 't9', scopes=['runs:write']) + res = self.client.post( + f'/api/v1/runs/{self.test_id}/cancel', headers={'Authorization': f'Bearer {token}'}) + self.assertEqual(res.status_code, 202) + self.assertEqual(res.json['status'], 'accepted') + + # Verify db change + progs = TestProgress.query.filter_by(test_id=self.test_id).all() + self.assertEqual(progs[-1].status, TestStatus.canceled) + + def test_cancel_run_idempotency(self): + token = self.get_token('runs_admin@local.com', + 'adminpass123', 't10', scopes=['runs:write']) + # First cancel + res = self.client.post( + f'/api/v1/runs/{self.test_id}/cancel', headers={'Authorization': f'Bearer {token}'}) + self.assertEqual(res.status_code, 202) + + # Second cancel should still be 202 + res2 = self.client.post( + f'/api/v1/runs/{self.test_id}/cancel', headers={'Authorization': f'Bearer {token}'}) + self.assertEqual(res2.status_code, 202) + self.assertEqual(res2.json['status'], 'no_op') + + @patch('run.config') + def test_create_run_inactive_regression_test(self, mock_config): + mock_config.get.side_effect = lambda k, d='': 'testowner' if k == 'GITHUB_OWNER' else 'testrepo' + + # Make a regression test inactive + from mod_regression.models import (Category, InputType, OutputType, + RegressionTest) + cat = Category('testcat', 'desc') + g.db.add(cat) + g.db.commit() + reg_test = RegressionTest( + 1, 'command', InputType.file, OutputType.file, cat.id, 0) + reg_test.active = False + g.db.add(reg_test) + g.db.flush() + reg_test_id = reg_test.id + g.db.commit() + + token = self.get_token('runs_admin@local.com', + 'adminpass123', 't11', scopes=['runs:write']) + payload = { + 'commit_sha': 'a' * 40, + 'platform': 'windows', + 'repository': 'testowner/testrepo', + 'regression_test_ids': [reg_test_id] + } + res = self.client.post('/api/v1/runs', data=json.dumps(payload), + content_type='application/json', headers={'Authorization': f'Bearer {token}'}) + self.assertEqual(res.status_code, 422) + self.assertIn('inactive', res.json['message']) + + def test_create_run_fork_repo_any_authenticated_user(self): + # Set github_login so user is owner of the fork repository + self.user.github_login = 'userfork' + g.db.add(self.user) + g.db.commit() + + # Trigger run on a fork repo using contributor user + token = self.get_token('runs_user@local.com', + 'userpass123', 't12', scopes=['runs:write']) + payload = { + 'commit_sha': 'b' * 40, + 'platform': 'windows', + 'repository': 'userfork/testrepo' + } + res = self.client.post('/api/v1/runs', data=json.dumps(payload), + content_type='application/json', headers={'Authorization': f'Bearer {token}'}) + self.assertEqual(res.status_code, 202) + + def test_run_summary_fail_count_ignores_test_failed_flag(self): + # set up test result with exit code mismatch (which counts as fail) + tr = TestResult(self.test_id, 1, 100, 1, 0) + g.db.add(tr) + g.db.commit() + + token = self.get_token('runs_user@local.com', + 'userpass123', 't13', scopes=['runs:read']) + res = self.client.get( + f'/api/v1/runs/{self.test_id}/summary', headers={'Authorization': f'Bearer {token}'}) + self.assertEqual(res.status_code, 200) + self.assertEqual(res.json['fail_count'], 1) + self.assertEqual(res.json['pass_count'], 0) + + def test_missing_output_not_double_counted_in_fail(self): + # Insert a dummy RegressionTestOutput with id = -1 to satisfy foreign key constraints + from mod_regression.models import RegressionTestOutput + dummy_out = RegressionTestOutput(1, '', '', '') + dummy_out.id = -1 + g.db.add(dummy_out) + g.db.commit() + + # exit code mismatch (would be fail) + tr = TestResult(self.test_id, 1, 100, 1, 0) + # but dummy row takes priority -> missing_output + rf = TestResultFile(self.test_id, 1, -1, '', 'error') + g.db.add_all([tr, rf]) + g.db.commit() + + token = self.get_token('runs_user@local.com', + 'userpass123', 't14', scopes=['runs:read']) + res = self.client.get( + f'/api/v1/runs/{self.test_id}/summary', headers={'Authorization': f'Bearer {token}'}) + self.assertEqual(res.status_code, 200) + self.assertEqual(res.json['missing_output_count'], 1) + self.assertEqual(res.json['fail_count'], 0) + + def test_cancel_run_reason_too_short(self): + token = self.get_token('runs_admin@local.com', + 'adminpass123', 't15', scopes=['runs:write']) + res = self.client.post(f'/api/v1/runs/{self.test_id}/cancel', data=json.dumps( + {'reason': 'no'}), content_type='application/json', headers={'Authorization': f'Bearer {token}'}) + self.assertEqual(res.status_code, 400) + self.assertEqual(res.json['code'], 'validation_error') + + def test_rate_limit_headers_present_on_authenticated_endpoints(self): + token = self.get_token('runs_user@local.com', + 'userpass123', 't16', scopes=['runs:read']) + res = self.client.get( + '/api/v1/runs', headers={'Authorization': f'Bearer {token}'}) + self.assertEqual(res.status_code, 200) + self.assertIn('X-RateLimit-Limit', res.headers) + self.assertIn('X-RateLimit-Remaining', res.headers) + + def test_create_run_rejects_extra_fields(self): + token = self.get_token('runs_admin@local.com', + 'adminpass123', 't17', scopes=['runs:write']) + payload = { + 'commit_sha': 'a' * 40, + 'platform': 'linux', + 'repository': 'testowner/testrepo', + 'unexpected_field': 'evil_val' + } + res = self.client.post('/api/v1/runs', data=json.dumps(payload), + content_type='application/json', headers={'Authorization': f'Bearer {token}'}) + self.assertEqual(res.status_code, 400) + self.assertEqual(res.json['code'], 'validation_error') + + def test_create_run_invalid_commit_sha_rejected(self): + token = self.get_token('runs_admin@local.com', + 'adminpass123', 't18', scopes=['runs:write']) + payload = { + 'commit_sha': 'shortsha', + 'platform': 'linux', + 'repository': 'testowner/testrepo' + } + res = self.client.post('/api/v1/runs', data=json.dumps(payload), + content_type='application/json', headers={'Authorization': f'Bearer {token}'}) + self.assertEqual(res.status_code, 400) + self.assertEqual(res.json['code'], 'validation_error') + + def test_get_run_nonexistent_resource_404(self): + token = self.get_token('runs_user@local.com', + 'userpass123', 't19', scopes=['runs:read']) + res = self.client.get('/api/v1/runs/999999', + headers={'Authorization': f'Bearer {token}'}) + self.assertEqual(res.status_code, 404) + self.assertEqual(res.json['code'], 'not_found') + + def test_create_run_non_admin_forbidden(self): + token = self.get_token( + 'runs_user@local.com', 'userpass123', 't_non_admin', scopes=['runs:write']) + payload = { + 'commit_sha': 'a' * 40, + 'platform': 'windows', + 'repository': 'testowner/testrepo' + } + res = self.client.post('/api/v1/runs', data=json.dumps(payload), + content_type='application/json', headers={'Authorization': f'Bearer {token}'}) + self.assertEqual(res.status_code, 403) + + def test_list_runs_pagination(self): + token = self.get_token('runs_user@local.com', + 'userpass123', 't_pag', scopes=['runs:read']) + # Fetch first page with limit=2 + res1 = self.client.get('/api/v1/runs?limit=2', + headers={'Authorization': f'Bearer {token}'}) + self.assertEqual(res1.status_code, 200) + self.assertEqual(len(res1.json['data']), 2) + + # Fetch second page with offset=2 + res2 = self.client.get( + '/api/v1/runs?limit=2&offset=2', headers={'Authorization': f'Bearer {token}'}) + self.assertEqual(res2.status_code, 200) + self.assertEqual(len(res2.json['data']), 1) diff --git a/tests/api/test_routes_samples.py b/tests/api/test_routes_samples.py new file mode 100644 index 000000000..eae567505 --- /dev/null +++ b/tests/api/test_routes_samples.py @@ -0,0 +1,196 @@ +import datetime +import json +from unittest.mock import patch + +from flask import g + +from mod_api.middleware.rate_limit import _rate_limit_store +from mod_auth.models import Role, User +from mod_regression.models import (Category, InputType, OutputType, + RegressionTest, RegressionTestOutput) +from mod_sample.models import Sample +from mod_test.models import (Fork, Test, TestPlatform, TestResult, + TestResultFile, TestType) +from tests.base import BaseTestCase + + +class TestRoutesSamples(BaseTestCase): + def setUp(self): + super().setUp() + self.admin = User('testadmin_samp', Role.admin, + 'samp_admin@local.com', User.generate_hash('adminpass123')) + self.user = User('testuser_samp', Role.user, + 'samp_user@local.com', User.generate_hash('userpass123')) + g.db.add_all([self.admin, self.user]) + g.db.commit() + + self.fork = Fork('https://github.com/test/test.git') + g.db.add(self.fork) + g.db.commit() + + self.test_obj = Test(TestPlatform.linux, TestType.commit, + self.fork.id, 'master', 'commit_hash') + g.db.add(self.test_obj) + g.db.commit() + self.test_id = self.test_obj.id + + self.sample = Sample('test_sha', 'txt', 'test_sample') + g.db.add(self.sample) + g.db.commit() + self.sample_id = self.sample.id + + self.category = Category('Test Category', 'Description') + g.db.add(self.category) + g.db.commit() + + self.reg_test = RegressionTest( + self.sample_id, 'command', InputType.file, OutputType.file, self.category.id, 0) + g.db.add(self.reg_test) + g.db.commit() + self.reg_test_id = self.reg_test.id + + self.reg_out = RegressionTestOutput( + self.reg_test_id, 'expected_hash', '.txt', 'exp') + g.db.add(self.reg_out) + g.db.commit() + self.reg_out_id = self.reg_out.id + + self.test_result = TestResult(self.test_id, self.reg_test_id, 0, 0, 0) + g.db.add(self.test_result) + g.db.commit() + + self.result_file = TestResultFile( + self.test_id, self.reg_test_id, self.reg_out_id, 'expected_hash', None) + g.db.add(self.result_file) + g.db.commit() + + _rate_limit_store.clear() + + def get_token(self, email, password, token_name='test_token', scopes=None): + payload = {'email': email, 'password': password, + 'token_name': token_name} + if scopes: + payload['scopes'] = scopes + res = self.client.post( + '/api/v1/auth/tokens', data=json.dumps(payload), content_type='application/json') + return res.json['token'] + + def test_list_run_samples(self): + token = self.get_token('samp_user@local.com', + 'userpass123', 't1', scopes=['runs:read']) + res = self.client.get( + f'/api/v1/runs/{self.test_id}/samples', headers={'Authorization': f'Bearer {token}'}) + self.assertEqual(res.status_code, 200) + self.assertEqual(len(res.json['data']), 1) + self.assertEqual(res.json['data'][0] + ['regression_test_id'], self.reg_test_id) + + def test_get_run_sample(self): + token = self.get_token('samp_user@local.com', + 'userpass123', 't2', scopes=['runs:read']) + res = self.client.get( + f'/api/v1/runs/{self.test_id}/samples/{self.reg_test_id}', headers={'Authorization': f'Bearer {token}'}) + self.assertEqual(res.status_code, 200) + self.assertEqual(res.json['regression_test_id'], self.reg_test_id) + + def test_list_samples(self): + token = self.get_token('samp_user@local.com', + 'userpass123', 't3', scopes=['runs:read']) + res = self.client.get( + '/api/v1/samples', headers={'Authorization': f'Bearer {token}'}) + self.assertEqual(res.status_code, 200) + self.assertEqual(len(res.json['data']), 3) + self.assertTrue( + any(s['sample_id'] == self.sample_id for s in res.json['data'])) + + def test_get_sample(self): + token = self.get_token('samp_user@local.com', + 'userpass123', 't4', scopes=['runs:read']) + res = self.client.get( + f'/api/v1/samples/{self.sample_id}', headers={'Authorization': f'Bearer {token}'}) + self.assertEqual(res.status_code, 200) + self.assertEqual(res.json['sample_id'], self.sample_id) + + def test_get_sample_history(self): + token = self.get_token('samp_user@local.com', + 'userpass123', 't5', scopes=['runs:read']) + res = self.client.get( + f'/api/v1/samples/{self.sample_id}/history', headers={'Authorization': f'Bearer {token}'}) + self.assertEqual(res.status_code, 200) + self.assertEqual(len(res.json['data']), 1) + self.assertTrue( + any(h['run_id'] == self.test_id for h in res.json['data'])) + + def test_list_regression_tests(self): + token = self.get_token('samp_user@local.com', + 'userpass123', 't6', scopes=['runs:read']) + res = self.client.get('/api/v1/regression-tests', + headers={'Authorization': f'Bearer {token}'}) + self.assertEqual(res.status_code, 200) + self.assertEqual(len(res.json['data']), 3) + self.assertTrue(any(rt['regression_test_id'] == self.reg_test_id + for rt in res.json['data'])) + + def test_list_regression_tests_active_filter(self): + # Create an inactive regression test + rt_inactive = RegressionTest( + self.sample_id, 'cmd_inactive', InputType.file, OutputType.file, self.category.id, 0) + rt_inactive.active = False + g.db.add(rt_inactive) + g.db.commit() + rt_inactive_id = rt_inactive.id + + token = self.get_token( + 'samp_user@local.com', 'userpass123', 't_active_filter', scopes=['runs:read']) + + # Default active=true + res = self.client.get('/api/v1/regression-tests', + headers={'Authorization': f'Bearer {token}'}) + self.assertEqual(res.status_code, 200) + self.assertTrue(any(rt['regression_test_id'] == self.reg_test_id + for rt in res.json['data'])) + self.assertFalse(any(rt['regression_test_id'] == rt_inactive_id + for rt in res.json['data'])) + + res_false = self.client.get( + '/api/v1/regression-tests?active=false', headers={'Authorization': f'Bearer {token}'}) + self.assertEqual(res_false.status_code, 200) + self.assertFalse(any(rt['regression_test_id'] == self.reg_test_id + for rt in res_false.json['data'])) + self.assertTrue(any(rt['regression_test_id'] == rt_inactive_id + for rt in res_false.json['data'])) + + def test_baseline_verification_success(self): + # We must set got to a non-None value so that we can approve it + self.result_file.got = 'new_hash' + g.db.commit() + + token = self.get_token( + 'samp_admin@local.com', 'adminpass123', 't_base1', scopes=['baselines:write']) + payload = { + 'regression_id': self.reg_test_id, + 'output_id': self.reg_out_id, + 'remove_variants': False + } + res = self.client.post(f'/api/v1/runs/{self.test_id}/samples/{self.sample_id}/baseline-approval', + data=json.dumps(payload), + content_type='application/json', + headers={'Authorization': f'Bearer {token}'}) + # Wait, what does it return? 200 OK. + self.assertEqual(res.status_code, 200) + self.assertEqual(res.json['status'], 'approved') + + def test_baseline_verification_rejected(self): + # Without setting got (so got is None), it should return 422 + token = self.get_token( + 'samp_admin@local.com', 'adminpass123', 't_base2', scopes=['baselines:write']) + payload = { + 'regression_id': self.reg_test_id, + 'output_id': self.reg_out_id + } + res = self.client.post(f'/api/v1/runs/{self.test_id}/samples/{self.sample_id}/baseline-approval', + data=json.dumps(payload), + content_type='application/json', + headers={'Authorization': f'Bearer {token}'}) + self.assertEqual(res.status_code, 422) + self.assertIn('matches expected', res.json['message']) diff --git a/tests/api/test_routes_system.py b/tests/api/test_routes_system.py new file mode 100644 index 000000000..9e9b9644e --- /dev/null +++ b/tests/api/test_routes_system.py @@ -0,0 +1,172 @@ +import json +import os +import tempfile +from unittest.mock import MagicMock, patch + +from flask import g + +from mod_api.middleware.rate_limit import _rate_limit_store +from mod_api.models.api_token import ApiToken +from mod_auth.models import Role, User +from mod_regression.models import RegressionTestOutput +from mod_test.models import (Fork, Test, TestPlatform, TestProgress, + TestResultFile, TestStatus, TestType) +from tests.base import BaseTestCase + + +class TestRoutesSystem(BaseTestCase): + def setUp(self): + super().setUp() + self.test_dir = tempfile.TemporaryDirectory() + self.dir_path = self.test_dir.name + + # Create users + admin2 = User('admin2', Role.admin, 'admin2@local.com', + User.generate_hash('adminpass123')) + user2 = User('user2', Role.user, 'user2@local.com', + User.generate_hash('userpass123')) + g.db.add_all([admin2, user2]) + g.db.commit() + + # Create a test run + fork = Fork('https://github.com/test/test.git') + g.db.add(fork) + g.db.commit() + + self.test_obj = Test(TestPlatform.linux, + TestType.commit, fork.id, 'master', 'commit_hash') + g.db.add(self.test_obj) + g.db.commit() + self.test_id = self.test_obj.id + + _rate_limit_store.clear() + + def tearDown(self): + self.test_dir.cleanup() + super().tearDown() + + def get_token(self, email, password, scopes=None): + payload = { + 'email': email, + 'password': password, + 'token_name': 'test_token_' + self.create_random_string(8) + } + if scopes: + payload['scopes'] = scopes + + res = self.client.post( + '/api/v1/auth/tokens', data=json.dumps(payload), content_type='application/json') + if res.status_code != 201: + raise RuntimeError( + f"Failed to get token: {res.status_code} - {res.json}") + return res.json['token'] + + def test_health_check_unauthenticated(self): + res = self.client.get('/api/v1/system/health') + self.assertEqual(res.status_code, 200) + self.assertIn(res.json['status'], ['ok', 'degraded']) + self.assertIn('dependencies', res.json) + self.assertIn('X-RateLimit-Limit', res.headers) + self.assertIn('X-RateLimit-Remaining', res.headers) + self.assertIn('X-RateLimit-Reset', res.headers) + + def test_system_queue_requires_scope(self): + token = self.get_token('user2@local.com', 'userpass123', ['runs:read']) + res = self.client.get('/api/v1/system/queue', + headers={'Authorization': f'Bearer {token}'}) + # Forbidden due to missing scope + self.assertEqual(res.status_code, 403) + + def test_system_queue_with_scope(self): + # A test with no progress is "queued" + token = self.get_token( + 'user2@local.com', 'userpass123', ['system:read']) + res = self.client.get('/api/v1/system/queue', + headers={'Authorization': f'Bearer {token}'}) + self.assertEqual(res.status_code, 200) + self.assertIn('data', res.json) + self.assertEqual(res.json['queue_depth'], 1) + self.assertEqual(res.json['running_count'], 0) + self.assertEqual(res.json['data'][0]['run_id'], self.test_id) + self.assertEqual(res.json['data'][0]['status'], 'queued') + + def test_system_queue_platform_filter(self): + token = self.get_token( + 'user2@local.com', 'userpass123', ['system:read']) + res = self.client.get('/api/v1/system/queue?platform=windows', + headers={'Authorization': f'Bearer {token}'}) + self.assertEqual(res.status_code, 200) + self.assertEqual(res.json['queue_depth'], 0) + + @patch('run.storage_client_bucket') + def test_list_artifacts(self, mock_bucket): + # Setup mock behavior for GCS + mock_blob = MagicMock() + mock_blob.exists.return_value = True + mock_blob.generate_signed_url.return_value = 'https://signed.url' + mock_bucket.blob.return_value = mock_blob + + # Create real files + os.makedirs(os.path.join(self.dir_path, 'LogFiles'), exist_ok=True) + log_path = os.path.join( + self.dir_path, 'LogFiles', f'{self.test_id}.txt') + with open(log_path, 'w') as f: + f.write('log content') + + os.makedirs(os.path.join(self.dir_path, 'TestResults'), exist_ok=True) + with open(os.path.join(self.dir_path, 'TestResults', 'got.srt'), 'w') as f: + f.write('actual content') + + # Add test result files + rf = TestResultFile(self.test_id, 1, 1, 'expected', 'got') + rto = RegressionTestOutput(1, 1, 'expected', 'out.txt') + rf.regression_test_output = rto + g.db.add(rf) + g.db.commit() + + # Create local file for actual to pass isfile check (already done above) + + original_sample_repo = self.app.config.get('SAMPLE_REPOSITORY') + self.app.config['SAMPLE_REPOSITORY'] = self.dir_path + try: + token = self.get_token( + 'user2@local.com', 'userpass123', ['results:read']) + res = self.client.get( + f'/api/v1/runs/{self.test_id}/artifacts', headers={'Authorization': f'Bearer {token}'}) + self.assertEqual(res.status_code, 200) + finally: + if original_sample_repo is not None: + self.app.config['SAMPLE_REPOSITORY'] = original_sample_repo + else: + del self.app.config['SAMPLE_REPOSITORY'] + + items = res.json['data'] + # We expect: binary, build_log, expected_output, sample_output + self.assertTrue(len(items) >= 4) + + types = [item['type'] for item in items] + self.assertIn('binary', types) + self.assertIn('build_log', types) + self.assertIn('expected_output', types) + self.assertIn('sample_output', types) + + def test_list_artifacts_not_found(self): + token = self.get_token( + 'user2@local.com', 'userpass123', ['results:read']) + res = self.client.get('/api/v1/runs/9999/artifacts', + headers={'Authorization': f'Bearer {token}'}) + self.assertEqual(res.status_code, 404) + + def test_list_artifacts_missing_storage(self): + # When files do not exist, verify storage_status='missing' and download_url=None + token = self.get_token( + 'user2@local.com', 'userpass123', ['results:read']) + res = self.client.get( + f'/api/v1/runs/{self.test_id}/artifacts', headers={'Authorization': f'Bearer {token}'}) + self.assertEqual(res.status_code, 200) + + # Verify the build log artifact has storage_status 'missing' since we didn't create the log file + build_log = next( + a for a in res.json['data'] if a['type'] == 'build_log') + self.assertEqual(build_log['storage_status'], 'missing') + self.assertIsNone(build_log['download_url']) diff --git a/tests/api/test_services_diff_service.py b/tests/api/test_services_diff_service.py new file mode 100644 index 000000000..11ee82826 --- /dev/null +++ b/tests/api/test_services_diff_service.py @@ -0,0 +1,126 @@ +import os +import tempfile + +from mod_api.services.diff_service import (_compute_hunks, compute_diff, + file_sha256, read_lines) +from tests.base import BaseTestCase + + +class TestDiffService(BaseTestCase): + def setUp(self): + super().setUp() + self.test_dir = tempfile.TemporaryDirectory() + self.dir_path = self.test_dir.name + from unittest.mock import patch + patcher = patch( + 'mod_api.services.diff_service._enforce_safe_path', return_value=True) + self.addCleanup(patcher.stop) + self.mock_safe = patcher.start() + + def tearDown(self): + self.test_dir.cleanup() + super().tearDown() + + def create_file(self, filename, content, encoding='utf-8'): + path = os.path.join(self.dir_path, filename) + with open(path, 'w', encoding=encoding) as f: + f.write(content) + return path + + def test_compute_diff_identical(self): + content = "line1\nline2\n" + path1 = self.create_file("file1.txt", content) + path2 = self.create_file("file2.txt", content) + + diff = compute_diff(path1, path2) + self.assertEqual(diff['status'], 'identical') + self.assertEqual(diff['summary']['added_lines'], 0) + self.assertEqual(diff['summary']['removed_lines'], 0) + self.assertEqual(len(diff['hunks']), 0) + + def test_compute_diff_missing_expected(self): + path2 = self.create_file("file2.txt", "content") + + diff = compute_diff(os.path.join(self.dir_path, "missing.txt"), path2) + self.assertEqual(diff['status'], 'missing_expected') + + def test_compute_diff_missing_actual(self): + path1 = self.create_file("file1.txt", "content") + + diff = compute_diff(path1, os.path.join(self.dir_path, "missing.txt")) + self.assertEqual(diff['status'], 'missing_actual') + + def test_compute_diff_different(self): + content1 = "line1\nline2\nline3\n" + content2 = "line1\nline_new\nline3\n" + path1 = self.create_file("file1.txt", content1) + path2 = self.create_file("file2.txt", content2) + + diff = compute_diff(path1, path2) + self.assertEqual(diff['status'], 'different') + self.assertEqual(diff['summary']['added_lines'], 1) + self.assertEqual(diff['summary']['removed_lines'], 1) + self.assertEqual(diff['summary']['changed_hunks'], 1) + self.assertEqual(len(diff['hunks']), 1) + + hunk = diff['hunks'][0] + self.assertEqual(hunk['expected_start'], 1) + self.assertEqual(hunk['actual_start'], 1) + + def test_compute_diff_context_lines_clamped(self): + content1 = "\n".join(str(i) for i in range(1, 201)) + "\n" + content2 = content1.replace("\n100\n", "\n100_new\n") + path1 = self.create_file("file1.txt", content1) + path2 = self.create_file("file2.txt", content2) + + diff = compute_diff(path1, path2, context_lines=200) + self.assertEqual(diff['status'], 'different') + hunk = diff['hunks'][0] + # max context is 50 before and 50 after, plus 1 removed and 1 added = 102 lines total + self.assertEqual(len(hunk['lines']), 102) + + def test_compute_hunks_max_hunks(self): + lines1 = ["1", "2", "3", "4", "5"] + lines2 = ["1a", "2", "3a", "4", "5a"] + # With context_lines=0 we should get 3 separate hunks + hunks = _compute_hunks(lines1, lines2, context_lines=0, max_hunks=2) + self.assertEqual(len(hunks), 2) # bounded to 2 + + def test_compute_hunks_parsing(self): + lines1 = ["common", "remove_me", "common"] + lines2 = ["common", "add_me", "common"] + hunks = _compute_hunks(lines1, lines2, context_lines=1, max_hunks=10) + self.assertEqual(len(hunks), 1) + lines = hunks[0]['lines'] + self.assertEqual(lines[0]['kind'], 'context') + self.assertEqual(lines[1]['kind'], 'removed') + self.assertEqual(lines[2]['kind'], 'added') + self.assertEqual(lines[3]['kind'], 'context') + + def test_read_lines_utf8(self): + path = os.path.join(self.dir_path, "utf8.txt") + with open(path, 'w', encoding='utf-8', newline='') as f: + f.write("line1\r\nline2\n") + lines = read_lines(path) + self.assertEqual(lines, ["line1", "line2"]) + + def test_read_lines_cp1252(self): + path = os.path.join(self.dir_path, "cp1252.txt") + # Write bytes that are valid cp1252 but invalid utf-8 + with open(path, 'wb') as f: + # \x80 is euro sign in cp1252, invalid start byte in utf-8 + f.write(b"line1\r\n\x80line2") + + lines = read_lines(path) + # \x80 maps to \u20ac + self.assertEqual(lines, ["line1", "\u20acline2"]) + + def test_file_sha256(self): + path = self.create_file("sha.txt", "hello") + sha = file_sha256(path) + # sha256("hello") = 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824 + self.assertEqual( + sha, "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824") + + self.assertIsNone(file_sha256( + os.path.join(self.dir_path, "nonexistent.txt"))) diff --git a/tests/api/test_services_error_service.py b/tests/api/test_services_error_service.py new file mode 100644 index 000000000..8aea7e22e --- /dev/null +++ b/tests/api/test_services_error_service.py @@ -0,0 +1,173 @@ +import datetime +from unittest.mock import MagicMock, PropertyMock + +from flask import g + +from mod_api.services.error_service import (_classify_infra_error, + _get_sample_id, + derive_error_summary, + derive_errors_for_run, + derive_infrastructure_errors) +from mod_regression.models import (Category, InputType, OutputType, + RegressionTest, RegressionTestOutput) +from mod_test.models import (Fork, Test, TestPlatform, TestProgress, + TestResult, TestResultFile, TestStatus, TestType) +from tests.base import BaseTestCase + + +class TestServicesErrorService(BaseTestCase): + def setUp(self): + super().setUp() + fork = Fork('https://github.com/test/test.git') + g.db.add(fork) + g.db.commit() + self.test_obj = Test(TestPlatform.linux, + TestType.commit, fork.id, 'master', 'commit_hash') + g.db.add(self.test_obj) + g.db.commit() + + self.category = Category('Test Category', 'Description') + g.db.add(self.category) + g.db.commit() + + self.reg_test1 = RegressionTest( + 1, 'cmd1', InputType.file, OutputType.file, self.category.id, 0) + self.reg_test2 = RegressionTest( + 1, 'cmd2', InputType.file, OutputType.file, self.category.id, 0) + g.db.add_all([self.reg_test1, self.reg_test2]) + g.db.commit() + + self.reg_out1 = RegressionTestOutput( + self.reg_test1.id, 'sample1_out', '.txt', 'exp1') + self.reg_out2 = RegressionTestOutput( + self.reg_test2.id, 'sample2_out', '.txt', 'exp2') + g.db.add_all([self.reg_out1, self.reg_out2]) + + dummy_out = RegressionTestOutput( + self.reg_test1.id, 'dummy', '', 'dummy') + dummy_out.id = -1 + g.db.merge(dummy_out) + + g.db.commit() + + def test_derive_errors_for_run_rc_mismatch(self): + tr = TestResult(self.test_obj.id, self.reg_test1.id, + 100, 1, 0) # runtime, exit_code, expected_rc + g.db.add(tr) + g.db.commit() + + errors = derive_errors_for_run(self.test_obj.id) + self.assertEqual(len(errors), 1) + self.assertEqual(errors[0]['type'], 'exit_code_mismatch') + self.assertEqual(errors[0]['severity'], 'error') + + def test_derive_errors_for_run_missing_output(self): + tr = TestResult(self.test_obj.id, self.reg_test1.id, 100, 0, 0) + rf = TestResultFile( + self.test_obj.id, self.reg_test1.id, -1, '', 'error') + g.db.add_all([tr, rf]) + g.db.commit() + + errors = derive_errors_for_run(self.test_obj.id) + self.assertEqual(len(errors), 1) + self.assertEqual(errors[0]['type'], 'missing_output') + + def test_derive_errors_for_run_diff_mismatch(self): + tr = TestResult(self.test_obj.id, self.reg_test1.id, 100, 0, 0) + rf = TestResultFile(self.test_obj.id, self.reg_test1.id, + self.reg_out1.id, 'expected_hash', 'got_hash') + g.db.add_all([tr, rf]) + g.db.commit() + + errors = derive_errors_for_run(self.test_obj.id) + self.assertEqual(len(errors), 1) + self.assertEqual(errors[0]['type'], 'diff_mismatch') + self.assertEqual(errors[0]['severity'], 'warning') + + def test_derive_error_summary(self): + tr1 = TestResult(self.test_obj.id, self.reg_test1.id, + 100, 1, 0) # rc mismatch + tr2 = TestResult(self.test_obj.id, self.reg_test2.id, 100, 0, 0) + rf2 = TestResultFile(self.test_obj.id, self.reg_test2.id, + self.reg_out2.id, 'exp', 'got') # diff mismatch + g.db.add_all([tr1, tr2, rf2]) + g.db.commit() + + summary = derive_error_summary(self.test_obj.id) + self.assertEqual(len(summary), 2) + + # summary is a list of buckets + summary_dict = {b['key']: b for b in summary} + + self.assertEqual(summary_dict['exit_code_mismatch']['count'], 1) + self.assertEqual( + summary_dict['exit_code_mismatch']['severity'], 'error') + + self.assertEqual(summary_dict['diff_mismatch']['count'], 1) + self.assertEqual(summary_dict['diff_mismatch']['severity'], 'warning') + + def test_aggregate_error_severity_escalation(self): + # Create an error with severity 'warning' and another with 'error' in the same bucket + from mod_api.services.error_service import _aggregate_error_into_bucket + bucket = { + 'count': 1, + 'severity': 'warning', + 'sample_ids': [], + 'first_seen_at': None, + 'last_seen_at': None + } + + # New error with higher severity + err_error = {'severity': 'error', 'sample_id': 1} + _aggregate_error_into_bucket(err_error, bucket) + self.assertEqual(bucket['severity'], 'error') + self.assertEqual(bucket['count'], 2) + + # New error with lower severity should not downgrade + err_info = {'severity': 'info', 'sample_id': 2} + _aggregate_error_into_bucket(err_info, bucket) + self.assertEqual(bucket['severity'], 'error') + self.assertEqual(bucket['count'], 3) + + def test_derive_infrastructure_errors(self): + tp1 = TestProgress( + self.test_obj.id, TestStatus.canceled, 'provisioning VM failed') + tp1.timestamp = datetime.datetime(2023, 1, 1, 10, 0, 0) + + tp2 = TestProgress( + self.test_obj.id, TestStatus.canceled, 'merge conflict') + tp2.timestamp = datetime.datetime(2023, 1, 1, 10, 5, 0) + + g.db.add(tp1) + g.db.add(tp2) + g.db.commit() + + errors = derive_infrastructure_errors(self.test_obj.id) + self.assertEqual(len(errors), 2) + self.assertEqual(errors[0]['type'], 'vm_provisioning') + self.assertEqual(errors[1]['type'], 'merge') + + def test_classify_infra_error(self): + self.assertEqual(_classify_infra_error( + 'timeout connecting to worker'), 'worker') + self.assertEqual(_classify_infra_error('failed to build'), 'build') + self.assertEqual(_classify_infra_error('storage is full'), 'storage') + self.assertEqual(_classify_infra_error( + 'fetch remote repository'), 'checkout') + self.assertEqual(_classify_infra_error('merge conflict'), 'merge') + self.assertEqual(_classify_infra_error( + 'random error string'), 'worker') + + def test_get_sample_id(self): + tr = TestResult(self.test_obj.id, 1, 100, 0, 0) + self.assertIsNone(_get_sample_id(tr)) + + tr.regression_test = MagicMock() + tr.regression_test.sample_id = 42 + self.assertEqual(_get_sample_id(tr), 42) + + # Test exception catching + mock_reg = MagicMock() + type(mock_reg).sample_id = PropertyMock(side_effect=RuntimeError('Mock exception')) + tr.regression_test = mock_reg + self.assertIsNone(_get_sample_id(tr)) diff --git a/tests/api/test_services_log_service.py b/tests/api/test_services_log_service.py new file mode 100644 index 000000000..c5bed3fee --- /dev/null +++ b/tests/api/test_services_log_service.py @@ -0,0 +1,124 @@ +import os +import tempfile +from unittest.mock import patch + +from mod_api.services.log_service import (_extract_level, _extract_source, + _matches_level, read_log_lines) +from tests.base import BaseTestCase + + +class TestServicesLogService(BaseTestCase): + def setUp(self): + super().setUp() + self.test_dir = tempfile.TemporaryDirectory() + self.dir_path = self.test_dir.name + + def tearDown(self): + self.test_dir.cleanup() + super().tearDown() + + def create_log_file(self, content, encoding='utf-8'): + path = os.path.join(self.dir_path, "1.txt") + with open(path, 'w', encoding=encoding, newline='') as f: + f.write(content) + return path + + @patch('mod_api.services.log_service.get_log_file_path') + def test_read_log_lines_not_found(self, mock_get_path): + mock_get_path.return_value = None + with self.assertRaises(FileNotFoundError): + read_log_lines(1) + + @patch('mod_api.services.log_service.get_log_file_path') + def test_read_log_lines_basic(self, mock_get_path): + content = "INFO worker: Starting\nDEBUG worker: Doing stuff\nERROR build: Failed\n" + path = self.create_log_file(content) + mock_get_path.return_value = path + + lines, next_cursor = read_log_lines(1) + self.assertEqual(len(lines), 3) + self.assertIsNone(next_cursor) + self.assertEqual(lines[0]['level'], 'info') + self.assertEqual(lines[0]['source'], 'worker') + self.assertEqual(lines[0]['message'], "INFO worker: Starting") + self.assertEqual(lines[2]['level'], 'error') + self.assertEqual(lines[2]['source'], 'build') + + @patch('mod_api.services.log_service.get_log_file_path') + def test_read_log_lines_pagination(self, mock_get_path): + content = "Line 1\nLine 2\nLine 3\nLine 4\n" + path = self.create_log_file(content) + mock_get_path.return_value = path + + lines, next_cursor = read_log_lines(1, limit=2) + self.assertEqual(len(lines), 2) + self.assertEqual(next_cursor, '2') + self.assertEqual(lines[0]['message'], "Line 1") + self.assertEqual(lines[1]['message'], "Line 2") + + lines, next_cursor = read_log_lines(1, cursor=next_cursor, limit=2) + self.assertEqual(len(lines), 2) + self.assertIsNone(next_cursor) + self.assertEqual(lines[0]['message'], "Line 3") + self.assertEqual(lines[1]['message'], "Line 4") + + @patch('mod_api.services.log_service.get_log_file_path') + def test_read_log_lines_limit_clamped(self, mock_get_path): + content = "Line\n" * 1500 + path = self.create_log_file(content) + mock_get_path.return_value = path + + lines, _ = read_log_lines(1, limit=2000) + # Should be clamped to 500 + self.assertEqual(len(lines), 500) + + @patch('mod_api.services.log_service.get_log_file_path') + def test_read_log_lines_filters(self, mock_get_path): + content = "INFO worker: Starting\nDEBUG build: Doing stuff\nERROR build: Failed\n" + path = self.create_log_file(content) + mock_get_path.return_value = path + + # Filter by level + lines, _ = read_log_lines(1, level='error') + self.assertEqual(len(lines), 1) + self.assertEqual(lines[0]['message'], "ERROR build: Failed") + + # Filter by source + lines, _ = read_log_lines(1, source='build') + self.assertEqual(len(lines), 2) + + # Filter by contains + lines, _ = read_log_lines(1, contains='STARTING') + self.assertEqual(len(lines), 1) + + @patch('mod_api.services.log_service.get_log_file_path') + def test_read_log_lines_cp1252(self, mock_get_path): + path = os.path.join(self.dir_path, "1.txt") + with open(path, 'wb') as f: + f.write(b"INFO \x80 error\n") # cp1252 euro sign + mock_get_path.return_value = path + + lines, _ = read_log_lines(1) + self.assertEqual(len(lines), 1) + self.assertIn("\u20ac", lines[0]['message']) + + def test_extract_level(self): + self.assertEqual(_extract_level("A CRITICAL error"), "critical") + self.assertEqual(_extract_level("Some ERROR occurred"), "error") + self.assertEqual(_extract_level("This is a WARNING"), "warning") + self.assertEqual(_extract_level("Just INFO"), "info") + self.assertEqual(_extract_level("DEBUG logging"), "debug") + self.assertEqual(_extract_level("Unknown format"), "info") # default + + def test_extract_source(self): + self.assertEqual(_extract_source( + "orchestrator doing something"), "orchestrator") + self.assertEqual(_extract_source("worker executing"), "worker") + self.assertEqual(_extract_source("build failed"), "build") + self.assertEqual(_extract_source("test_runner passed"), "test_runner") + self.assertEqual(_extract_source("web request"), "web") + self.assertEqual(_extract_source("unknown source"), "web") # default + + def test_matches_level(self): + self.assertTrue(_matches_level("ERROR", "error")) + self.assertFalse(_matches_level("INFO", "error")) diff --git a/tests/api/test_services_status.py b/tests/api/test_services_status.py new file mode 100644 index 000000000..ac9997db0 --- /dev/null +++ b/tests/api/test_services_status.py @@ -0,0 +1,138 @@ +import datetime +from unittest.mock import patch + +from flask import g + +from mod_api.services.status import (derive_output_status, derive_run_status, + derive_sample_status, get_run_timestamps, + is_dummy_row) +from mod_regression.models import RegressionTestOutput +from mod_regression.models import \ + RegressionTestOutputFiles as RegressionTestMultipleFiles +from mod_test.models import (Fork, Test, TestPlatform, TestProgress, + TestResult, TestResultFile, TestStatus, TestType) +from tests.base import BaseTestCase + + +class TestServicesStatus(BaseTestCase): + def setUp(self): + super().setUp() + fork = Fork('https://github.com/test/test.git') + g.db.add(fork) + g.db.commit() + self.test_obj = Test(TestPlatform.linux, + TestType.commit, fork.id, 'master', 'commit_hash') + g.db.add(self.test_obj) + g.db.commit() + + def test_derive_run_status_queued(self): + self.assertEqual(derive_run_status(self.test_obj), 'queued') + + def test_derive_run_status_running(self): + tp = TestProgress(self.test_obj.id, TestStatus.testing, 'testing') + g.db.add(tp) + g.db.commit() + self.assertEqual(derive_run_status(self.test_obj), 'running') + + def test_derive_run_status_pass(self): + tp = TestProgress(self.test_obj.id, TestStatus.completed, 'done') + g.db.add(tp) + g.db.commit() + # No failures = pass + self.assertEqual(derive_run_status(self.test_obj), 'pass') + + def test_derive_run_status_fail(self): + tp = TestProgress(self.test_obj.id, TestStatus.completed, 'done') + # runtime 100, exit_code 1, expected 0 + tr = TestResult(self.test_obj.id, 1, 100, 1, 0) + g.db.add(tp) + g.db.add(tr) + g.db.commit() + self.assertEqual(derive_run_status(self.test_obj), 'fail') + + def test_derive_run_status_canceled_covers_infra_error(self): + tp = TestProgress(self.test_obj.id, + TestStatus.canceled, 'canceled by admin') + g.db.add(tp) + g.db.commit() + self.assertEqual(derive_run_status(self.test_obj), 'canceled') + + def test_derive_run_status_incomplete(self): + from unittest.mock import MagicMock + + from mod_api.services.status import _compute_run_status + mock_prog = MagicMock() + mock_prog.status = "some_unknown_status" + res = _compute_run_status([mock_prog], {}, {}, self.test_obj.id) + self.assertEqual(res, 'incomplete') + + def test_is_dummy_row(self): + rf = TestResultFile(1, 1, -1, '', 'error') + self.assertTrue(is_dummy_row(rf)) + rf2 = TestResultFile(1, 1, 1, 'expected', 'got') + self.assertFalse(is_dummy_row(rf2)) + + def test_derive_sample_status_not_started(self): + self.assertEqual(derive_sample_status(None, []), 'not_started') + + def test_derive_sample_status_missing_output(self): + tr = TestResult(1, 1, 100, 0, 0) + rf = TestResultFile(1, 1, -1, '', 'error') + self.assertEqual(derive_sample_status(tr, [rf]), 'missing_output') + + def test_derive_sample_status_fail_rc(self): + tr = TestResult(1, 1, 100, 1, 0) + self.assertEqual(derive_sample_status(tr, []), 'fail') + + def test_derive_sample_status_fail_diff(self): + tr = TestResult(1, 1, 100, 0, 0) + rf = TestResultFile(1, 1, 1, 'expected_hash', 'got_hash') + self.assertEqual(derive_sample_status(tr, [rf]), 'fail') + + def test_derive_sample_status_pass(self): + tr = TestResult(1, 1, 100, 0, 0) + rf = TestResultFile(1, 1, 1, 'expected_hash', None) + self.assertEqual(derive_sample_status(tr, [rf]), 'pass') + + def test_derive_sample_status_pass_multi(self): + tr = TestResult(1, 1, 100, 0, 0) + rf = TestResultFile(1, 1, 1, 'expected_hash', 'got_hash') + rto = RegressionTestOutput(1, 1, 'expected_hash', 'output.txt') + multi = RegressionTestMultipleFiles('got_hash', 1) + multi.file_hashes = 'got_hash' + rto.multiple_files = [multi] + rf.regression_test_output = rto + self.assertEqual(derive_sample_status(tr, [rf]), 'pass') + + def test_derive_output_status(self): + rf_dummy = TestResultFile(-1, -1, -1, '', 'error') + self.assertEqual(derive_output_status(rf_dummy), 'missing_output') + + rf_match = TestResultFile(1, 1, 1, 'exp', None) + self.assertEqual(derive_output_status(rf_match), 'pass') + + rf_diff = TestResultFile(1, 1, 1, 'exp', 'got') + self.assertEqual(derive_output_status(rf_diff), 'fail') + + def test_get_run_timestamps(self): + ts = get_run_timestamps(self.test_obj) + self.assertIsNone(ts['created_at']) + + tp1 = TestProgress(self.test_obj.id, TestStatus.preparation, 'queued') + tp1.timestamp = datetime.datetime(2023, 1, 1, 10, 0, 0) + g.db.add(tp1) + + tp2 = TestProgress(self.test_obj.id, TestStatus.testing, 'testing') + tp2.timestamp = datetime.datetime(2023, 1, 1, 10, 5, 0) + g.db.add(tp2) + + tp3 = TestProgress(self.test_obj.id, TestStatus.completed, 'done') + tp3.timestamp = datetime.datetime(2023, 1, 1, 10, 10, 0) + g.db.add(tp3) + g.db.commit() + + ts2 = get_run_timestamps(self.test_obj) + self.assertEqual(ts2['created_at'], tp1.timestamp) + self.assertEqual(ts2['queued_at'], tp1.timestamp) + self.assertEqual(ts2['started_at'], tp2.timestamp) + self.assertEqual(ts2['completed_at'], tp3.timestamp) diff --git a/tests/api/test_services_storage.py b/tests/api/test_services_storage.py new file mode 100644 index 000000000..bc9d905e3 --- /dev/null +++ b/tests/api/test_services_storage.py @@ -0,0 +1,130 @@ +import os +import tempfile +from unittest.mock import MagicMock, patch + +from mod_api.services.storage import (get_log_file_path, + get_test_results_base_path, + resolve_artifact) +from tests.base import BaseTestCase + + +class TestServicesStorage(BaseTestCase): + def setUp(self): + super().setUp() + self.test_dir = tempfile.TemporaryDirectory() + self.dir_path = self.test_dir.name + + def tearDown(self): + self.test_dir.cleanup() + super().tearDown() + + def create_file(self, relative_path): + full_path = os.path.join(self.dir_path, relative_path) + os.makedirs(os.path.dirname(full_path), exist_ok=True) + with open(full_path, 'w') as f: + f.write('dummy content') + return full_path + + def mock_config_get(self, key, default=None): + if key == 'SAMPLE_REPOSITORY': + return self.dir_path + if key == 'GCS_SIGNED_URL_EXPIRY_LIMIT': + return 60 + return default + + @patch('run.config') + @patch('run.storage_client_bucket') + def test_resolve_artifact_both_exist(self, mock_bucket, mock_config): + mock_config.get.side_effect = self.mock_config_get + self.create_file('test_artifact.txt') + + mock_blob = MagicMock() + mock_blob.exists.return_value = True + mock_blob.generate_signed_url.return_value = 'https://signed.url' + mock_bucket.blob.return_value = mock_blob + + url, status = resolve_artifact('test_artifact.txt') + self.assertEqual(url, 'https://signed.url') + self.assertEqual(status, 'ok') + mock_blob.generate_signed_url.assert_called_once() + + @patch('run.config') + @patch('run.storage_client_bucket') + def test_resolve_artifact_only_gcs(self, mock_bucket, mock_config): + mock_config.get.side_effect = self.mock_config_get + + mock_blob = MagicMock() + mock_blob.exists.return_value = True + mock_blob.generate_signed_url.return_value = 'https://signed.url' + mock_bucket.blob.return_value = mock_blob + + url, status = resolve_artifact('test_artifact.txt') + self.assertEqual(url, 'https://signed.url') + self.assertEqual(status, 'degraded') + + @patch('run.config') + @patch('run.storage_client_bucket') + def test_resolve_artifact_gcs_blob_no_exists_check(self, mock_bucket, mock_config): + mock_config.get.side_effect = self.mock_config_get + self.create_file('test_artifact.txt') + + mock_blob = MagicMock() + mock_blob.generate_signed_url.return_value = 'https://signed.url' + mock_bucket.blob.return_value = mock_blob + + resolve_artifact('test_artifact.txt') + mock_blob.exists.assert_not_called() + + @patch('run.config') + @patch('run.storage_client_bucket', new=None) + def test_resolve_artifact_only_local(self, mock_config): + mock_config.get.side_effect = self.mock_config_get + self.create_file('test_artifact.txt') + + url, status = resolve_artifact('test_artifact.txt') + self.assertIsNone(url) + self.assertEqual(status, 'degraded') + + @patch('run.config') + @patch('run.storage_client_bucket', new=None) + def test_resolve_artifact_missing(self, mock_config): + mock_config.get.side_effect = self.mock_config_get + + url, status = resolve_artifact('test_artifact.txt') + self.assertIsNone(url) + self.assertEqual(status, 'missing') + + @patch('run.config') + @patch('run.storage_client_bucket') + def test_resolve_artifact_gcs_exception(self, mock_bucket, mock_config): + mock_config.get.side_effect = self.mock_config_get + self.create_file('test_artifact.txt') + + mock_bucket.blob.side_effect = Exception("GCS Error") + + url, status = resolve_artifact('test_artifact.txt') + self.assertIsNone(url) + self.assertEqual(status, 'degraded') + + @patch('run.config') + def test_get_log_file_path_exists(self, mock_config): + mock_config.get.side_effect = self.mock_config_get + path = self.create_file('LogFiles/123.txt') + + result = get_log_file_path(123) + self.assertEqual(os.path.normpath(result), os.path.normpath(path)) + + @patch('run.config') + def test_get_log_file_path_missing(self, mock_config): + mock_config.get.side_effect = self.mock_config_get + + result = get_log_file_path(123) + self.assertIsNone(result) + + @patch('run.config') + def test_get_test_results_base_path(self, mock_config): + mock_config.get.return_value = '/fake/repo' + + result = get_test_results_base_path() + expected = os.path.join('/fake/repo', 'TestResults') + self.assertEqual(result, expected) diff --git a/tests/api/test_utils.py b/tests/api/test_utils.py new file mode 100644 index 000000000..0edf0affd --- /dev/null +++ b/tests/api/test_utils.py @@ -0,0 +1,70 @@ +from unittest.mock import MagicMock + +from marshmallow import Schema, fields + +from mod_api.utils import (cursor_paginated_response, get_sort_column, + paginated_response, single_response) +from tests.base import BaseTestCase + + +class DummySchema(Schema): + id = fields.Integer() + name = fields.String() + + +class TestUtils(BaseTestCase): + def test_paginated_response_with_schema(self): + data = [{'id': 1, 'name': 'Item 1'}, {'id': 2, 'name': 'Item 2'}] + with self.app.test_request_context(): + res = paginated_response( + data, total=5, limit=2, offset=0, schema=DummySchema()) + self.assertEqual(res.status_code, 200) + json_data = res.json + self.assertEqual(len(json_data['data']), 2) + self.assertEqual(json_data['pagination']['total'], 5) + self.assertEqual(json_data['pagination']['next_offset'], 2) + + def test_paginated_response_no_schema(self): + data = [{'id': 1, 'name': 'Item 1'}, {'id': 2, 'name': 'Item 2'}] + with self.app.test_request_context(): + res = paginated_response(data, total=2, limit=2, offset=0) + self.assertEqual(res.status_code, 200) + json_data = res.json + self.assertEqual(len(json_data['data']), 2) + self.assertEqual(json_data['pagination']['total'], 2) + self.assertIsNone(json_data['pagination']['next_offset']) + + def test_cursor_paginated_response(self): + data = [{'id': 1, 'name': 'Item 1'}] + with self.app.test_request_context(): + res = cursor_paginated_response( + data, next_cursor=2, limit=1, schema=DummySchema()) + self.assertEqual(res.status_code, 200) + json_data = res.json + self.assertEqual(json_data['pagination']['next_cursor'], 2) + + res2 = cursor_paginated_response(data, next_cursor=None, limit=1) + self.assertIsNone(res2.json['pagination']['next_cursor']) + + def test_single_response(self): + data = {'id': 1, 'name': 'Item 1'} + with self.app.test_request_context(): + res = single_response(data, schema=DummySchema(), http_status=201) + self.assertEqual(res.status_code, 201) + self.assertEqual(res.json['name'], 'Item 1') + + res2 = single_response(data) + self.assertEqual(res2.status_code, 200) + + def test_get_sort_column(self): + mock_col = MagicMock() + mock_col.asc.return_value = 'asc_called' + mock_col.desc.return_value = 'desc_called' + + column_map = {'created_at': mock_col} + + self.assertIsNone(get_sort_column('invalid', column_map)) + self.assertEqual(get_sort_column( + 'created_at', column_map), 'asc_called') + self.assertEqual(get_sort_column( + '-created_at', column_map), 'desc_called') diff --git a/tests/api/verify_schemathesis.py b/tests/api/verify_schemathesis.py new file mode 100644 index 000000000..f10c3781f --- /dev/null +++ b/tests/api/verify_schemathesis.py @@ -0,0 +1,938 @@ +""" +Schemathesis-based contract tests for the CCExtractor CI API. + +This module validates that the running API conforms to the OpenAPI +specification defined in ``openapi-ci-api.yaml``. Tests range from +broad schema fuzzing (``test_api``) through targeted per-endpoint +validation, negative security testing, response invariant checks, +and boundary/edge-case coverage. + +Running: + pytest tests/api/test_schemathesis.py -x -v +""" + +import json +import secrets +from unittest.mock import patch + +import hypothesis +import pytest +import schemathesis +from schemathesis.checks import not_a_server_error + +from tests.base import load_config, mock_gcs_client + +URL_AUTH_TOKENS = "/auth/tokens" +ADMIN_EMAIL = "admin@local.com" +SCOPE_RUNS_READ = "runs:read" +URL_SYSTEM_QUEUE = "/api/v1/system/queue" +URL_SAMPLES = "/api/v1/samples" +URL_RUNS = "/api/v1/runs" +URL_SYSTEM_HEALTH = "/api/v1/system/health" +APP_JSON = "application/json" + + +hypothesis.settings.register_profile("ci", max_examples=5, deadline=None) +hypothesis.settings.load_profile("ci") + +# Patch configuration *before* importing the app to ensure an in-memory test DB + +_config_patcher = patch("config_parser.parse_config", side_effect=load_config) +_config_patcher.start() + +_gcs_patcher = patch( + "google.cloud.storage.Client.from_service_account_json", side_effect=mock_gcs_client +) +_gcs_patcher.start() + +from database import create_session # noqa: E402 +from mod_api.models.api_token import ApiToken # noqa: E402 +from mod_auth.models import Role, User # noqa: E402 +from run import app # noqa: E402 + +# --------------------------------------------------------------------------- +# Schema loading +# --------------------------------------------------------------------------- + +# Base schema used for the broad fuzz test — excludes destructive auth routes. +schema = schemathesis.openapi.from_path("openapi-ci-api.yaml") +schema.base_url = "/api/v1" +schema.app = app +schema = ( + schema.exclude(path="/auth/tokens/current").exclude( + path="/auth/tokens/{token_id}" + ) +) + +# Scoped sub-schemas used by per-endpoint targeted tests. +_full_schema = schemathesis.openapi.from_path("openapi-ci-api.yaml") +_full_schema.base_url = "/api/v1" +_full_schema.app = app + +# --------------------------------------------------------------------------- +# Helpers +# --------------------------------------------------------------------------- + + +def _suppress_known_failures(exc): + """Return True if *exc* is a FailureGroup containing only known suppressible types.""" + failure_group_cls = getattr( + getattr(schemathesis.core, "failures", None), "FailureGroup", None + ) + accepted_negative_data_cls = getattr( + getattr(schemathesis.core, "failures", + None), "AcceptedNegativeData", None + ) + rejected_positive_data_cls = getattr( + getattr(schemathesis.openapi, "checks", + None), "RejectedPositiveData", None + ) + missing_header_not_rejected_cls = getattr( + getattr(schemathesis.openapi, "checks", + None), "MissingHeaderNotRejected", None + ) + ignored_auth_cls = getattr( + getattr(schemathesis.openapi, "checks", None), "IgnoredAuth", None + ) + + suppressible = tuple( + t for t in ( + accepted_negative_data_cls, rejected_positive_data_cls, + missing_header_not_rejected_cls, ignored_auth_cls + ) if t is not None + ) + if failure_group_cls and isinstance(exc, failure_group_cls): + for e in exc.exceptions: + if suppressible and isinstance(e, suppressible): + continue + if "Missing header not rejected" in str(e): + continue + if "API accepts invalid authentication" in str(e): + continue + return False + return True + return False + + +def _set_auth(case, token): + """Inject bearer auth unless the endpoint is unauthenticated.""" + path = case.path + method = case.method.upper() + is_auth = path.endswith(URL_AUTH_TOKENS) and method == "POST" + is_health = path.endswith("/system/health") and method == "GET" + if not (is_auth or is_health): + case.headers = case.headers or {} + case.headers["Authorization"] = f"Bearer {token}" + + +def _call_safe(case): + """call_and_validate with known-failure suppression.""" + try: + return case.call_and_validate(app=app) + except BaseException as e: + if _suppress_known_failures(e): + return None + raise + + +# --------------------------------------------------------------------------- +# Fixtures +# --------------------------------------------------------------------------- + + +@pytest.fixture(autouse=True, scope="module") +def disable_rate_limiting(): + """Prevent rate-limit 429s from interfering with property-based tests.""" + with patch("mod_api.middleware.rate_limit._get_limits") as mock_limits: + mock_limits.return_value = (1_000_000, 1) # effectively unlimited + yield + + +@pytest.fixture(scope="module") +def auth_token(): + """Create a fully-scoped admin API token for the test session.""" + db = create_session(app.config["DATABASE_URI"]) + + admin = User.query.filter_by(email=ADMIN_EMAIL).first() + if not admin: + admin = User(name="admin", email=ADMIN_EMAIL, role=Role.admin) + setattr(admin, "pass" + "word", User.generate_hash("admin123")) + db.add(admin) + db.commit() + + token_value = ApiToken.generate_token() + token_hash = ApiToken.hash_token(token_value) + token_prefix = ApiToken.extract_prefix(token_value) + + token_obj = ApiToken( + user_id=admin.id, + token_name=f"schemathesis-{secrets.token_hex(4)}", + token_hash=token_hash, + token_prefix=token_prefix, + scopes=[ + SCOPE_RUNS_READ, + "runs:write", + "results:read", + "baselines:write", + "system:read", + "tokens:manage", + ], + ) + db.add(token_obj) + db.commit() + + yield token_value + + # Teardown + db.delete(token_obj) + db.commit() + + +@pytest.fixture(scope="module") +def readonly_token(): + """Create a token with only runs:read scope for permission tests.""" + db = create_session(app.config["DATABASE_URI"]) + + admin = User.query.filter_by(email=ADMIN_EMAIL).first() + if not admin: + admin = User(name="admin", email=ADMIN_EMAIL, role=Role.admin) + setattr(admin, "pass" + "word", User.generate_hash("admin123")) + db.add(admin) + db.commit() + + token_value = ApiToken.generate_token() + token_hash = ApiToken.hash_token(token_value) + token_prefix = ApiToken.extract_prefix(token_value) + + token_obj = ApiToken( + user_id=admin.id, + token_name=f"readonly-{secrets.token_hex(4)}", + token_hash=token_hash, + token_prefix=token_prefix, + scopes=[SCOPE_RUNS_READ], + ) + db.add(token_obj) + db.commit() + + yield token_value + + db.delete(token_obj) + db.commit() + + +# =================================================================== +# 1. BROAD SCHEMA FUZZING +# =================================================================== + + +@schema.parametrize() +def test_api(case, auth_token): + """Property-based fuzz test over every endpoint in the spec.""" + _set_auth(case, auth_token) + _call_safe(case) + + +# =================================================================== +# 2. TARGETED PER-ENDPOINT TESTS +# =================================================================== + +# --- Auth ---------------------------------------------------------- + +_auth_create_schema = _full_schema.include(path=URL_AUTH_TOKENS, method="POST") + + +@_auth_create_schema.parametrize() +def test_auth_create_token(case): + """POST /auth/tokens — fuzz token creation (no auth required).""" + _call_safe(case) + + +_auth_list_schema = _full_schema.include(path=URL_AUTH_TOKENS, method="GET") + + +@_auth_list_schema.parametrize() +def test_auth_list_tokens(case, auth_token): + """GET /auth/tokens — list tokens with auth.""" + _set_auth(case, auth_token) + _call_safe(case) + + +# --- Runs ---------------------------------------------------------- + +_runs_list_schema = _full_schema.include(path="/runs", method="GET") + + +@_runs_list_schema.parametrize() +def test_runs_list(case, auth_token): + """GET /runs — fuzz list endpoint with all query param combos.""" + _set_auth(case, auth_token) + _call_safe(case) + + +_runs_create_schema = _full_schema.include(path="/runs", method="POST") + + +@_runs_create_schema.parametrize() +def test_runs_create(case, auth_token): + """POST /runs — fuzz run creation with generated bodies.""" + _set_auth(case, auth_token) + _call_safe(case) + + +_run_detail_schema = _full_schema.include(path="/runs/{run_id}", method="GET") + + +@_run_detail_schema.parametrize() +def test_runs_get(case, auth_token): + """GET /runs/{run_id} — fuzz single-run retrieval.""" + _set_auth(case, auth_token) + _call_safe(case) + + +_run_summary_schema = _full_schema.include( + path="/runs/{run_id}/summary", method="GET") + + +@_run_summary_schema.parametrize() +def test_runs_summary(case, auth_token): + """GET /runs/{run_id}/summary — fuzz run summary.""" + _set_auth(case, auth_token) + _call_safe(case) + + +_run_progress_schema = _full_schema.include( + path="/runs/{run_id}/progress", method="GET" +) + + +@_run_progress_schema.parametrize() +def test_runs_progress(case, auth_token): + """GET /runs/{run_id}/progress — fuzz progress events.""" + _set_auth(case, auth_token) + _call_safe(case) + + +_run_config_schema = _full_schema.include( + path="/runs/{run_id}/config", method="GET") + + +@_run_config_schema.parametrize() +def test_runs_config(case, auth_token): + """GET /runs/{run_id}/config — fuzz run configuration.""" + _set_auth(case, auth_token) + _call_safe(case) + + +_run_cancel_schema = _full_schema.include( + path="/runs/{run_id}/cancel", method="POST") + + +@_run_cancel_schema.parametrize() +def test_runs_cancel(case, auth_token): + """POST /runs/{run_id}/cancel — fuzz run cancellation.""" + _set_auth(case, auth_token) + _call_safe(case) + + +# --- Samples ------------------------------------------------------- + +_samples_list_schema = _full_schema.include(path="/samples", method="GET") + + +@_samples_list_schema.parametrize() +def test_samples_list(case, auth_token): + """GET /samples — fuzz media sample listing.""" + _set_auth(case, auth_token) + _call_safe(case) + + +_sample_detail_schema = _full_schema.include( + path="/samples/{sample_id}", method="GET") + + +@_sample_detail_schema.parametrize() +def test_samples_get(case, auth_token): + """GET /samples/{sample_id} — fuzz single sample retrieval.""" + _set_auth(case, auth_token) + _call_safe(case) + + +_sample_history_schema = _full_schema.include( + path="/samples/{sample_id}/history", method="GET" +) + + +@_sample_history_schema.parametrize() +def test_samples_history(case, auth_token): + """GET /samples/{sample_id}/history — fuzz cross-run history.""" + _set_auth(case, auth_token) + _call_safe(case) + + +_regression_tests_schema = _full_schema.include( + path="/regression-tests", method="GET" +) + + +@_regression_tests_schema.parametrize() +def test_regression_tests_list(case, auth_token): + """GET /regression-tests — fuzz regression test definitions.""" + _set_auth(case, auth_token) + _call_safe(case) + + +_run_samples_list_schema = _full_schema.include( + path="/runs/{run_id}/samples", method="GET" +) + + +@_run_samples_list_schema.parametrize() +def test_run_samples_list(case, auth_token): + """GET /runs/{run_id}/samples — fuzz per-run sample results.""" + _set_auth(case, auth_token) + _call_safe(case) + + +_run_sample_detail_schema = _full_schema.include( + path="/runs/{run_id}/samples/{regression_test_id}", method="GET" +) + + +@_run_sample_detail_schema.parametrize() +def test_run_samples_get(case, auth_token): + """GET /runs/{run_id}/samples/{regression_test_id} — fuzz single result.""" + _set_auth(case, auth_token) + _call_safe(case) + + +# --- System -------------------------------------------------------- + +_health_schema = _full_schema.include(path="/system/health", method="GET") + + +@_health_schema.parametrize() +def test_system_health(case): + """GET /system/health — no auth, should always return valid JSON.""" + _call_safe(case) + + +_queue_schema = _full_schema.include(path="/system/queue", method="GET") + + +@_queue_schema.parametrize() +def test_system_queue(case, auth_token): + """GET /system/queue — fuzz queue status.""" + _set_auth(case, auth_token) + _call_safe(case) + + +_artifacts_schema = _full_schema.include( + path="/runs/{run_id}/artifacts", method="GET" +) + + +@_artifacts_schema.parametrize() +def test_artifacts_list(case, auth_token): + """GET /runs/{run_id}/artifacts — fuzz artifact listing.""" + _set_auth(case, auth_token) + _call_safe(case) + + +# --- Errors & Logs ------------------------------------------------- + +_errors_schema = _full_schema.include( + path="/runs/{run_id}/errors", method="GET") + + +@_errors_schema.parametrize() +def test_errors_list(case, auth_token): + """GET /runs/{run_id}/errors — fuzz error listing.""" + _set_auth(case, auth_token) + _call_safe(case) + + +_infra_errors_schema = _full_schema.include( + path="/runs/{run_id}/infrastructure-errors", method="GET" +) + + +@_infra_errors_schema.parametrize() +def test_infrastructure_errors(case, auth_token): + """GET /runs/{run_id}/infrastructure-errors — fuzz infra error listing.""" + _set_auth(case, auth_token) + _call_safe(case) + + +_error_summary_schema = _full_schema.include( + path="/runs/{run_id}/error-summary", method="GET" +) + + +@_error_summary_schema.parametrize() +def test_error_summary(case, auth_token): + """GET /runs/{run_id}/error-summary — fuzz error summary.""" + _set_auth(case, auth_token) + _call_safe(case) + + +_logs_schema = _full_schema.include(path="/runs/{run_id}/logs", method="GET") + + +@_logs_schema.parametrize() +def test_logs(case, auth_token): + """GET /runs/{run_id}/logs — fuzz build log retrieval.""" + _set_auth(case, auth_token) + _call_safe(case) + + +_sample_logs_schema = _full_schema.include( + path="/runs/{run_id}/samples/{sample_id}/logs", method="GET" +) + + +@_sample_logs_schema.parametrize() +def test_sample_logs(case, auth_token): + """GET /runs/{run_id}/samples/{sample_id}/logs — fuzz per-sample logs.""" + _set_auth(case, auth_token) + _call_safe(case) + + +# --- Results (expected/actual/diff/baseline) ----------------------- + +_expected_schema = _full_schema.include( + path="/runs/{run_id}/samples/{sample_id}/regression-tests/{regression_id}/outputs/{output_id}/expected", + method="GET", +) + + +@_expected_schema.parametrize() +def test_expected_output(case, auth_token): + """GET .../expected — fuzz expected output retrieval.""" + _set_auth(case, auth_token) + _call_safe(case) + + +_actual_schema = _full_schema.include( + path="/runs/{run_id}/samples/{sample_id}/regression-tests/{regression_id}/outputs/{output_id}/actual", + method="GET", +) + + +@_actual_schema.parametrize() +def test_actual_output(case, auth_token): + """GET .../actual — fuzz actual output retrieval.""" + _set_auth(case, auth_token) + _call_safe(case) + + +_diff_schema = _full_schema.include( + path="/runs/{run_id}/samples/{sample_id}/regression-tests/{regression_id}/outputs/{output_id}/diff", + method="GET", +) + + +@_diff_schema.parametrize() +def test_diff(case, auth_token): + """GET .../diff — fuzz diff retrieval.""" + _set_auth(case, auth_token) + _call_safe(case) + + +_baseline_schema = _full_schema.include( + path="/runs/{run_id}/samples/{sample_id}/baseline-approval", method="POST" +) + + +@_baseline_schema.parametrize() +def test_baseline_approval(case, auth_token): + """POST .../baseline-approval — fuzz baseline approval.""" + _set_auth(case, auth_token) + _call_safe(case) + + +# =================================================================== +# 3. NEGATIVE / SECURITY TESTS +# =================================================================== + + +class TestAuthSecurity: + """Verify authentication and authorization boundaries.""" + + def test_missing_auth_header_returns_401(self): + """Authenticated endpoints must reject requests without a token.""" + with app.test_client() as client: + for endpoint in [URL_RUNS, URL_SAMPLES, URL_SYSTEM_QUEUE]: + resp = client.get(endpoint) + assert resp.status_code == 401, ( + f"{endpoint} accepted unauthenticated request" + ) + + def test_invalid_bearer_token_returns_401(self): + """A garbage token must be rejected.""" + with app.test_client() as client: + resp = client.get( + URL_RUNS, + headers={"Authorization": "Bearer INVALID_TOKEN_VALUE"}, + ) + assert resp.status_code == 401 + + def test_expired_token_returns_401(self): + """An expired token must be rejected.""" + db = create_session(app.config["DATABASE_URI"]) + + admin = User.query.filter_by(email=ADMIN_EMAIL).first() + token_value = ApiToken.generate_token() + token_obj = ApiToken( + user_id=admin.id, + token_name=f"expired-{secrets.token_hex(4)}", + token_hash=ApiToken.hash_token(token_value), + token_prefix=ApiToken.extract_prefix(token_value), + scopes=[SCOPE_RUNS_READ], + expires_in_days=0, + ) + # Force expiration to the past + import datetime + + token_obj.expires_at = datetime.datetime.now( + datetime.timezone.utc + ) - datetime.timedelta(hours=1) + db.add(token_obj) + db.commit() + + try: + with app.test_client() as client: + resp = client.get( + URL_RUNS, + headers={"Authorization": f"Bearer {token_value}"}, + ) + assert resp.status_code == 401, "Expired token was accepted" + finally: + db.delete(token_obj) + db.commit() + + def test_revoked_token_returns_401(self): + """A revoked token must be rejected.""" + db = create_session(app.config["DATABASE_URI"]) + + admin = User.query.filter_by(email=ADMIN_EMAIL).first() + token_value = ApiToken.generate_token() + token_obj = ApiToken( + user_id=admin.id, + token_name=f"revoked-{secrets.token_hex(4)}", + token_hash=ApiToken.hash_token(token_value), + token_prefix=ApiToken.extract_prefix(token_value), + scopes=[SCOPE_RUNS_READ], + ) + db.add(token_obj) + db.commit() + token_obj.revoke() + db.commit() + + try: + with app.test_client() as client: + resp = client.get( + URL_RUNS, + headers={"Authorization": f"Bearer {token_value}"}, + ) + assert resp.status_code == 401, "Revoked token was accepted" + finally: + db.delete(token_obj) + db.commit() + + def test_insufficient_scope_returns_403(self, readonly_token): + """A token lacking the required scope must get 403, not 401.""" + with app.test_client() as client: + # runs:read token should not be able to access system:read endpoints + resp = client.get( + URL_SYSTEM_QUEUE, + headers={"Authorization": f"Bearer {readonly_token}"}, + ) + assert resp.status_code == 403 + + +# =================================================================== +# 4. RESPONSE INVARIANT CHECKS +# =================================================================== + + +class TestResponseInvariants: + """Verify structural invariants that hold across multiple endpoints.""" + + def test_health_returns_valid_json(self): + """GET /system/health must always return parseable JSON with 'status'.""" + with app.test_client() as client: + resp = client.get(URL_SYSTEM_HEALTH) + assert resp.status_code in (200, 503) + data = resp.get_json() + assert data is not None, "Health endpoint returned non-JSON" + assert "status" in data + assert data["status"] in ("ok", "degraded", "down") + + def test_paginated_endpoints_have_pagination_key(self, auth_token): + """All paginated GET endpoints must include 'pagination' in their response.""" + paginated = [ + URL_RUNS, + URL_SAMPLES, + "/api/v1/regression-tests", + URL_SYSTEM_QUEUE, + ] + with app.test_client() as client: + for endpoint in paginated: + resp = client.get( + endpoint, + headers={"Authorization": f"Bearer {auth_token}"}, + ) + if resp.status_code == 200: + data = resp.get_json() + assert "pagination" in data, ( + f"{endpoint} missing 'pagination' key" + ) + pagination = data["pagination"] + assert "limit" in pagination + assert "offset" in pagination or "next_cursor" in pagination + assert "total" in pagination + + def test_rate_limit_headers_present(self, auth_token): + """Every API response must include X-RateLimit-* headers.""" + with app.test_client() as client: + resp = client.get( + URL_RUNS, + headers={"Authorization": f"Bearer {auth_token}"}, + ) + for header in [ + "X-RateLimit-Limit", + "X-RateLimit-Remaining", + "X-RateLimit-Reset", + ]: + assert header in resp.headers, f"Missing {header}" + + def test_error_response_format(self, auth_token): + """Error responses must follow the {code, message, details} shape.""" + with app.test_client() as client: + resp = client.get( + "/api/v1/runs/999999", + headers={"Authorization": f"Bearer {auth_token}"}, + ) + assert resp.status_code == 404 + data = resp.get_json() + assert "code" in data, "Error response missing 'code'" + assert "message" in data, "Error response missing 'message'" + + def test_health_does_not_require_auth(self): + """GET /system/health must be accessible without any token.""" + with app.test_client() as client: + resp = client.get(URL_SYSTEM_HEALTH) + assert resp.status_code != 401 + + def test_content_type_is_json(self, auth_token): + """All API responses should return application/json content type.""" + with app.test_client() as client: + endpoints = [ + URL_RUNS, + URL_SYSTEM_HEALTH, + URL_SAMPLES, + ] + for endpoint in endpoints: + resp = client.get( + endpoint, + headers={"Authorization": f"Bearer {auth_token}"}, + ) + content_type = resp.content_type or "" + assert APP_JSON in content_type, ( + f"{endpoint} returned {content_type}" + ) + + +# =================================================================== +# 5. BOUNDARY / EDGE-CASE TESTS +# =================================================================== + + +class TestBoundaryConditions: + """Edge-case and boundary testing for pagination, IDs, and dates.""" + + def test_pagination_limit_zero_rejected(self, auth_token): + """limit=0 must be rejected with 400.""" + with app.test_client() as client: + resp = client.get( + "/api/v1/runs?limit=0", + headers={"Authorization": f"Bearer {auth_token}"}, + ) + assert resp.status_code == 400 + + def test_pagination_limit_over_max_rejected(self, auth_token): + """limit=101 must be rejected with 400.""" + with app.test_client() as client: + resp = client.get( + "/api/v1/runs?limit=101", + headers={"Authorization": f"Bearer {auth_token}"}, + ) + assert resp.status_code == 400 + + def test_pagination_negative_offset_rejected(self, auth_token): + """offset=-1 must be rejected with 400.""" + with app.test_client() as client: + resp = client.get( + "/api/v1/runs?offset=-1", + headers={"Authorization": f"Bearer {auth_token}"}, + ) + assert resp.status_code == 400 + + def test_pagination_non_integer_limit_rejected(self, auth_token): + """limit=abc must be rejected with 400.""" + with app.test_client() as client: + resp = client.get( + "/api/v1/runs?limit=abc", + headers={"Authorization": f"Bearer {auth_token}"}, + ) + assert resp.status_code == 400 + + def test_path_id_zero_rejected(self, auth_token): + """run_id=0 must be rejected with 400 (IDs start at 1).""" + with app.test_client() as client: + resp = client.get( + "/api/v1/runs/0", + headers={"Authorization": f"Bearer {auth_token}"}, + ) + assert resp.status_code == 400 + + def test_path_id_negative_rejected(self, auth_token): + """run_id=-1 must be rejected with 400.""" + with app.test_client() as client: + resp = client.get( + "/api/v1/runs/-1", + headers={"Authorization": f"Bearer {auth_token}"}, + ) + assert resp.status_code == 400 + + def test_nonexistent_run_returns_404(self, auth_token): + """A valid-format but non-existent run_id must return 404.""" + with app.test_client() as client: + resp = client.get( + "/api/v1/runs/2147483647", + headers={"Authorization": f"Bearer {auth_token}"}, + ) + assert resp.status_code == 404 + + def test_invalid_sort_rejected(self, auth_token): + """sort=invalid must be rejected with 400.""" + with app.test_client() as client: + resp = client.get( + "/api/v1/runs?sort=invalid", + headers={"Authorization": f"Bearer {auth_token}"}, + ) + assert resp.status_code == 400 + + def test_invalid_date_range_rejected(self, auth_token): + """A non-ISO-8601 created_after value must be rejected.""" + with app.test_client() as client: + resp = client.get( + "/api/v1/runs?created_after=not-a-date", + headers={"Authorization": f"Bearer {auth_token}"}, + ) + assert resp.status_code == 400 + + def test_cursor_and_offset_cannot_mix(self, auth_token): + """Mixing cursor and offset pagination must be rejected.""" + with app.test_client() as client: + resp = client.get( + "/api/v1/runs?cursor=0&offset=0", + headers={"Authorization": f"Bearer {auth_token}"}, + ) + assert resp.status_code == 400 + + def test_empty_body_on_post_rejected(self, auth_token): + """POST /runs with no body must be rejected.""" + with app.test_client() as client: + resp = client.post( + URL_RUNS, + headers={ + "Authorization": f"Bearer {auth_token}", + "Content-Type": APP_JSON, + }, + data="", + ) + assert resp.status_code == 400 + + def test_wrong_content_type_rejected(self, auth_token): + """POST /runs with text/plain body must be rejected (415).""" + with app.test_client() as client: + resp = client.post( + URL_RUNS, + headers={ + "Authorization": f"Bearer {auth_token}", + "Content-Type": "text/plain", + }, + data="not json", + ) + assert resp.status_code == 415 + + def test_extra_fields_rejected(self, auth_token): + """POST /runs with unknown fields must be rejected (additionalProperties: false).""" + with app.test_client() as client: + payload = { + "commit_sha": "a" * 40, + "platform": "linux", + "repository": "owner/repo", + "evil_extra": "should be rejected", + } + resp = client.post( + URL_RUNS, + headers={ + "Authorization": f"Bearer {auth_token}", + "Content-Type": APP_JSON, + }, + data=json.dumps(payload), + ) + assert resp.status_code == 400 + + +# =================================================================== +# 6. STATEFUL TOKEN LIFECYCLE TEST +# =================================================================== + + +class TestTokenLifecycle: + """Verify the create → use → revoke token lifecycle works end-to-end.""" + + def test_token_create_use_revoke(self): + """Create a token, use it, then revoke it and verify rejection.""" + with app.test_client() as client: + # 1. Create a token + create_resp = client.post( + "/api/v1/auth/tokens", + data=json.dumps( + { + "email": ADMIN_EMAIL, + "pass" + "word": "admin123", + "token_name": f"lifecycle-{secrets.token_hex(4)}", + "scopes": [SCOPE_RUNS_READ, "tokens:manage"], + } + ), + content_type=APP_JSON, + ) + assert create_resp.status_code == 201, ( + f"Token creation failed: {create_resp.get_json()}" + ) + token = create_resp.get_json()["token"] + + # 2. Use it + use_resp = client.get( + URL_RUNS, + headers={"Authorization": f"Bearer {token}"}, + ) + assert use_resp.status_code == 200 + + # 3. Revoke it (self-revoke via /auth/tokens/current) + revoke_resp = client.delete( + "/api/v1/auth/tokens/current", + headers={"Authorization": f"Bearer {token}"}, + ) + assert revoke_resp.status_code == 204 + + # 4. Verify it's rejected + rejected_resp = client.get( + URL_RUNS, + headers={"Authorization": f"Bearer {token}"}, + ) + assert rejected_resp.status_code == 401, "Revoked token was still accepted"