Initial public ModelForge release

2026-09-01 21:30:16 +02:00
commit 7082ab955a
490 changed files with 104252 additions and 0 deletions
@@ -0,0 +1,104 @@
+from __future__ import annotations
+
+from collections.abc import Iterator
+
+import pytest
+from fastapi.testclient import TestClient
+from sqlalchemy import create_engine
+from sqlalchemy.exc import SQLAlchemyError
+from sqlalchemy.orm import Session
+from sqlalchemy.pool import StaticPool
+
+from modelforge_api.api.routes.observability import get_service
+from modelforge_api.main import app
+from modelforge_api.persistence.models import Base
+from modelforge_api.services.observability import ObservabilityService
+from modelforge_api.settings import Settings, get_settings
+
+
+@pytest.fixture
+def session() -> Iterator[Session]:
+    engine = create_engine(
+        "sqlite+pysqlite:///:memory:",
+        connect_args={"check_same_thread": False},
+        poolclass=StaticPool,
+    )
+    Base.metadata.create_all(engine)
+    with Session(engine) as value:
+        yield value
+
+
+@pytest.fixture(autouse=True)
+def clean_overrides() -> Iterator[None]:
+    yield
+    app.dependency_overrides.clear()
+
+
+def test_operations_routes_require_the_operator_credential(session: Session) -> None:
+    subject = ObservabilityService(session, Settings(observability_monitor_enabled=False))
+    subject.ensure_defaults()
+    app.dependency_overrides[get_service] = lambda: subject
+    app.dependency_overrides[get_settings] = lambda: Settings(
+        operator_api_key="operator-secret", observability_monitor_enabled=False
+    )
+    client = TestClient(app)
+
+    assert client.get("/api/v1/admin/operations/overview").status_code == 401
+    assert client.get(
+        "/api/v1/admin/operations/overview",
+        headers={"Authorization": "Bearer capability-client-secret"},
+    ).status_code == 401
+    response = client.get(
+        "/api/v1/admin/operations/overview",
+        headers={"X-ModelForge-Admin-Token": "operator-secret"},
+    )
+    assert response.status_code == 200
+    assert response.json()["status"] == "HEALTHY"
+
+
+def test_prometheus_endpoint_is_bounded_and_contains_no_request_payload(
+    session: Session,
+) -> None:
+    subject = ObservabilityService(session, Settings(observability_monitor_enabled=False))
+    subject.ensure_defaults()
+    app.dependency_overrides[get_service] = lambda: subject
+    app.dependency_overrides[get_settings] = lambda: Settings(
+        operator_api_key="operator-secret", observability_monitor_enabled=False
+    )
+    response = TestClient(app).get(
+        "/metrics", headers={"X-ModelForge-Admin-Token": "operator-secret"}
+    )
+
+    assert response.status_code == 200
+    assert response.headers["content-type"].startswith("text/plain")
+    assert "modelforge_api_requests_total" in response.text
+    assert "modelforge_api_request_duration_seconds_bucket" in response.text
+    for forbidden in ("request_id=", "input_sha256=", "prompt=", "payload="):
+        assert forbidden not in response.text
+
+
+def test_process_metrics_remain_available_when_observability_storage_fails() -> None:
+    class BrokenSession:
+        rolled_back = False
+
+        def rollback(self) -> None:
+            self.rolled_back = True
+
+    class BrokenService:
+        session = BrokenSession()
+
+        def prometheus(self) -> str:
+            raise SQLAlchemyError("simulated observability database outage")
+
+    broken = BrokenService()
+    app.dependency_overrides[get_service] = lambda: broken
+    app.dependency_overrides[get_settings] = lambda: Settings(
+        operator_api_key="operator-secret", observability_monitor_enabled=False
+    )
+    response = TestClient(app).get(
+        "/metrics", headers={"X-ModelForge-Admin-Token": "operator-secret"}
+    )
+
+    assert response.status_code == 200
+    assert broken.session.rolled_back is True
+    assert "modelforge_observability_degraded 1" in response.text