test: strengthen safety-critical coverage

2026-07-29 19:40:27 +02:00
parent 0ed202ec95
commit c826561c77
11 changed files with 613 additions and 5 deletions
@@ -1242,3 +1242,81 @@ test("push bundle preflight does not require Git or Gitea credentials on Unraid"
  assert.equal(result.checks.some((item) => item.id === "server-git-command"), false);
  assert.equal(result.summary.ready, true, JSON.stringify(result.checks.filter((item) => item.status === "fail")));
 });
+
+test("preflight explains monitor-only and degraded server evidence without hiding warnings", async () => {
+  const sha = "d".repeat(40);
+  const profile = {
+    id: "observed", provider: "ssh-unraid", environment: "production", branch: "main", serverId: "unraid",
+    remoteFolder: "Observed", deploymentMode: "monitor-only", composeFiles: ["compose.yml"],
+    composeService: "app", iconMode: "url", iconUrl: "", preservePaths: ["data"]
+  };
+  const service = new UnraidDeploymentService({
+    store: {
+      getDeploymentProfile: () => profile,
+      getServer: () => ({ id: "unraid", name: "Unraid", host: "server", port: 22, username: "deploy", basePath: "/mnt/apps", hostFingerprint: "" })
+    },
+    git: {},
+    ssh: { test: async () => { throw new Error("host unavailable"); } },
+    gitea: {},
+    sourcePath: process.cwd()
+  });
+  service.inspectWriteAccess = async () => { throw new Error("permission probe failed"); };
+  service.inspect = async () => ({
+    exists: true, rootGit: true, head: "e".repeat(40), trackedChanges: ["compose.yml"], nestedGit: ["vendor/repo"],
+    dockerfile: true, dockerignore: false, dockerignoreGitExcluded: false, dockerContextExclusionsMissing: ["data"],
+    existingPreservePaths: ["data"], composeFiles: []
+  });
+  const result = await service.preflight({ repository: { fullName: "Jens/Observed", name: "Observed", localPath: null }, profileId: profile.id, sha });
+  const byId = (id) => result.checks.find((check) => check.id === id);
+  assert.equal(byId("deployment-mode").status, "fail");
+  assert.equal(byId("local-repository").status, "fail");
+  assert.equal(byId("ssh").status, "fail");
+  assert.equal(byId("host-key").status, "fail");
+  assert.equal(byId("project-write-access").status, "fail");
+  assert.equal(byId("tracked-changes").status, "warning");
+  assert.equal(byId("nested-git").status, "warning");
+  assert.equal(byId("dockerignore").status, "warning");
+  assert.equal(byId("dockerignore-runtime").status, "warning");
+  assert.equal(byId("dockerman-icon").status, "fail");
+  assert.equal(byId("dockerman-webui").status, "warning");
+  assert.equal(result.summary.ready, false);
+});
+
+test("server-pull preflight resolves Gitea SHA and reports every degraded capability and write target", async () => {
+  const sha = "f".repeat(40);
+  const profile = {
+    id: "server-pull", provider: "ssh-unraid", environment: "staging", branch: "release", serverId: "unraid", remoteFolder: "App",
+    deploymentMode: "server-git", composeFiles: ["compose.yml", "compose.prod.yml"], composeService: "web",
+    iconMode: "none", preservePaths: []
+  };
+  const service = new UnraidDeploymentService({
+    store: {
+      getDeploymentProfile: () => profile,
+      getServer: () => ({ id: "unraid", name: "Unraid", host: "server", port: 22, username: "deploy", basePath: "/mnt/apps", hostFingerprint: "SHA256:trusted" })
+    },
+    git: { status: async () => ({ root: "/local", clean: false, counts: { changed: 3 }, branch: { head: "main" } }) },
+    ssh: { test: async () => ({ capabilities: { docker: true, dockerReady: false, compose: false, git: false, tar: true, checksum: false, baseWritable: false } }) },
+    gitea: { getBranch: async () => ({ commit: { sha } }) },
+    sourcePath: process.cwd()
+  });
+  service.probeServerGitAccess = async () => ({ ready: false, error: "deploy key missing", remoteSha: null });
+  service.inspectWriteAccess = async () => ({
+    ready: false, identity: { user: "deploy" }, blocking: [{ path: "/mnt/apps/App" }],
+    targets: [{ id: "root", label: "Project root", path: "/mnt/apps/App", required: true, effectiveWritable: false, owner: "root", group: "root", mode: "0755", detail: "not writable" }]
+  });
+  service.inspect = async () => ({ exists: false, rootGit: false, trackedChanges: [], nestedGit: [], dockerfile: false, dockerignore: false, dockerignoreGitExcluded: false, dockerContextExclusionsMissing: [], existingPreservePaths: [], composeFiles: [] });
+  const result = await service.preflight({ repository: { fullName: "Jens/App", name: "App", localPath: "/local" }, profileId: profile.id });
+  const byId = (id) => result.checks.find((check) => check.id === id);
+  assert.equal(result.sha, sha);
+  assert.equal(byId("local-branch").status, "warning");
+  assert.equal(byId("local-clean").status, "warning");
+  assert.equal(byId("docker-runtime").status, "fail");
+  assert.match(byId("docker-runtime").detail, /cannot query/i);
+  assert.equal(byId("compose-command").status, "fail");
+  assert.equal(byId("bundle-tools").status, "fail");
+  assert.equal(byId("server-base-writable").status, "fail");
+  assert.equal(byId("server-git-access").repairAction, "configure-server-git-access");
+  assert.equal(byId("write-path:root").status, "fail");
+  assert.equal(byId("remote-folder").status, "pass");
+  assert.equal(byId("dockerman-icon").status, "warning");
+});