Merge remote-tracking branch 'origin/master' into feat/decomp-hook-points
# Conflicts: # nextcloud_mcp_server/vector/scanner.py
This commit is contained in:
Chris Coutinho
@@ -0,0 +1,212 @@
|
||||
"""ACL-aware ownership filter — deterministic, in-memory Qdrant.
|
||||
|
||||
Proves the query-time ownership expansion added for ACL-aware search
|
||||
(``search/access_filter.build_ownership_filter`` →
|
||||
``SemanticSearchAlgorithm``): a user finds documents whose owner shared them
|
||||
(``owner_id`` ∈ accessible_owners), does not find documents owned by users who
|
||||
have not shared with them, and legacy points carrying only ``user_id`` stay
|
||||
findable by their original indexer.
|
||||
|
||||
This complements ``tests/unit/search/test_access_filter.py`` (filter
|
||||
construction in isolation) by exercising the filter against a real Qdrant
|
||||
engine through the actual search algorithm — no Nextcloud, no verification
|
||||
layer, no background sync, so it is fast and deterministic. The full
|
||||
real-Nextcloud flow (share + verify-on-read) lives in
|
||||
``test_acl_shared_search.py``.
|
||||
"""
|
||||
|
||||
from unittest.mock import AsyncMock
|
||||
|
||||
import pytest
|
||||
from qdrant_client import AsyncQdrantClient
|
||||
from qdrant_client.models import Distance, PointStruct, VectorParams
|
||||
|
||||
from nextcloud_mcp_server.config import get_settings
|
||||
from nextcloud_mcp_server.embedding import SimpleEmbeddingProvider
|
||||
from nextcloud_mcp_server.search.algorithms import get_indexed_doc_types
|
||||
from nextcloud_mcp_server.search.context import _get_chunk_by_index_from_qdrant
|
||||
from nextcloud_mcp_server.search.semantic import SemanticSearchAlgorithm
|
||||
|
||||
pytestmark = pytest.mark.integration
|
||||
|
||||
# Same text for every point so cosine similarity to the query is ~identical:
|
||||
# the *filter*, not the score, must decide what each user sees.
|
||||
_DOC_TEXT = "Quarterly infrastructure budget planning and resource allocation"
|
||||
|
||||
# (point_id, doc_id, owner_id, user_id) — owner_id=None mimics a legacy point
|
||||
# indexed before the owner_id payload field existed.
|
||||
_ALICE_FILE = (101, "101", "alice", "alice")
|
||||
_CHARLIE_FILE = (102, "102", "charlie", "charlie")
|
||||
_LEGACY_DAVE_FILE = (103, "103", None, "dave")
|
||||
|
||||
|
||||
@pytest.fixture
|
||||
async def seeded_collection(monkeypatch):
|
||||
"""In-memory Qdrant seeded with three file points, wired into the algorithm.
|
||||
|
||||
Yields the ``SimpleEmbeddingProvider`` so the test can build a query vector
|
||||
identical to the one the algorithm will generate.
|
||||
"""
|
||||
provider = SimpleEmbeddingProvider(dimension=384)
|
||||
client = AsyncQdrantClient(":memory:")
|
||||
collection = get_settings().get_collection_name()
|
||||
|
||||
# The production collection uses a named "dense" vector (see
|
||||
# vector/qdrant_client.py); the semantic algorithm queries using="dense".
|
||||
await client.create_collection(
|
||||
collection_name=collection,
|
||||
vectors_config={"dense": VectorParams(size=384, distance=Distance.COSINE)},
|
||||
)
|
||||
|
||||
embedding = await provider.embed(_DOC_TEXT)
|
||||
points = []
|
||||
for point_id, doc_id, owner_id, user_id in (
|
||||
_ALICE_FILE,
|
||||
_CHARLIE_FILE,
|
||||
_LEGACY_DAVE_FILE,
|
||||
):
|
||||
payload = {
|
||||
"doc_id": doc_id,
|
||||
"doc_type": "file",
|
||||
"user_id": user_id,
|
||||
"is_placeholder": False,
|
||||
"file_path": f"docs/{doc_id}.txt",
|
||||
"title": f"file {doc_id}",
|
||||
"excerpt": _DOC_TEXT,
|
||||
"chunk_index": 0,
|
||||
"total_chunks": 1,
|
||||
}
|
||||
# Legacy points carry no owner_id at all.
|
||||
if owner_id is not None:
|
||||
payload["owner_id"] = owner_id
|
||||
points.append(
|
||||
PointStruct(id=point_id, vector={"dense": embedding}, payload=payload)
|
||||
)
|
||||
|
||||
await client.upsert(collection_name=collection, points=points, wait=True)
|
||||
|
||||
# Point the algorithm at the in-memory client + deterministic embeddings.
|
||||
monkeypatch.setattr(
|
||||
"nextcloud_mcp_server.search.semantic.get_qdrant_client",
|
||||
AsyncMock(return_value=client),
|
||||
)
|
||||
monkeypatch.setattr(
|
||||
"nextcloud_mcp_server.search.semantic.get_embedding_service",
|
||||
lambda: provider,
|
||||
)
|
||||
# get_indexed_doc_types reads the client from the algorithms module.
|
||||
monkeypatch.setattr(
|
||||
"nextcloud_mcp_server.search.algorithms.get_qdrant_client",
|
||||
AsyncMock(return_value=client),
|
||||
)
|
||||
# The cached-chunk lookups read the client from the context module.
|
||||
monkeypatch.setattr(
|
||||
"nextcloud_mcp_server.search.context.get_qdrant_client",
|
||||
AsyncMock(return_value=client),
|
||||
)
|
||||
|
||||
yield provider
|
||||
|
||||
await client.close()
|
||||
|
||||
|
||||
def _ids(results):
|
||||
return {r.id for r in results}
|
||||
|
||||
|
||||
async def test_shared_owner_is_visible_unshared_is_not(seeded_collection):
|
||||
"""Bob sees Alice's file (shared → owner in accessible_owners), not Charlie's."""
|
||||
algo = SemanticSearchAlgorithm(score_threshold=0.0)
|
||||
|
||||
results = await algo.search(
|
||||
query=_DOC_TEXT,
|
||||
user_id="bob",
|
||||
limit=10,
|
||||
doc_type="file",
|
||||
accessible_owners=["bob", "alice"],
|
||||
)
|
||||
|
||||
found = _ids(results)
|
||||
assert "101" in found, "Alice's shared file must be discoverable by Bob"
|
||||
assert "102" not in found, "Charlie's unshared file must NOT be visible to Bob"
|
||||
assert "103" not in found, "Legacy file owned by dave must NOT be visible to Bob"
|
||||
|
||||
|
||||
async def test_no_shares_sees_only_own(seeded_collection):
|
||||
"""With no shares, Bob (who owns nothing here) gets nothing."""
|
||||
algo = SemanticSearchAlgorithm(score_threshold=0.0)
|
||||
|
||||
results = await algo.search(
|
||||
query=_DOC_TEXT,
|
||||
user_id="bob",
|
||||
limit=10,
|
||||
doc_type="file",
|
||||
accessible_owners=["bob"],
|
||||
)
|
||||
|
||||
assert _ids(results) == set()
|
||||
|
||||
|
||||
async def test_legacy_user_id_point_still_found_by_indexer(seeded_collection):
|
||||
"""A pre-owner_id point stays findable by its original indexer via the
|
||||
legacy ``user_id`` OR-branch in build_ownership_filter."""
|
||||
algo = SemanticSearchAlgorithm(score_threshold=0.0)
|
||||
|
||||
results = await algo.search(
|
||||
query=_DOC_TEXT,
|
||||
user_id="dave",
|
||||
limit=10,
|
||||
doc_type="file",
|
||||
accessible_owners=["dave"],
|
||||
)
|
||||
|
||||
found = _ids(results)
|
||||
assert "103" in found, "dave must still find his own legacy (user_id-only) file"
|
||||
assert "101" not in found
|
||||
assert "102" not in found
|
||||
|
||||
|
||||
async def test_owner_sees_own_new_style_point(seeded_collection):
|
||||
"""Alice finds her own file via the owner_id branch."""
|
||||
algo = SemanticSearchAlgorithm(score_threshold=0.0)
|
||||
|
||||
results = await algo.search(
|
||||
query=_DOC_TEXT,
|
||||
user_id="alice",
|
||||
limit=10,
|
||||
doc_type="file",
|
||||
accessible_owners=["alice"],
|
||||
)
|
||||
|
||||
found = _ids(results)
|
||||
assert "101" in found
|
||||
assert "102" not in found
|
||||
assert "103" not in found
|
||||
|
||||
|
||||
async def test_get_indexed_doc_types_is_acl_aware(seeded_collection):
|
||||
"""get_indexed_doc_types respects the ownership scope: with the expanded
|
||||
accessible_owners Bob discovers the shared "file" type, but self-only Bob
|
||||
(who owns nothing here) discovers nothing — proving it is no longer
|
||||
ACL-blind."""
|
||||
# ACL-aware: Bob can read Alice's shared file → discovers "file".
|
||||
assert await get_indexed_doc_types("bob", accessible_owners=["bob", "alice"]) == {
|
||||
"file"
|
||||
}
|
||||
# Self-only (default): Bob owns nothing here → discovers nothing.
|
||||
assert await get_indexed_doc_types("bob") == set()
|
||||
|
||||
|
||||
async def test_cached_chunk_lookup_is_acl_aware(seeded_collection):
|
||||
"""The cached-chunk Qdrant lookup honours accessible_owners: Bob retrieves
|
||||
the excerpt of Alice's file point (owner_id=alice, chunk_index=0) when alice
|
||||
is in his accessible owners, but not when scoped self-only. This is the
|
||||
Qdrant-layer half of cross-user file chunk context (the per-file access
|
||||
gate lives in get_chunk_with_context / file_accessible_by_id)."""
|
||||
# Alice's seeded file point (_ALICE_FILE) carries excerpt=_DOC_TEXT at chunk 0.
|
||||
text = await _get_chunk_by_index_from_qdrant(
|
||||
"bob", "101", "file", 0, accessible_owners=["bob", "alice"]
|
||||
)
|
||||
assert text == _DOC_TEXT
|
||||
# Self-only Bob cannot reach Alice's cached chunk.
|
||||
assert await _get_chunk_by_index_from_qdrant("bob", "101", "file", 0) is None
|
||||
@@ -0,0 +1,271 @@
|
||||
"""End-to-end ACL-aware semantic search against a real Nextcloud (PR #813).
|
||||
|
||||
This is the card-120 acceptance criterion exercised across the *new* code
|
||||
paths together:
|
||||
|
||||
1. ``list_accessible_owners`` resolves the querying user's real OCS shares into
|
||||
the set of owner UIDs they may search.
|
||||
2. ``SemanticSearchAlgorithm`` applies the expanded ownership filter in Qdrant.
|
||||
3. ``verify_search_results`` re-checks each hit against real Nextcloud
|
||||
(ACL-aware, by global file id).
|
||||
|
||||
Qdrant is in-memory and seeded directly with one point owned by *alice* — this
|
||||
deliberately stands in for the background scanner (whose only relevant change
|
||||
is writing ``owner_id`` into the payload, covered separately). Nextcloud itself
|
||||
is real, so the share lookup (step 1) and the verification (step 3) exercise
|
||||
the live OCS Sharing + WebDAV APIs. The result: bob, with whom alice shared the
|
||||
file, finds it without having indexed anything; diana, with no share, does not.
|
||||
|
||||
The pure-filter matrix lives in ``test_acl_owner_filter.py`` and the
|
||||
verification layer in ``test_verify_on_read.py``; this test is the glue that
|
||||
proves the real share → accessible_owners → filter → verify chain.
|
||||
"""
|
||||
|
||||
import os
|
||||
import uuid
|
||||
from unittest.mock import AsyncMock
|
||||
|
||||
import pytest
|
||||
from httpx import BasicAuth
|
||||
from qdrant_client import AsyncQdrantClient
|
||||
from qdrant_client.models import Distance, PointStruct, VectorParams
|
||||
|
||||
from nextcloud_mcp_server.client import NextcloudClient
|
||||
from nextcloud_mcp_server.config import get_settings
|
||||
from nextcloud_mcp_server.embedding import SimpleEmbeddingProvider
|
||||
from nextcloud_mcp_server.search.access_filter import (
|
||||
clear_accessible_owners_cache,
|
||||
list_accessible_owners,
|
||||
)
|
||||
from nextcloud_mcp_server.search.context import get_chunk_with_context
|
||||
from nextcloud_mcp_server.search.semantic import SemanticSearchAlgorithm
|
||||
from nextcloud_mcp_server.search.verification import verify_search_results
|
||||
|
||||
pytestmark = pytest.mark.integration
|
||||
|
||||
|
||||
@pytest.fixture(autouse=True)
|
||||
def _reset_owners_cache():
|
||||
"""Reset the process-global accessible-owners cache around each test so a
|
||||
real OCS share created in a fixture isn't masked by a stale cached entry."""
|
||||
clear_accessible_owners_cache()
|
||||
yield
|
||||
clear_accessible_owners_cache()
|
||||
|
||||
|
||||
_DOC_TEXT = "Confidential quarterly infrastructure budget and capacity plan"
|
||||
|
||||
|
||||
def _user_client(username: str, password: str) -> NextcloudClient:
|
||||
return NextcloudClient(
|
||||
base_url=os.environ["NEXTCLOUD_HOST"],
|
||||
username=username,
|
||||
auth=BasicAuth(username, password),
|
||||
password=password,
|
||||
)
|
||||
|
||||
|
||||
@pytest.fixture
|
||||
async def acl_users(test_users_setup):
|
||||
"""alice (owner), bob (recipient), diana (no access) direct clients."""
|
||||
clients = {
|
||||
name: _user_client(name, test_users_setup[name]["password"])
|
||||
for name in ("alice", "bob", "diana")
|
||||
}
|
||||
try:
|
||||
yield clients
|
||||
finally:
|
||||
for c in clients.values():
|
||||
await c._client.aclose()
|
||||
|
||||
|
||||
@pytest.fixture
|
||||
async def shared_file(acl_users):
|
||||
"""alice creates a nested file and shares it with bob (not diana).
|
||||
|
||||
Yields (file_id, owner_relative_path); cleans up the directory after.
|
||||
"""
|
||||
alice = acl_users["alice"]
|
||||
suffix = uuid.uuid4().hex[:8]
|
||||
test_dir = f"acl_e2e_{suffix}"
|
||||
nested = f"{test_dir}/reports"
|
||||
path = f"{nested}/budget.txt"
|
||||
|
||||
await alice.webdav.create_directory(test_dir)
|
||||
await alice.webdav.create_directory(nested)
|
||||
await alice.webdav.write_file(path, _DOC_TEXT.encode(), "text/plain")
|
||||
file_id = (await alice.webdav.get_file_info(path))["id"]
|
||||
await alice.sharing.create_share(
|
||||
path=f"/{path}", share_with="bob", share_type=0, permissions=1
|
||||
)
|
||||
try:
|
||||
yield file_id, path
|
||||
finally:
|
||||
await alice.webdav.delete_resource(test_dir)
|
||||
|
||||
|
||||
@pytest.fixture
|
||||
async def seeded_semantic(monkeypatch, shared_file):
|
||||
"""In-memory Qdrant carrying alice's file point, wired into the algorithm.
|
||||
|
||||
Stands in for the background scanner: the point carries ``owner_id=alice``
|
||||
exactly as the scanner now writes it.
|
||||
"""
|
||||
file_id, path = shared_file
|
||||
provider = SimpleEmbeddingProvider(dimension=384)
|
||||
client = AsyncQdrantClient(":memory:")
|
||||
collection = get_settings().get_collection_name()
|
||||
await client.create_collection(
|
||||
collection_name=collection,
|
||||
vectors_config={"dense": VectorParams(size=384, distance=Distance.COSINE)},
|
||||
)
|
||||
await client.upsert(
|
||||
collection_name=collection,
|
||||
points=[
|
||||
PointStruct(
|
||||
id=int(file_id),
|
||||
vector={"dense": await provider.embed(_DOC_TEXT)},
|
||||
payload={
|
||||
"doc_id": str(file_id),
|
||||
"doc_type": "file",
|
||||
"owner_id": "alice",
|
||||
"user_id": "alice",
|
||||
"is_placeholder": False,
|
||||
"file_path": path,
|
||||
"title": "budget.txt",
|
||||
"excerpt": _DOC_TEXT,
|
||||
"chunk_index": 0,
|
||||
"total_chunks": 1,
|
||||
},
|
||||
)
|
||||
],
|
||||
wait=True,
|
||||
)
|
||||
|
||||
monkeypatch.setattr(
|
||||
"nextcloud_mcp_server.search.semantic.get_qdrant_client",
|
||||
AsyncMock(return_value=client),
|
||||
)
|
||||
monkeypatch.setattr(
|
||||
"nextcloud_mcp_server.search.semantic.get_embedding_service",
|
||||
lambda: provider,
|
||||
)
|
||||
# The cached-chunk lookups (get_chunk_with_context) read the client from the
|
||||
# context module — point it at the same in-memory Qdrant.
|
||||
monkeypatch.setattr(
|
||||
"nextcloud_mcp_server.search.context.get_qdrant_client",
|
||||
AsyncMock(return_value=client),
|
||||
)
|
||||
yield file_id
|
||||
await client.close()
|
||||
|
||||
|
||||
async def _search_as(user_client, file_id_unused) -> list:
|
||||
"""Run the full new chain (share lookup → filter → verify) as a user."""
|
||||
accessible_owners = await list_accessible_owners(
|
||||
user_client.sharing, user_client.username
|
||||
)
|
||||
algo = SemanticSearchAlgorithm(score_threshold=0.0)
|
||||
unverified = await algo.search(
|
||||
query=_DOC_TEXT,
|
||||
user_id=user_client.username,
|
||||
limit=10,
|
||||
doc_type="file",
|
||||
accessible_owners=accessible_owners,
|
||||
)
|
||||
kept, _dropped = await verify_search_results(user_client, unverified)
|
||||
return kept
|
||||
|
||||
|
||||
async def test_recipient_finds_shared_file_without_indexing(acl_users, seeded_semantic):
|
||||
"""Bob finds alice's shared file end-to-end: real share lookup expands his
|
||||
accessible owners to include alice, the filter surfaces her point, and
|
||||
real verification confirms his ACL access — all without bob indexing."""
|
||||
file_id = seeded_semantic
|
||||
# Sanity: the live OCS lookup really does expand bob to include alice.
|
||||
owners = await list_accessible_owners(acl_users["bob"].sharing, "bob")
|
||||
assert "alice" in owners, "OCS shared-with-me must surface alice as an owner"
|
||||
|
||||
kept = await _search_as(acl_users["bob"], file_id)
|
||||
|
||||
assert [r.id for r in kept] == [str(file_id)], (
|
||||
"bob must find alice's shared file via semantic search"
|
||||
)
|
||||
|
||||
|
||||
async def test_non_recipient_does_not_find_file(acl_users, seeded_semantic):
|
||||
"""Diana, with no share, never sees the file: her accessible-owners set
|
||||
excludes alice, so the ownership filter drops the point before verification."""
|
||||
owners = await list_accessible_owners(acl_users["diana"].sharing, "diana")
|
||||
assert "alice" not in owners
|
||||
|
||||
kept = await _search_as(acl_users["diana"], seeded_semantic)
|
||||
|
||||
assert kept == [], "diana (no share) must not find alice's file"
|
||||
|
||||
|
||||
async def test_file_accessible_by_id_resolves_shares(acl_users, shared_file):
|
||||
"""Lock the verify-on-read contract directly on ``file_accessible_by_id``.
|
||||
|
||||
The WebDAV SEARCH-by-fileid with ``scope=""`` must resolve a file that the
|
||||
caller does NOT own but which is shared with them. This is the exact check
|
||||
verify-on-read depends on for shared, nested files; a Nextcloud change to
|
||||
how ``scope=""`` is interpreted would otherwise silently break ACL-aware
|
||||
verification. The file lives in a subfolder, so a path-based check would
|
||||
404 for the recipient — only the by-id SEARCH gets it right.
|
||||
"""
|
||||
file_id, _path = shared_file
|
||||
fid = int(file_id)
|
||||
|
||||
# Owner and share recipient can both reach it...
|
||||
assert await acl_users["alice"].webdav.file_accessible_by_id(fid) is True
|
||||
assert await acl_users["bob"].webdav.file_accessible_by_id(fid) is True
|
||||
# ...the non-recipient cannot.
|
||||
assert await acl_users["diana"].webdav.file_accessible_by_id(fid) is False
|
||||
|
||||
|
||||
async def test_cross_user_file_chunk_context(acl_users, seeded_semantic):
|
||||
"""End-to-end cross-user FILE chunk context: Bob (a share recipient) gets
|
||||
Alice's cached chunk text, Diana (no share) gets None.
|
||||
|
||||
Exercises the full secure path: the ACL-aware Qdrant cached-chunk lookup
|
||||
(owner_id=alice surfaces for Bob) gated by a real per-file
|
||||
``file_accessible_by_id`` check against live Nextcloud. Diana fails the gate
|
||||
and is denied even though the chunk is cached. Per-user types are covered by
|
||||
the self-only behaviour elsewhere — this is the file path the feature adds.
|
||||
"""
|
||||
file_id = seeded_semantic
|
||||
bob = acl_users["bob"]
|
||||
diana = acl_users["diana"]
|
||||
|
||||
bob_owners = await list_accessible_owners(bob.sharing, "bob")
|
||||
assert "alice" in bob_owners
|
||||
|
||||
ctx = await get_chunk_with_context(
|
||||
nc_client=bob,
|
||||
user_id="bob",
|
||||
doc_id=str(file_id),
|
||||
doc_type="file",
|
||||
chunk_start=0,
|
||||
chunk_end=len(_DOC_TEXT),
|
||||
chunk_index=0,
|
||||
total_chunks=1,
|
||||
accessible_owners=bob_owners,
|
||||
)
|
||||
assert ctx is not None, "Bob (share recipient) must get Alice's cached chunk"
|
||||
assert ctx.chunk_text == _DOC_TEXT
|
||||
|
||||
# Diana has no share → per-file gate denies even though the chunk is cached.
|
||||
diana_owners = await list_accessible_owners(diana.sharing, "diana")
|
||||
denied = await get_chunk_with_context(
|
||||
nc_client=diana,
|
||||
user_id="diana",
|
||||
doc_id=str(file_id),
|
||||
doc_type="file",
|
||||
chunk_start=0,
|
||||
chunk_end=len(_DOC_TEXT),
|
||||
chunk_index=0,
|
||||
total_chunks=1,
|
||||
accessible_owners=diana_owners,
|
||||
)
|
||||
assert denied is None, "Diana (no share) must not get cross-user chunk context"
|
||||
@@ -133,7 +133,6 @@ async def test_chunk_context_endpoint_uses_app_password(
|
||||
try:
|
||||
await login_to_nextcloud(page, username, password)
|
||||
auth_result = await complete_astrolabe_authorization(page, username, password)
|
||||
assert auth_result["step1"], "OAuth authorization did not complete"
|
||||
assert auth_result["step2"], "App password provisioning did not complete"
|
||||
|
||||
auth_header = _build_basic_auth_header(username, password)
|
||||
|
||||
@@ -1,139 +0,0 @@
|
||||
"""Integration test for Astrolabe's "Enable Semantic Search" OAuth flow on
|
||||
the `mcp-login-flow` profile.
|
||||
|
||||
Cross-system interface test. Brings together Astrolabe (Nextcloud PHP app
|
||||
installed at container start by ``app-hooks/post-installation``) with the
|
||||
``mcp-login-flow`` MCP server over OAuth + the management API. Mirrors
|
||||
the production-shaped flow that PR #773's recent
|
||||
`ALLOWED_MGMT_CLIENT` ↔ `astrolabeMcpClientOAuth00000000000` drift was
|
||||
masking — every management API call from Astrolabe (e.g.
|
||||
``/api/v1/users/admin/session``) was returning 401 because the
|
||||
real-deployment client id was not in the test-fixture allowlist, so the
|
||||
Astrolabe settings page never updated to reflect a successful
|
||||
authorization.
|
||||
|
||||
This test is **regression coverage** for that class of drift. If the
|
||||
Astrolabe client id ever falls out of `mcp-login-flow`'s
|
||||
``ALLOWED_MGMT_CLIENT`` again, the post-redirect assertions here will
|
||||
fail because the page state stays on ``oauth-required.php``.
|
||||
|
||||
Requires the login-flow stack to be running:
|
||||
|
||||
MCP_SERVER_URL=http://mcp-login-flow:8004 \\
|
||||
docker compose --profile login-flow up -d app db mcp-login-flow
|
||||
|
||||
The ``app-hooks/before-starting/26-configure-astrolabe-oauth.sh`` hook
|
||||
creates the OAuth client with the production-shaped id
|
||||
``astrolabeMcpClientOAuth00000000000`` automatically when
|
||||
``MCP_SERVER_URL`` is set, so no fixture-level OIDC client creation is
|
||||
needed here.
|
||||
"""
|
||||
|
||||
import logging
|
||||
import os
|
||||
import re
|
||||
|
||||
import pytest
|
||||
from playwright.async_api import Page
|
||||
|
||||
# Reuse helpers from the multi-user-basic Astrolabe test for login + nav.
|
||||
from tests.integration.test_astrolabe_multi_user_background_sync import (
|
||||
login_to_nextcloud,
|
||||
navigate_to_astrolabe_settings,
|
||||
)
|
||||
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
pytestmark = [pytest.mark.integration, pytest.mark.login_flow]
|
||||
|
||||
NEXTCLOUD_URL = "http://localhost:8080"
|
||||
ASTROLABE_SETTINGS_URL = f"{NEXTCLOUD_URL}/settings/user/astrolabe"
|
||||
|
||||
|
||||
async def _click_enable_semantic_search(page: Page) -> None:
|
||||
"""Click the "Enable Semantic Search" OAuth link on the
|
||||
``oauth-required.php`` template that login-flow mode renders to a
|
||||
not-yet-authorized user.
|
||||
|
||||
Astrolabe's own e2e helper (``third_party/astrolabe/tests/e2e/helpers/
|
||||
authorize.ts``) targets the same link by accessible name.
|
||||
"""
|
||||
enable_link = page.get_by_role("link", name="Enable Semantic Search")
|
||||
await enable_link.wait_for(state="visible", timeout=10_000)
|
||||
logger.info("Clicking 'Enable Semantic Search' OAuth link")
|
||||
await enable_link.click()
|
||||
|
||||
|
||||
async def _grant_oidc_consent(page: Page) -> None:
|
||||
"""Click "Allow" on the Nextcloud OIDC consent screen, if shown.
|
||||
|
||||
Nextcloud may auto-redirect for already-trusted clients, in which
|
||||
case the consent button never appears — that's not an error.
|
||||
"""
|
||||
allow_button = page.get_by_role("button", name=re.compile(r"^allow$", re.I))
|
||||
try:
|
||||
await allow_button.wait_for(state="visible", timeout=10_000)
|
||||
logger.info("Clicking 'Allow' on OIDC consent")
|
||||
await allow_button.click(force=True)
|
||||
except Exception:
|
||||
logger.info(
|
||||
"OIDC consent screen not visible — assuming auto-grant for "
|
||||
"already-trusted client"
|
||||
)
|
||||
|
||||
|
||||
@pytest.mark.timeout(180)
|
||||
async def test_enable_semantic_search_completes_oauth_for_login_flow(browser):
|
||||
"""Click the "Enable Semantic Search" link, grant consent, and assert
|
||||
the post-redirect page reflects a completed authorization.
|
||||
|
||||
The success criterion is intentionally negative: after the OAuth
|
||||
flow, the original "Enable Semantic Search" link must be gone. If
|
||||
Astrolabe's management API call is rejected by the MCP server (HTTP
|
||||
401, the original bug), the page falls back to the same
|
||||
``oauth-required.php`` template and the link reappears — making this
|
||||
test the canary for the drift class.
|
||||
"""
|
||||
admin_password = os.getenv("NEXTCLOUD_PASSWORD")
|
||||
if admin_password is None:
|
||||
raise RuntimeError("NEXTCLOUD_PASSWORD must be set")
|
||||
page = await browser.new_page()
|
||||
try:
|
||||
await login_to_nextcloud(page, "admin", admin_password)
|
||||
await navigate_to_astrolabe_settings(page)
|
||||
|
||||
# Sanity-check we're on the not-yet-authorized template.
|
||||
enable_link = page.get_by_role("link", name="Enable Semantic Search")
|
||||
if await enable_link.count() == 0:
|
||||
pytest.skip(
|
||||
"Astrolabe is already authorized for admin (oauth-required.php "
|
||||
"not rendered). Reset by clearing the user's OAuth tokens "
|
||||
"before re-running this test."
|
||||
)
|
||||
|
||||
await _click_enable_semantic_search(page)
|
||||
await _grant_oidc_consent(page)
|
||||
|
||||
# OAuth callback returns to /apps/astrolabe/oauth/callback then the
|
||||
# controller redirects to /settings/user/astrolabe.
|
||||
await page.wait_for_url(re.compile(r"/settings/user/astrolabe"), timeout=30_000)
|
||||
await page.wait_for_load_state("networkidle", timeout=15_000)
|
||||
|
||||
# Regression assertion for the ALLOWED_MGMT_CLIENT drift bug:
|
||||
# the page must have moved past oauth-required.php. If
|
||||
# Astrolabe's management API call to /api/v1/users/{id}/session
|
||||
# is rejected (401), the session lookup falls back to "no token",
|
||||
# and the same oauth-required.php template re-renders with the
|
||||
# link still present.
|
||||
post_auth_count = await page.get_by_role(
|
||||
"link", name="Enable Semantic Search"
|
||||
).count()
|
||||
assert post_auth_count == 0, (
|
||||
"'Enable Semantic Search' link still visible after completing "
|
||||
"OAuth flow — Astrolabe could not read the user's session from "
|
||||
"the MCP server. Most likely cause: "
|
||||
"`astrolabeMcpClientOAuth00000000000` missing from "
|
||||
"`ALLOWED_MGMT_CLIENT` on `mcp-login-flow`."
|
||||
)
|
||||
finally:
|
||||
await page.close()
|
||||
@@ -7,19 +7,19 @@ lives in a separate repository (https://github.com/cbcoutinho/astrolabe).
|
||||
|
||||
This test verifies that multiple users can independently:
|
||||
1. Log in to Nextcloud
|
||||
2. Generate an app password in Security settings
|
||||
3. Enter the app password in Astrolabe personal settings
|
||||
4. Enable background sync for the mcp-multi-user-basic service
|
||||
5. Verify app password is stored in the database
|
||||
2. Click the one-click "Enable background indexing" opt-in in Astrolabe settings
|
||||
3. Have a dedicated app password minted from their session and handed to the
|
||||
MCP server (core/getapppassword — no Security-settings step, no copy-paste)
|
||||
4. Verify the app password is stored in the database
|
||||
|
||||
Tests the complete app password provisioning flow:
|
||||
user login → Security settings → app password generation → Astrolabe settings →
|
||||
app password entry → background sync activation → database verification.
|
||||
Tests the one-click background-indexing provisioning flow:
|
||||
user login → Astrolabe settings → Enable background indexing → session app
|
||||
password minted + forwarded to MCP → background sync active → DB verification.
|
||||
"""
|
||||
|
||||
import logging
|
||||
import re
|
||||
import subprocess
|
||||
import tempfile
|
||||
|
||||
import anyio
|
||||
import pytest
|
||||
@@ -91,621 +91,64 @@ async def navigate_to_astrolabe_settings(page: Page):
|
||||
logger.info("✓ Successfully loaded Astrolabe settings page")
|
||||
|
||||
|
||||
async def authorize_search_access(page: Page, username: str) -> bool:
|
||||
"""Complete Step 1: OAuth Authorization for Astrolabe.
|
||||
async def enable_background_sync(page: Page, username: str) -> bool:
|
||||
"""Provision background indexing via the one-click opt-in button.
|
||||
|
||||
Handles the OAuth flow:
|
||||
1. Check if already authorized (Step 1 shows "Complete")
|
||||
2. Click "Authorize" link
|
||||
3. Handle Nextcloud OIDC consent screen
|
||||
4. Wait for redirect back to Astrolabe settings
|
||||
5. Verify "Complete" badge appears on Step 1
|
||||
The refactored settings page mints a dedicated app password from the
|
||||
current Nextcloud session (core/getapppassword) and hands it to the MCP
|
||||
server — there is no app-password generation in Security settings and no
|
||||
copy-paste. Idempotent: if already enabled (the revoke form is shown
|
||||
instead of the enable button), returns True without acting.
|
||||
|
||||
Args:
|
||||
page: Playwright page instance (must be on Astrolabe settings page)
|
||||
username: Username for logging
|
||||
|
||||
Returns:
|
||||
True if authorization completed successfully
|
||||
"""
|
||||
nextcloud_url = "http://localhost:8080"
|
||||
|
||||
logger.info("Authorizing search access (Step 1) for %s...", username)
|
||||
|
||||
# Check if already on Astrolabe settings page, if not navigate there
|
||||
if "/settings/user/astrolabe" not in page.url:
|
||||
await navigate_to_astrolabe_settings(page)
|
||||
|
||||
# Wait for page to fully render
|
||||
await anyio.sleep(1)
|
||||
|
||||
# Check if already authorized (either "Active" badge or Step 1 "Complete" badge)
|
||||
try:
|
||||
# Check for "Active" badge (fully configured state)
|
||||
active_badge = page.get_by_text("Active", exact=True)
|
||||
if await active_badge.count() > 0 and await active_badge.is_visible():
|
||||
logger.info("✓ Already fully authorized for %s (Active badge)", username)
|
||||
return True
|
||||
except Exception:
|
||||
pass
|
||||
|
||||
try:
|
||||
step1_section = page.locator('h4:has-text("Step 1")')
|
||||
if await step1_section.count() > 0:
|
||||
# Look for "Complete" text in the Step 1 section's parent
|
||||
step1_parent = step1_section.locator("..")
|
||||
complete_badge = step1_parent.get_by_text("Complete", exact=True)
|
||||
if await complete_badge.count() > 0 and await complete_badge.is_visible():
|
||||
logger.info("✓ Step 1 already complete for %s", username)
|
||||
return True
|
||||
except Exception:
|
||||
pass
|
||||
|
||||
# Find and click the "Authorize" button
|
||||
authorize_button = page.locator('a.button.primary:has-text("Authorize")')
|
||||
|
||||
try:
|
||||
await authorize_button.wait_for(timeout=5000, state="visible")
|
||||
logger.info("Found Authorize button for %s", username)
|
||||
except Exception:
|
||||
# Take screenshot for debugging
|
||||
screenshot_path = f"/tmp/astrolabe_no_authorize_button_{username}.png"
|
||||
await page.screenshot(path=screenshot_path)
|
||||
logger.error(
|
||||
"Could not find Authorize button for %s. Screenshot: %s",
|
||||
username,
|
||||
screenshot_path,
|
||||
)
|
||||
raise ValueError(f"Authorize button not found for {username}")
|
||||
|
||||
# Click the Authorize button - this will redirect to OAuth provider
|
||||
# Use force=True to bypass stability check which can timeout due to CSS transitions
|
||||
await authorize_button.click(force=True)
|
||||
logger.info("Clicked Authorize button for %s", username)
|
||||
|
||||
# Wait for OAuth redirect to complete
|
||||
await page.wait_for_load_state("networkidle", timeout=30000)
|
||||
logger.info("After networkidle, current URL: %s", page.url)
|
||||
|
||||
# Take screenshot to see current state
|
||||
await page.screenshot(path=f"/tmp/astrolabe_after_authorize_{username}.png")
|
||||
logger.info("Screenshot saved: /tmp/astrolabe_after_authorize_%s.png", username)
|
||||
|
||||
# Handle OIDC consent screen if present
|
||||
consent_handled = await _handle_oauth_consent_screen(page, username)
|
||||
if consent_handled:
|
||||
logger.info("✓ OAuth consent granted for %s", username)
|
||||
else:
|
||||
logger.info(
|
||||
"No consent screen required for %s (may be previously authorized)", username
|
||||
)
|
||||
|
||||
# Wait for redirect back to Astrolabe settings
|
||||
# The OAuth callback will redirect back to /settings/user/astrolabe
|
||||
try:
|
||||
await page.wait_for_url(
|
||||
f"**{nextcloud_url}/settings/user/astrolabe**", timeout=30000
|
||||
)
|
||||
logger.info("Redirected back to Astrolabe settings for %s", username)
|
||||
except Exception:
|
||||
# Check if we're already on settings page
|
||||
if "/settings/user/astrolabe" not in page.url:
|
||||
logger.warning(
|
||||
"Not redirected to Astrolabe settings, current URL: %s", page.url
|
||||
)
|
||||
# Navigate manually
|
||||
await page.goto(
|
||||
f"{nextcloud_url}/settings/user/astrolabe", wait_until="networkidle"
|
||||
)
|
||||
|
||||
# Wait for page to reload and render
|
||||
await anyio.sleep(2)
|
||||
|
||||
# Verify authorization completed - check for various success indicators
|
||||
# When fully configured, shows "Active" badge; when only Step 1 done, shows "Complete"
|
||||
try:
|
||||
# First check if "Active" badge is shown (fully configured state)
|
||||
active_badge = page.get_by_text("Active", exact=True)
|
||||
if await active_badge.count() > 0 and await active_badge.is_visible():
|
||||
logger.info(
|
||||
"✓ OAuth authorization complete for %s (Active badge)", username
|
||||
)
|
||||
return True
|
||||
except Exception:
|
||||
pass
|
||||
|
||||
try:
|
||||
# Check for Step 1 "Complete" badge (partial configuration)
|
||||
step1_section = page.locator('h4:has-text("Step 1")')
|
||||
if await step1_section.count() > 0:
|
||||
step1_parent = step1_section.locator("..")
|
||||
complete_badge = step1_parent.get_by_text("Complete", exact=True)
|
||||
await complete_badge.wait_for(timeout=5000, state="visible")
|
||||
logger.info("✓ Step 1 OAuth authorization complete for %s", username)
|
||||
return True
|
||||
except Exception:
|
||||
pass
|
||||
|
||||
# Neither badge found - authorization failed
|
||||
screenshot_path = f"/tmp/astrolabe_step1_not_complete_{username}.png"
|
||||
await page.screenshot(path=screenshot_path)
|
||||
logger.error(
|
||||
"Authorization badge not visible for %s. Screenshot: %s",
|
||||
username,
|
||||
screenshot_path,
|
||||
)
|
||||
raise ValueError(f"OAuth authorization did not complete for {username}")
|
||||
|
||||
|
||||
async def _handle_oauth_consent_screen(page: Page, username: str) -> bool:
|
||||
"""Handle the OIDC consent screen during OAuth flow.
|
||||
|
||||
Reuses the proven pattern from tests/conftest.py.
|
||||
|
||||
Args:
|
||||
page: Playwright page instance
|
||||
username: Username for logging
|
||||
|
||||
Returns:
|
||||
True if consent was handled, False if no consent screen was found
|
||||
"""
|
||||
try:
|
||||
logger.info("Checking for consent screen at URL: %s", page.url)
|
||||
|
||||
# Check if consent screen is present - try multiple selectors
|
||||
# The consent screen may be #oidc-consent or use a different format
|
||||
consent_div = await page.query_selector("#oidc-consent")
|
||||
|
||||
if consent_div:
|
||||
logger.info("Consent screen detected via #oidc-consent for %s", username)
|
||||
# Get consent screen data attributes for logging
|
||||
client_name = await consent_div.get_attribute("data-client-name")
|
||||
scopes_attr = await consent_div.get_attribute("data-scopes")
|
||||
logger.info(" Client: %s", client_name)
|
||||
logger.info(" Requested scopes: %s", scopes_attr)
|
||||
else:
|
||||
# Check for Allow button directly (different consent screen format)
|
||||
allow_button = page.locator('button:has-text("Allow")')
|
||||
if await allow_button.count() > 0:
|
||||
logger.info("Consent screen detected via Allow button for %s", username)
|
||||
else:
|
||||
logger.info("No consent screen found for %s at %s", username, page.url)
|
||||
await page.screenshot(path=f"/tmp/no_consent_screen_{username}.png")
|
||||
logger.info("Screenshot: /tmp/no_consent_screen_%s.png", username)
|
||||
return False
|
||||
|
||||
# Wait for Vue.js to render the Allow button
|
||||
try:
|
||||
await page.wait_for_selector('button:has-text("Allow")', timeout=10000)
|
||||
logger.info(" Allow button rendered by Vue.js")
|
||||
except Exception as e:
|
||||
screenshot_path = f"/tmp/consent_no_allow_button_{username}.png"
|
||||
await page.screenshot(path=screenshot_path)
|
||||
logger.error(" Timeout waiting for Allow button: %s", e)
|
||||
raise
|
||||
|
||||
# Check all scope checkboxes
|
||||
scope_checkboxes = await page.query_selector_all('input[type="checkbox"]')
|
||||
if scope_checkboxes:
|
||||
logger.info(" Found %s scope checkboxes", len(scope_checkboxes))
|
||||
for i, checkbox in enumerate(scope_checkboxes):
|
||||
is_checked = await checkbox.is_checked()
|
||||
is_disabled = await checkbox.is_disabled()
|
||||
if not is_checked and not is_disabled:
|
||||
await checkbox.check()
|
||||
logger.info(" ✓ Checked scope checkbox %s", i + 1)
|
||||
|
||||
# Click the Allow button using JavaScript (handles viewport issues)
|
||||
allow_button_locator = page.locator('button:has-text("Allow")')
|
||||
|
||||
# Debug: take screenshot before clicking Allow
|
||||
await page.screenshot(path=f"/tmp/consent_before_allow_{username}.png")
|
||||
logger.info(
|
||||
" Screenshot before Allow: /tmp/consent_before_allow_%s.png", username
|
||||
)
|
||||
|
||||
button_count = await allow_button_locator.count()
|
||||
logger.info(" Found %s Allow button(s)", button_count)
|
||||
|
||||
if button_count > 0:
|
||||
current_url = page.url
|
||||
logger.info(" Current URL: %s", current_url)
|
||||
logger.info(" Clicking Allow button for %s...", username)
|
||||
|
||||
# Use JavaScript click to handle consent buttons (proven pattern from conftest.py)
|
||||
# This is more reliable than Playwright's click for Vue.js rendered buttons
|
||||
await page.evaluate(
|
||||
"""
|
||||
const buttons = document.querySelectorAll('button');
|
||||
for (const btn of buttons) {
|
||||
if (btn.textContent.trim() === 'Allow') {
|
||||
btn.click();
|
||||
break;
|
||||
}
|
||||
}
|
||||
"""
|
||||
)
|
||||
|
||||
# Wait for URL to change (Vue.js uses window.location.href after fetch)
|
||||
# networkidle doesn't detect fetch-based redirects
|
||||
try:
|
||||
await page.wait_for_url(
|
||||
lambda url: url != current_url,
|
||||
timeout=30000,
|
||||
)
|
||||
logger.info(" URL changed to: %s", page.url)
|
||||
except Exception as wait_error:
|
||||
# If URL didn't change, check console for errors
|
||||
logger.warning(" URL didn't change after click: %s", wait_error)
|
||||
await page.screenshot(path=f"/tmp/consent_after_allow_{username}.png")
|
||||
|
||||
# Try alternative: manually POST consent and navigate
|
||||
logger.info(" Trying manual consent submission...")
|
||||
try:
|
||||
redirect_url = await page.evaluate(
|
||||
"""
|
||||
async () => {
|
||||
const selectedScopes = Array.from(document.querySelectorAll('input[type="checkbox"]:checked'))
|
||||
.map(cb => cb.value).join(' ');
|
||||
|
||||
const response = await fetch('/index.php/apps/oidc/consent/grant', {
|
||||
method: 'POST',
|
||||
headers: {
|
||||
'Content-Type': 'application/x-www-form-urlencoded',
|
||||
'requesttoken': OC.requestToken,
|
||||
},
|
||||
body: 'scopes=' + encodeURIComponent(selectedScopes),
|
||||
redirect: 'follow',
|
||||
});
|
||||
|
||||
return response.url || '/index.php/apps/oidc/authorize';
|
||||
}
|
||||
"""
|
||||
)
|
||||
logger.info(" Manual consent returned URL: %s", redirect_url)
|
||||
await page.goto(redirect_url, wait_until="networkidle")
|
||||
except Exception as manual_error:
|
||||
logger.error(" Manual consent also failed: %s", manual_error)
|
||||
raise
|
||||
|
||||
await page.screenshot(path=f"/tmp/consent_after_allow_{username}.png")
|
||||
logger.info(" Consent granted for %s", username)
|
||||
return True
|
||||
else:
|
||||
logger.error(" Allow button not found for %s", username)
|
||||
return False
|
||||
|
||||
except Exception as e:
|
||||
logger.error("Error handling consent screen for %s: %s", username, e)
|
||||
raise
|
||||
|
||||
|
||||
async def generate_app_password(
|
||||
page: Page, username: str, app_name: str = "Astrolabe Background Sync"
|
||||
) -> str:
|
||||
"""Generate an app password in Nextcloud Security settings.
|
||||
|
||||
Args:
|
||||
page: Playwright page instance (must be authenticated)
|
||||
page: Playwright page instance (must be logged in)
|
||||
username: Username (for logging)
|
||||
app_name: Name for the app password
|
||||
|
||||
Returns:
|
||||
The generated app password string
|
||||
True once background indexing is enabled.
|
||||
"""
|
||||
logger.info("Generating app password for %s...", username)
|
||||
|
||||
nextcloud_url = "http://localhost:8080"
|
||||
|
||||
# Navigate to Security settings
|
||||
await page.goto(f"{nextcloud_url}/settings/user/security", wait_until="networkidle")
|
||||
logger.info("Navigated to Security settings")
|
||||
|
||||
# Fill the app password input field (selector confirmed via Playwright MCP)
|
||||
app_password_input = page.locator('input[placeholder="App name"]')
|
||||
await app_password_input.fill(app_name)
|
||||
logger.info("Entered app name: %s", app_name)
|
||||
|
||||
# Wait for Vue.js to react and enable the button (needs 1 second, not 0.5)
|
||||
await anyio.sleep(1.0)
|
||||
logger.info("Waited for Vue.js to process input and enable button")
|
||||
|
||||
# Click the create button - use force=True to bypass stability check (CSS transitions)
|
||||
create_button = page.locator(
|
||||
'button[type="submit"]:has-text("Create new app password")'
|
||||
)
|
||||
try:
|
||||
await create_button.click(force=True, timeout=10000)
|
||||
except Exception:
|
||||
# Fallback: JavaScript click
|
||||
logger.info("Using JavaScript click for create button...")
|
||||
await page.evaluate(
|
||||
"""
|
||||
const btn = document.querySelector('button[type="submit"]');
|
||||
if (btn) btn.click();
|
||||
"""
|
||||
)
|
||||
logger.info("Clicked create app password button")
|
||||
|
||||
# Wait for app password to be generated and displayed in the dialog
|
||||
await anyio.sleep(3) # Give it more time to generate and display
|
||||
|
||||
# Debug screenshot after clicking create
|
||||
await page.screenshot(path=f"/tmp/app_password_after_create_{username}.png")
|
||||
logger.info(
|
||||
"Screenshot after create: /tmp/app_password_after_create_%s.png", username
|
||||
)
|
||||
|
||||
# Find the Login input field which should have the username value
|
||||
# Then find the Password input field which is in the same form
|
||||
app_password = None
|
||||
try:
|
||||
# Wait for heading "New app password" to appear
|
||||
await page.wait_for_selector('text="New app password"', timeout=10000)
|
||||
logger.info("App password dialog appeared with heading")
|
||||
|
||||
# Get all visible input elements
|
||||
all_inputs = await page.locator('input[type="text"]').all()
|
||||
logger.info("Found %s text input elements", len(all_inputs))
|
||||
|
||||
# Check each input to find the one with the app password
|
||||
for idx, input_elem in enumerate(all_inputs):
|
||||
try:
|
||||
value = await input_elem.input_value()
|
||||
if value and "-" in value and len(value) > 20:
|
||||
app_password = value.strip()
|
||||
logger.info(
|
||||
"Found app password in input %s: '%s' (length: %s)",
|
||||
idx,
|
||||
app_password,
|
||||
len(app_password),
|
||||
)
|
||||
break
|
||||
except Exception as e:
|
||||
logger.debug("Could not get value from input %s: %s", idx, e)
|
||||
continue
|
||||
|
||||
except Exception as e:
|
||||
logger.error("Failed to find app password dialog or extract password: %s", e)
|
||||
|
||||
if not app_password:
|
||||
# Take screenshot for debugging
|
||||
screenshot_path = f"/tmp/app_password_generation_{username}.png"
|
||||
await page.screenshot(path=screenshot_path)
|
||||
raise ValueError(
|
||||
f"Could not find generated app password. Screenshot: {screenshot_path}"
|
||||
)
|
||||
|
||||
# Validate password format before returning
|
||||
|
||||
if not re.match(
|
||||
r"^[a-zA-Z0-9]{5}-[a-zA-Z0-9]{5}-[a-zA-Z0-9]{5}-[a-zA-Z0-9]{5}-[a-zA-Z0-9]{5}$",
|
||||
app_password,
|
||||
):
|
||||
logger.error(
|
||||
"Extracted password does not match expected format: '%s'", app_password
|
||||
)
|
||||
logger.error("Password repr: %s", repr(app_password))
|
||||
screenshot_path = f"/tmp/app_password_invalid_format_{username}.png"
|
||||
await page.screenshot(path=screenshot_path)
|
||||
raise ValueError(
|
||||
f"App password format validation failed. Screenshot: {screenshot_path}"
|
||||
)
|
||||
|
||||
logger.info(
|
||||
"✓ Generated app password for %s: %s... (validated)",
|
||||
username,
|
||||
app_password[:10],
|
||||
)
|
||||
|
||||
# Close dialog with Escape key (bypasses CSS layout issues with h2 intercepting clicks)
|
||||
logger.info("Closing app password dialog with Escape key...")
|
||||
await page.keyboard.press("Escape")
|
||||
await anyio.sleep(0.5) # Wait for dialog close animation
|
||||
logger.info("Closed app password dialog")
|
||||
|
||||
return app_password
|
||||
|
||||
|
||||
async def enable_background_sync_via_app_password(
|
||||
page: Page, username: str, app_password: str
|
||||
):
|
||||
"""Enable background sync by entering app password in Astrolabe settings.
|
||||
|
||||
Args:
|
||||
page: Playwright page instance
|
||||
username: Username (for logging)
|
||||
app_password: App password to enter
|
||||
|
||||
Returns:
|
||||
True if background sync was enabled successfully
|
||||
"""
|
||||
logger.info("Enabling background sync via app password for %s...", username)
|
||||
|
||||
nextcloud_url = "http://localhost:8080"
|
||||
|
||||
# Set up network request and console listeners BEFORE navigation
|
||||
network_requests = []
|
||||
network_responses = []
|
||||
console_messages = []
|
||||
|
||||
def log_request(req):
|
||||
network_requests.append(f"{req.method} {req.url}")
|
||||
|
||||
def log_response(resp):
|
||||
response_info = f"{resp.status} {resp.url}"
|
||||
network_responses.append(response_info)
|
||||
logger.info("Response: %s", response_info)
|
||||
|
||||
def log_console(msg):
|
||||
console_messages.append(f"[{msg.type}] {msg.text}")
|
||||
|
||||
page.on("request", log_request)
|
||||
page.on("response", log_response)
|
||||
page.on("console", log_console)
|
||||
|
||||
# Navigate to Astrolabe settings
|
||||
logger.info("Enabling background indexing for %s...", username)
|
||||
await page.goto(
|
||||
f"{nextcloud_url}/settings/user/astrolabe", wait_until="networkidle"
|
||||
"http://localhost:8080/settings/user/astrolabe", wait_until="networkidle"
|
||||
)
|
||||
|
||||
# Wait for page to load
|
||||
await anyio.sleep(1)
|
||||
|
||||
# Check if already complete (look for Step 2 "Complete" badge or overall "Active" state)
|
||||
try:
|
||||
# First check for overall "Active" badge (both steps complete)
|
||||
active_text = page.get_by_text("Active", exact=True)
|
||||
if await active_text.is_visible(timeout=2000):
|
||||
logger.info("✓ Background sync already active for %s", username)
|
||||
return True
|
||||
except Exception:
|
||||
pass
|
||||
if await page.locator("#mcp-revoke-background-button").count() > 0:
|
||||
logger.info("✓ Background indexing already enabled for %s", username)
|
||||
return True
|
||||
|
||||
try:
|
||||
# Check for Step 2 "Complete" badge (app password already set)
|
||||
step2_section = page.locator('h4:has-text("Step 2")')
|
||||
if await step2_section.count() > 0:
|
||||
step2_parent = step2_section.locator("..")
|
||||
complete_badge = step2_parent.get_by_text("Complete", exact=True)
|
||||
if await complete_badge.count() > 0 and await complete_badge.is_visible():
|
||||
logger.info("✓ Step 2 (app password) already complete for %s", username)
|
||||
return True
|
||||
except Exception:
|
||||
pass
|
||||
|
||||
# Find the app password input field using the placeholder text
|
||||
# Based on manual testing: textbox with placeholder "xxxxx-xxxxx-xxxxx-xxxxx-xxxxx"
|
||||
app_password_input = page.get_by_placeholder("xxxxx-xxxxx-xxxxx-xxxxx-xxxxx")
|
||||
enable_button = page.locator("#mcp-enable-background-button")
|
||||
await enable_button.wait_for(timeout=5000, state="visible")
|
||||
await enable_button.click()
|
||||
logger.info("Clicked 'Enable background indexing' for %s", username)
|
||||
|
||||
# On success the page JS reloads to the enabled state (revoke form shown).
|
||||
try:
|
||||
await app_password_input.wait_for(timeout=5000, state="visible")
|
||||
logger.info("Found app password input field")
|
||||
await page.locator("#mcp-revoke-background-button").wait_for(
|
||||
timeout=15000, state="visible"
|
||||
)
|
||||
logger.info("✓ Background indexing enabled for %s", username)
|
||||
return True
|
||||
except Exception:
|
||||
# Take screenshot for debugging
|
||||
screenshot_path = f"/tmp/astrolabe_no_password_field_{username}.png"
|
||||
screenshot_path = (
|
||||
f"{tempfile.gettempdir()}/astrolabe_enable_failed_{username}.png"
|
||||
)
|
||||
await page.screenshot(path=screenshot_path)
|
||||
raise ValueError(
|
||||
f"Could not find app password input field for {username}. Screenshot: {screenshot_path}"
|
||||
f"Background indexing did not enable for {username}. "
|
||||
f"Screenshot: {screenshot_path}"
|
||||
)
|
||||
|
||||
# Enter the app password
|
||||
await app_password_input.fill(app_password)
|
||||
logger.info("Entered app password for %s", username)
|
||||
|
||||
# Wait a moment for any validation to complete
|
||||
await anyio.sleep(0.5)
|
||||
|
||||
# Take screenshot before clicking Save to check for warnings
|
||||
screenshot_path = f"/tmp/before_save_{username}.png"
|
||||
await page.screenshot(path=screenshot_path)
|
||||
logger.info("Screenshot taken before Save: %s", screenshot_path)
|
||||
|
||||
# Find and click the Save button
|
||||
save_button = page.get_by_role("button", name="Save")
|
||||
|
||||
# Check if Save button is enabled
|
||||
is_disabled = await save_button.is_disabled()
|
||||
logger.info("Save button disabled state: %s", is_disabled)
|
||||
|
||||
await save_button.click()
|
||||
logger.info("Clicked Save button")
|
||||
|
||||
# Give the request time to complete before checking logs
|
||||
await anyio.sleep(0.5)
|
||||
|
||||
# Log network requests after clicking Save
|
||||
logger.info("Network requests after Save for %s:", username)
|
||||
for req in network_requests[-10:]: # Last 10 requests
|
||||
logger.info(" %s", req)
|
||||
|
||||
# Log network responses after clicking Save
|
||||
logger.info("Network responses after Save for %s:", username)
|
||||
for resp in network_responses[-10:]: # Last 10 responses
|
||||
logger.info(" %s", resp)
|
||||
|
||||
# Check specifically for the credentials POST response
|
||||
credentials_responses = [
|
||||
r for r in network_responses if "background-sync/credentials" in r
|
||||
]
|
||||
if credentials_responses:
|
||||
logger.info("Credentials endpoint response: %s", credentials_responses[-1])
|
||||
if "200" not in credentials_responses[-1]:
|
||||
logger.error(
|
||||
"Credentials POST did not return 200 OK: %s", credentials_responses[-1]
|
||||
)
|
||||
else:
|
||||
logger.warning("No response found for credentials endpoint!")
|
||||
|
||||
# Wait for the page to reload after successful save
|
||||
# The JavaScript in personalSettings.js does: setTimeout(() => window.location.reload(), 1000)
|
||||
await page.wait_for_load_state("networkidle", timeout=15000)
|
||||
await anyio.sleep(2)
|
||||
|
||||
# Log any console messages
|
||||
if console_messages:
|
||||
logger.info("Console messages for %s:", username)
|
||||
for msg in console_messages:
|
||||
logger.info(" %s", msg)
|
||||
|
||||
# Check for error notifications (toast messages)
|
||||
try:
|
||||
error_toast = page.locator(".toastify.toast-error, .toast-error")
|
||||
if await error_toast.count() > 0:
|
||||
error_text = await error_toast.first.text_content()
|
||||
logger.error("Error notification for %s: %s", username, error_text)
|
||||
except Exception:
|
||||
pass
|
||||
|
||||
# Verify Step 2 "Complete" badge or overall "Active" badge appears after reload
|
||||
try:
|
||||
# First try to find "Active" badge (both steps complete)
|
||||
active_text = page.get_by_text("Active", exact=True)
|
||||
if await active_text.count() > 0:
|
||||
await active_text.wait_for(timeout=5000, state="visible")
|
||||
logger.info(
|
||||
"✓ Background sync enabled for %s - Active badge visible", username
|
||||
)
|
||||
return True
|
||||
except Exception:
|
||||
pass
|
||||
|
||||
try:
|
||||
# Check for Step 2 "Complete" badge
|
||||
step2_section = page.locator('h4:has-text("Step 2")')
|
||||
if await step2_section.count() > 0:
|
||||
step2_parent = step2_section.locator("..")
|
||||
complete_badge = step2_parent.get_by_text("Complete", exact=True)
|
||||
await complete_badge.wait_for(timeout=5000, state="visible")
|
||||
logger.info(
|
||||
"✓ Step 2 (app password) enabled for %s - Complete badge visible",
|
||||
username,
|
||||
)
|
||||
return True
|
||||
except Exception:
|
||||
pass
|
||||
|
||||
# If neither badge found, raise error
|
||||
screenshot_path = f"/tmp/astrolabe_after_password_{username}.png"
|
||||
await page.screenshot(path=screenshot_path)
|
||||
logger.error(
|
||||
"Neither Active nor Complete badge appeared for %s. Screenshot: %s",
|
||||
username,
|
||||
screenshot_path,
|
||||
)
|
||||
raise ValueError(f"Background sync setup did not complete for {username}")
|
||||
|
||||
|
||||
async def complete_astrolabe_authorization(
|
||||
page: Page, username: str, password: str
|
||||
) -> dict:
|
||||
"""Complete full Astrolabe two-step authorization.
|
||||
"""Provision background indexing for a user (one-click app-password opt-in).
|
||||
|
||||
Performs the complete authorization flow:
|
||||
1. Navigate to Astrolabe settings
|
||||
2. OAuth authorization (Step 1) if needed
|
||||
3. Generate app password in Security settings
|
||||
4. App password entry (Step 2) if needed
|
||||
The auth refactor dropped the per-user OAuth step entirely — search now
|
||||
uses a session-minted JWT, so the only remaining "authorization" is the
|
||||
one-click background-indexing opt-in (a dedicated app password minted from
|
||||
the session and handed to the MCP server).
|
||||
|
||||
Args:
|
||||
page: Playwright page instance (must be logged in)
|
||||
@@ -713,64 +156,15 @@ async def complete_astrolabe_authorization(
|
||||
password: Nextcloud password (for reference, not used directly)
|
||||
|
||||
Returns:
|
||||
Dict with {"step1": bool, "step2": bool, "app_password": str | None}
|
||||
Dict with {"step1": True (no-op, kept for caller compat),
|
||||
"step2": bool, "app_password": None}
|
||||
"""
|
||||
logger.info("Starting full Astrolabe authorization for %s...", username)
|
||||
logger.info("Provisioning Astrolabe background indexing for %s...", username)
|
||||
|
||||
result = {"step1": False, "step2": False, "app_password": None}
|
||||
|
||||
# Navigate to Astrolabe settings
|
||||
await navigate_to_astrolabe_settings(page)
|
||||
|
||||
# Step 1: OAuth authorization
|
||||
try:
|
||||
result["step1"] = await authorize_search_access(page, username)
|
||||
logger.info("✓ Step 1 complete for %s", username)
|
||||
except Exception as e:
|
||||
logger.error("Step 1 failed for %s: %s", username, e)
|
||||
raise
|
||||
|
||||
# Navigate back to settings if needed (OAuth might have redirected elsewhere)
|
||||
if "/settings/user/astrolabe" not in page.url:
|
||||
await navigate_to_astrolabe_settings(page)
|
||||
|
||||
# Check if Step 2 is already complete
|
||||
try:
|
||||
step2_section = page.locator('h4:has-text("Step 2")')
|
||||
if await step2_section.count() > 0:
|
||||
step2_parent = step2_section.locator("..")
|
||||
complete_badge = step2_parent.get_by_text("Complete", exact=True)
|
||||
if await complete_badge.count() > 0 and await complete_badge.is_visible():
|
||||
logger.info("✓ Step 2 already complete for %s", username)
|
||||
result["step2"] = True
|
||||
return result
|
||||
except Exception:
|
||||
pass
|
||||
|
||||
# Also check for overall "Active" badge
|
||||
try:
|
||||
active_text = page.get_by_text("Active", exact=True)
|
||||
if await active_text.count() > 0 and await active_text.is_visible():
|
||||
logger.info("✓ Authorization already fully active for %s", username)
|
||||
result["step2"] = True
|
||||
return result
|
||||
except Exception:
|
||||
pass
|
||||
|
||||
# Step 2: Generate app password and enter it
|
||||
app_password = await generate_app_password(page, username)
|
||||
result["app_password"] = app_password
|
||||
|
||||
try:
|
||||
result["step2"] = await enable_background_sync_via_app_password(
|
||||
page, username, app_password
|
||||
)
|
||||
logger.info("✓ Step 2 complete for %s", username)
|
||||
except Exception as e:
|
||||
logger.error("Step 2 failed for %s: %s", username, e)
|
||||
raise
|
||||
|
||||
logger.info("✓ Full Astrolabe authorization complete for %s", username)
|
||||
# step1 is retained as always-True for backward compat with callers — there
|
||||
# is no longer an OAuth authorize step to perform.
|
||||
result = {"step1": True, "step2": False, "app_password": None}
|
||||
result["step2"] = await enable_background_sync(page, username)
|
||||
return result
|
||||
|
||||
|
||||
@@ -993,15 +387,11 @@ async def test_multi_user_astrolabe_background_sync_enablement(
|
||||
# Step 1: Login to Nextcloud
|
||||
await login_to_nextcloud(page, username, password)
|
||||
|
||||
# Step 2: Generate app password in Security settings
|
||||
app_password = await generate_app_password(page, username)
|
||||
# Step 2: One-click "Enable background indexing" (mints a dedicated
|
||||
# app password from the session and hands it to the MCP server).
|
||||
sync_enabled = await enable_background_sync(page, username)
|
||||
|
||||
# Step 3: Enable background sync by entering app password in Astrolabe
|
||||
sync_enabled = await enable_background_sync_via_app_password(
|
||||
page, username, app_password
|
||||
)
|
||||
|
||||
# Step 4: Verify app password was stored in database
|
||||
# Step 3: Verify app password was stored in database
|
||||
app_password_stored = await verify_app_password_created(username)
|
||||
|
||||
# Give it time to complete
|
||||
@@ -1009,7 +399,6 @@ async def test_multi_user_astrolabe_background_sync_enablement(
|
||||
|
||||
results[username] = {
|
||||
"settings_accessed": True,
|
||||
"app_password_generated": bool(app_password),
|
||||
"sync_enabled": sync_enabled,
|
||||
"app_password_stored": app_password_stored,
|
||||
"background_sync_active": sync_enabled and app_password_stored,
|
||||
@@ -1017,7 +406,6 @@ async def test_multi_user_astrolabe_background_sync_enablement(
|
||||
|
||||
logger.info("\\n%s results:", username)
|
||||
logger.info(" Settings accessed: ✓")
|
||||
logger.info(" App password generated: %s", "✓" if app_password else "✗")
|
||||
logger.info(" Sync enabled: %s", "✓" if sync_enabled else "✗")
|
||||
logger.info(
|
||||
" App password stored: %s", "✓" if app_password_stored else "✗"
|
||||
@@ -1061,9 +449,6 @@ async def test_multi_user_astrolabe_background_sync_enablement(
|
||||
assert result["settings_accessed"], (
|
||||
f"{username} could not access Astrolabe settings"
|
||||
)
|
||||
assert result["app_password_generated"], (
|
||||
f"{username} app password was not generated"
|
||||
)
|
||||
assert result["sync_enabled"], (
|
||||
f"{username} background sync enablement did not complete successfully"
|
||||
)
|
||||
@@ -1081,7 +466,7 @@ async def test_multi_user_astrolabe_background_sync_enablement(
|
||||
|
||||
|
||||
async def revoke_background_sync_access(page: Page, username: str) -> bool:
|
||||
"""Revoke background sync access by clicking the Revoke Access button.
|
||||
"""Revoke background sync access by clicking the "Disable background indexing" button.
|
||||
|
||||
Args:
|
||||
page: Playwright page instance (must be authenticated)
|
||||
@@ -1122,37 +507,37 @@ async def revoke_background_sync_access(page: Page, username: str) -> bool:
|
||||
# Wait for page to load
|
||||
await anyio.sleep(1)
|
||||
|
||||
# Check if "Active" badge is visible (indicating background sync is enabled)
|
||||
# The revoke form (#mcp-revoke-background-form) is only rendered while
|
||||
# background indexing is enabled.
|
||||
revoke_button = page.locator("#mcp-revoke-background-button")
|
||||
try:
|
||||
active_text = page.get_by_text("Active", exact=True)
|
||||
if not await active_text.is_visible(timeout=2000):
|
||||
if await revoke_button.count() == 0:
|
||||
logger.warning(
|
||||
"Background sync not active for %s, nothing to revoke", username
|
||||
"Background indexing not enabled for %s, nothing to revoke", username
|
||||
)
|
||||
return False
|
||||
except Exception:
|
||||
logger.warning("Could not find Active badge for %s", username)
|
||||
logger.warning("Could not find revoke button for %s", username)
|
||||
return False
|
||||
|
||||
# Find the "Revoke Access" button
|
||||
revoke_button = page.get_by_role("button", name="Revoke Access")
|
||||
|
||||
try:
|
||||
await revoke_button.wait_for(timeout=5000, state="visible")
|
||||
logger.info("Found Revoke Access button")
|
||||
logger.info("Found 'Disable background indexing' button")
|
||||
except Exception:
|
||||
screenshot_path = f"/tmp/astrolabe_no_revoke_button_{username}.png"
|
||||
screenshot_path = (
|
||||
f"{tempfile.gettempdir()}/astrolabe_no_revoke_button_{username}.png"
|
||||
)
|
||||
await page.screenshot(path=screenshot_path)
|
||||
raise ValueError(
|
||||
f"Could not find Revoke Access button for {username}. Screenshot: {screenshot_path}"
|
||||
f"Could not find revoke button for {username}. Screenshot: {screenshot_path}"
|
||||
)
|
||||
|
||||
# Set up dialog handler for confirmation dialog
|
||||
page.once("dialog", lambda dialog: dialog.accept())
|
||||
|
||||
# Click the Revoke Access button
|
||||
# Click the "Disable background indexing" button
|
||||
await revoke_button.click()
|
||||
logger.info("Clicked Revoke Access button")
|
||||
logger.info("Clicked the revoke button")
|
||||
|
||||
# Wait for the request to complete and page to reload
|
||||
await page.wait_for_load_state("networkidle", timeout=15000)
|
||||
@@ -1178,7 +563,9 @@ async def revoke_background_sync_access(page: Page, username: str) -> bool:
|
||||
else:
|
||||
logger.warning("No response found for credentials/revoke endpoint!")
|
||||
# Take screenshot for debugging
|
||||
screenshot_path = f"/tmp/astrolabe_revoke_no_response_{username}.png"
|
||||
screenshot_path = (
|
||||
f"{tempfile.gettempdir()}/astrolabe_revoke_no_response_{username}.png"
|
||||
)
|
||||
await page.screenshot(path=screenshot_path)
|
||||
return False
|
||||
|
||||
@@ -1198,12 +585,14 @@ async def revoke_background_sync_access(page: Page, username: str) -> bool:
|
||||
except Exception:
|
||||
pass
|
||||
|
||||
# Verify "Active" badge is no longer visible
|
||||
# After revoke + reload the settings page returns to the un-provisioned
|
||||
# state: the revoke button is gone and the app-password input is shown again.
|
||||
try:
|
||||
active_text = page.get_by_text("Active", exact=True)
|
||||
if await active_text.is_visible(timeout=2000):
|
||||
logger.error("Active badge still visible for %s after revoke!", username)
|
||||
screenshot_path = f"/tmp/astrolabe_revoke_still_active_{username}.png"
|
||||
if await page.locator("#mcp-revoke-background-button").is_visible(timeout=2000):
|
||||
logger.error("Revoke button still visible for %s after revoke!", username)
|
||||
screenshot_path = (
|
||||
f"{tempfile.gettempdir()}/astrolabe_revoke_still_enabled_{username}.png"
|
||||
)
|
||||
await page.screenshot(path=screenshot_path)
|
||||
return False
|
||||
except Exception:
|
||||
@@ -1280,11 +669,11 @@ async def test_revoke_background_sync_access(
|
||||
test_users_setup,
|
||||
configure_astrolabe_for_mcp_server,
|
||||
):
|
||||
"""Test that users can revoke background sync access via the Revoke Access button.
|
||||
"""Test that users can revoke background sync access via the "Disable background indexing" button.
|
||||
|
||||
This test verifies:
|
||||
1. User enables background sync via app password
|
||||
2. User clicks "Revoke Access" button
|
||||
2. User clicks "Disable background indexing" button
|
||||
3. Confirmation dialog is handled
|
||||
4. POST request is sent to /api/v1/background-sync/credentials/revoke
|
||||
5. "Active" badge disappears from settings page
|
||||
@@ -1319,14 +708,9 @@ async def test_revoke_background_sync_access(
|
||||
# Step 1: Login to Nextcloud
|
||||
await login_to_nextcloud(page, username, password)
|
||||
|
||||
# Step 2: Complete full authorization (OAuth Step 1 + App Password Step 2)
|
||||
# Provision background indexing (app-password opt-in; no OAuth step).
|
||||
auth_result = await complete_astrolabe_authorization(page, username, password)
|
||||
assert auth_result["step1"], (
|
||||
f"OAuth authorization (Step 1) failed for {username}"
|
||||
)
|
||||
assert auth_result["step2"], (
|
||||
f"App password setup (Step 2) failed for {username}"
|
||||
)
|
||||
assert auth_result["step2"], f"App password provisioning failed for {username}"
|
||||
|
||||
# Step 3: Verify background sync is enabled
|
||||
assert await verify_app_password_created(username), (
|
||||
|
||||
@@ -108,7 +108,7 @@ async def navigate_to_astrolabe_main(page: Page):
|
||||
@pytest.mark.multi_user_basic
|
||||
@pytest.mark.timeout(
|
||||
300
|
||||
) # 5 minutes - this test involves OAuth, app password, and vector sync
|
||||
) # 5 minutes - this test involves app-password provisioning + vector sync
|
||||
async def test_astrolabe_plotly_visualization_with_basic_auth(
|
||||
browser,
|
||||
test_users_setup,
|
||||
@@ -143,7 +143,7 @@ async def test_astrolabe_plotly_visualization_with_basic_auth(
|
||||
page = await context.new_page()
|
||||
|
||||
try:
|
||||
# Phase 2: Complete full Astrolabe authorization (OAuth + app password)
|
||||
# Phase 2: Provision background indexing (app-password opt-in; no OAuth)
|
||||
await login_to_nextcloud(page, username, password)
|
||||
auth_result = await complete_astrolabe_authorization(page, username, password)
|
||||
logger.info("Authorization result: %s", auth_result)
|
||||
|
||||
@@ -0,0 +1,109 @@
|
||||
"""Astrolabe session-derived JWT search path (card 120 auth refactor).
|
||||
|
||||
Cross-system interface test. The astrolabe app was refactored to mint a
|
||||
short-lived JWT for the current Nextcloud session user on demand (via the
|
||||
`oidc` app's ``TokenGenerationRequestEvent``), replacing the old OAuth
|
||||
authorize + offline_access + stored-refresh-token flow. This test proves the
|
||||
new path end-to-end:
|
||||
|
||||
logged-in NC user → GET /apps/astrolabe/api/search → astrolabe mints a JWT
|
||||
(McpTokenMinter) → calls the MCP server with ``Authorization: Bearer`` →
|
||||
MCP validates the JWT (unified_verifier, aud=astrolabe_client_id) → results.
|
||||
|
||||
The headline behavioural change is that a user needs **no provisioning** to
|
||||
search: there is no authorize redirect and ``has_background_access`` stays
|
||||
False (app-password provisioning is now only for *background indexing*, a
|
||||
separate opt-in covered by the background-sync tests).
|
||||
|
||||
Astrolabe is installed + configured (astrolabe_client_id, mcp_server_url) by
|
||||
the container app-hooks; the test skips if that wiring is absent. Driven over
|
||||
HTTP with BasicAuth (which establishes a Nextcloud session for the request) —
|
||||
no browser needed.
|
||||
"""
|
||||
|
||||
import os
|
||||
|
||||
import httpx
|
||||
import pytest
|
||||
|
||||
pytestmark = [pytest.mark.integration, pytest.mark.login_flow]
|
||||
|
||||
NEXTCLOUD_URL = "http://localhost:8080"
|
||||
ASTROLABE_API = f"{NEXTCLOUD_URL}/apps/astrolabe/api"
|
||||
_HEADERS = {"OCS-APIRequest": "true"}
|
||||
|
||||
|
||||
async def _astrolabe_configured(client: httpx.AsyncClient, auth) -> bool:
|
||||
"""Readiness probe: astrolabe must be able to reach its MCP server."""
|
||||
try:
|
||||
resp = await client.get(
|
||||
f"{ASTROLABE_API}/vector-status", auth=auth, headers=_HEADERS
|
||||
)
|
||||
except httpx.HTTPError:
|
||||
return False
|
||||
if resp.status_code != 200:
|
||||
return False
|
||||
return bool(resp.json().get("success"))
|
||||
|
||||
|
||||
async def test_session_user_searches_without_provisioning(test_users_setup):
|
||||
"""A non-admin session user searches with no OAuth/provisioning step.
|
||||
|
||||
success=True proves astrolabe minted a JWT from the session and the MCP
|
||||
server accepted it. Results may be empty (nothing indexed) — the auth
|
||||
chain, not recall, is under test here.
|
||||
"""
|
||||
auth = httpx.BasicAuth("bob", test_users_setup["bob"]["password"])
|
||||
async with httpx.AsyncClient(timeout=30) as client:
|
||||
if not await _astrolabe_configured(client, auth):
|
||||
pytest.skip("Astrolabe not wired to an MCP server in this stack")
|
||||
|
||||
# No provisioning: search must work purely from the session JWT.
|
||||
status = await client.get(
|
||||
f"{ASTROLABE_API}/v1/background-sync/status", auth=auth, headers=_HEADERS
|
||||
)
|
||||
assert status.json()["has_background_access"] is False, (
|
||||
"precondition: bob has not opted into background indexing"
|
||||
)
|
||||
|
||||
resp = await client.get(
|
||||
f"{ASTROLABE_API}/search",
|
||||
params={"query": "quarterly planning", "limit": 3},
|
||||
auth=auth,
|
||||
headers=_HEADERS,
|
||||
)
|
||||
|
||||
assert resp.status_code == 200, resp.text
|
||||
body = resp.json()
|
||||
assert body["success"] is True, (
|
||||
f"session-JWT search must succeed without provisioning; got {body}"
|
||||
)
|
||||
assert "results" in body and "algorithm_used" in body
|
||||
|
||||
|
||||
async def test_admin_session_search_succeeds():
|
||||
"""The same JWT-mint path works for the admin session user."""
|
||||
admin_pw = os.environ["NEXTCLOUD_PASSWORD"]
|
||||
auth = httpx.BasicAuth(os.environ["NEXTCLOUD_USERNAME"], admin_pw)
|
||||
async with httpx.AsyncClient(timeout=30) as client:
|
||||
if not await _astrolabe_configured(client, auth):
|
||||
pytest.skip("Astrolabe not wired to an MCP server in this stack")
|
||||
resp = await client.get(
|
||||
f"{ASTROLABE_API}/search",
|
||||
params={"query": "infrastructure", "limit": 3},
|
||||
auth=auth,
|
||||
headers=_HEADERS,
|
||||
)
|
||||
assert resp.status_code == 200, resp.text
|
||||
assert resp.json()["success"] is True
|
||||
|
||||
|
||||
async def test_search_requires_authentication():
|
||||
"""Unauthenticated search is rejected (no anonymous JWT minting)."""
|
||||
async with httpx.AsyncClient(follow_redirects=False, timeout=30) as client:
|
||||
resp = await client.get(
|
||||
f"{ASTROLABE_API}/search",
|
||||
params={"query": "x"},
|
||||
headers=_HEADERS,
|
||||
)
|
||||
assert resp.status_code in (401, 302, 303, 307, 308), resp.status_code
|
||||
@@ -1,96 +1,63 @@
|
||||
"""Integration tests for Astrolabe personal settings page buttons.
|
||||
"""Integration tests for Astrolabe personal-settings background-sync endpoints.
|
||||
|
||||
Cross-system interface test: Tests the MCP server's integration with the
|
||||
Astrolabe Nextcloud app, which is installed from the Nextcloud app store via
|
||||
app-hooks/post-installation/20-install-astrolabe-app.sh. Astrolabe source
|
||||
lives in a separate repository (https://github.com/cbcoutinho/astrolabe).
|
||||
Cross-system interface test. The astrolabe app (installed by
|
||||
app-hooks/post-installation/20-install-astrolabe-app.sh; source in
|
||||
./third_party/astrolabe) was refactored to session-minted JWTs — the old
|
||||
per-user OAuth flow and its ``/apps/astrolabe/oauth/disconnect`` route are
|
||||
gone. Background indexing is now an app-password opt-in with a single revoke
|
||||
endpoint.
|
||||
|
||||
Tests the button functionality on /settings/user/astrolabe:
|
||||
1. Disable Indexing button (POST to /apps/astrolabe/api/revoke)
|
||||
2. Disconnect button (POST to /apps/astrolabe/oauth/disconnect)
|
||||
|
||||
These tests verify that:
|
||||
- The endpoints respond correctly to POST requests
|
||||
- CSRF token validation works
|
||||
- User actions are properly handled
|
||||
- Appropriate redirects occur
|
||||
These tests assert the *current* HTTP surface of the settings page:
|
||||
- the revoke endpoint exists and is auth-gated
|
||||
(POST /apps/astrolabe/api/v1/background-sync/credentials/revoke)
|
||||
- the obsolete OAuth disconnect route is gone (404)
|
||||
- the personal settings page route resolves
|
||||
"""
|
||||
|
||||
import httpx
|
||||
import pytest
|
||||
|
||||
pytestmark = pytest.mark.integration
|
||||
|
||||
@pytest.mark.integration
|
||||
async def test_disable_indexing_button_endpoint_exists():
|
||||
"""Test that the Disable Indexing endpoint is accessible."""
|
||||
async with httpx.AsyncClient() as client:
|
||||
# Try without authentication - should return 401 or redirect
|
||||
response = await client.post(
|
||||
"http://localhost:8080/apps/astrolabe/api/revoke",
|
||||
follow_redirects=False,
|
||||
)
|
||||
NEXTCLOUD_URL = "http://localhost:8080"
|
||||
ASTROLABE = f"{NEXTCLOUD_URL}/apps/astrolabe"
|
||||
|
||||
# Should get 401 Unauthorized or 30x redirect
|
||||
assert response.status_code in [401, 301, 302, 303, 307, 308], (
|
||||
f"Expected 401 or redirect without auth, got {response.status_code}"
|
||||
# Auth failures (no session) surface as 401 or a login redirect.
|
||||
_UNAUTH = {401, 302, 303, 307, 308}
|
||||
|
||||
|
||||
async def test_revoke_endpoint_requires_auth():
|
||||
"""The background-sync revoke endpoint exists and rejects anonymous calls."""
|
||||
async with httpx.AsyncClient(follow_redirects=False) as client:
|
||||
resp = await client.post(
|
||||
f"{ASTROLABE}/api/v1/background-sync/credentials/revoke",
|
||||
headers={"OCS-APIRequest": "true"},
|
||||
)
|
||||
# Must NOT be 404 — the route must exist — and must be auth-gated.
|
||||
assert resp.status_code != 404, "revoke route missing"
|
||||
assert resp.status_code in _UNAUTH, (
|
||||
f"expected auth rejection, got {resp.status_code}"
|
||||
)
|
||||
|
||||
|
||||
@pytest.mark.integration
|
||||
async def test_disconnect_button_endpoint_exists():
|
||||
"""Test that the Disconnect endpoint is accessible."""
|
||||
async with httpx.AsyncClient() as client:
|
||||
# Try without authentication - should return 401 or redirect
|
||||
response = await client.post(
|
||||
"http://localhost:8080/apps/astrolabe/oauth/disconnect",
|
||||
follow_redirects=False,
|
||||
)
|
||||
async def test_obsolete_oauth_disconnect_route_removed():
|
||||
"""The pre-refactor OAuth disconnect route must no longer exist.
|
||||
|
||||
# Should get 401 Unauthorized or 30x redirect
|
||||
assert response.status_code in [401, 301, 302, 303, 307, 308], (
|
||||
f"Expected 401 or redirect without auth, got {response.status_code}"
|
||||
)
|
||||
|
||||
|
||||
@pytest.mark.integration
|
||||
async def test_settings_page_renders_buttons():
|
||||
"""Test that the settings page template includes button forms.
|
||||
|
||||
This test verifies that the PHP template renders the form elements.
|
||||
It doesn't require authentication since we're just checking the route exists.
|
||||
Regression guard for the auth refactor: ``/apps/astrolabe/oauth/disconnect``
|
||||
(and the rest of the OAuth authorize/callback/disconnect surface) was
|
||||
removed in favour of session-minted JWTs.
|
||||
"""
|
||||
async with httpx.AsyncClient(follow_redirects=False) as client:
|
||||
# Try to access settings page
|
||||
response = await client.get("http://localhost:8080/settings/user/astrolabe")
|
||||
|
||||
# Should get 401/redirect if not authenticated (expected)
|
||||
# or 200 if user session exists from browser testing
|
||||
assert response.status_code in [200, 401, 302, 303, 307, 308], (
|
||||
f"Unexpected status code: {response.status_code}"
|
||||
)
|
||||
resp = await client.post(f"{ASTROLABE}/oauth/disconnect")
|
||||
assert resp.status_code == 404, (
|
||||
f"obsolete oauth/disconnect route still resolves ({resp.status_code})"
|
||||
)
|
||||
|
||||
|
||||
@pytest.mark.integration
|
||||
@pytest.mark.skip(
|
||||
reason="Requires manual authentication - test with Playwright instead"
|
||||
)
|
||||
async def test_disconnect_button_functionality():
|
||||
"""Test that clicking Disconnect button clears user OAuth tokens.
|
||||
|
||||
NOTE: This test is skipped because programmatic login to Nextcloud is complex.
|
||||
Use Playwright-based tests or manual testing instead.
|
||||
"""
|
||||
pass
|
||||
|
||||
|
||||
@pytest.mark.integration
|
||||
@pytest.mark.skip(
|
||||
reason="Requires manual authentication - test with Playwright instead"
|
||||
)
|
||||
async def test_disable_indexing_button_functionality():
|
||||
"""Test that clicking Disable Indexing button revokes background access.
|
||||
|
||||
NOTE: This test is skipped because programmatic login to Nextcloud is complex.
|
||||
Use Playwright-based tests or manual testing instead.
|
||||
"""
|
||||
pass
|
||||
async def test_settings_page_route_resolves():
|
||||
"""The personal settings page route exists (auth-gated when no session)."""
|
||||
async with httpx.AsyncClient(follow_redirects=False) as client:
|
||||
resp = await client.get(f"{NEXTCLOUD_URL}/settings/user/astrolabe")
|
||||
assert resp.status_code in ({200} | _UNAUTH), (
|
||||
f"unexpected status for settings page: {resp.status_code}"
|
||||
)
|
||||
|
||||
@@ -1,702 +0,0 @@
|
||||
"""Integration tests for Astrolabe token refresh flow.
|
||||
|
||||
Cross-system interface test: Tests the MCP server's integration with the
|
||||
Astrolabe Nextcloud app, which is installed from the Nextcloud app store via
|
||||
app-hooks/post-installation/20-install-astrolabe-app.sh. Astrolabe source
|
||||
lives in a separate repository (https://github.com/cbcoutinho/astrolabe).
|
||||
|
||||
Tests the token refresh mechanism between Astrolabe (Nextcloud app)
|
||||
and the MCP server backend in a multi-user basic auth deployment.
|
||||
|
||||
This test verifies:
|
||||
1. User provisions access via Astrolabe personal settings
|
||||
2. Token is stored encrypted in Nextcloud database
|
||||
3. Token expires (simulated via database manipulation)
|
||||
4. MCP server requests new token via refresh
|
||||
5. Astrolabe refreshes token with IdP
|
||||
6. New token is stored and used successfully
|
||||
|
||||
Note: The mcp-multi-user-basic deployment uses "hybrid mode" which requires
|
||||
BOTH OAuth authorization AND app password for full configuration. These tests
|
||||
focus on the app password/credential storage aspects and verify database state
|
||||
directly rather than relying on UI elements that require both steps.
|
||||
"""
|
||||
|
||||
import logging
|
||||
import re
|
||||
import subprocess
|
||||
|
||||
import anyio
|
||||
import pytest
|
||||
from playwright.async_api import Page
|
||||
|
||||
pytestmark = [pytest.mark.integration, pytest.mark.multi_user_basic]
|
||||
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
|
||||
async def login_to_nextcloud(page: Page, username: str, password: str):
|
||||
"""Helper function to login to Nextcloud via Playwright.
|
||||
|
||||
Args:
|
||||
page: Playwright page instance
|
||||
username: Nextcloud username
|
||||
password: Nextcloud password
|
||||
"""
|
||||
nextcloud_url = "http://localhost:8080"
|
||||
|
||||
logger.info("Logging in to Nextcloud as %s...", username)
|
||||
await page.goto(f"{nextcloud_url}/login", wait_until="networkidle")
|
||||
|
||||
# Fill in login form
|
||||
await page.wait_for_selector('input[name="user"]', timeout=10000)
|
||||
await page.fill('input[name="user"]', username)
|
||||
await page.fill('input[name="password"]', password)
|
||||
|
||||
# Submit form
|
||||
await page.click('button[type="submit"]')
|
||||
await page.wait_for_load_state("networkidle", timeout=30000)
|
||||
|
||||
# Verify logged in (should redirect away from login page)
|
||||
current_url = page.url
|
||||
assert "/login" not in current_url, (
|
||||
f"Login failed for {username}, still on login page"
|
||||
)
|
||||
logger.info("✓ Successfully logged in as %s", username)
|
||||
|
||||
|
||||
async def generate_app_password(
|
||||
page: Page, username: str, app_name: str = "Astrolabe Test"
|
||||
) -> str:
|
||||
"""Generate an app password in Nextcloud Security settings.
|
||||
|
||||
Args:
|
||||
page: Playwright page instance (must be authenticated)
|
||||
username: Username (for logging)
|
||||
app_name: Name for the app password
|
||||
|
||||
Returns:
|
||||
The generated app password string
|
||||
"""
|
||||
logger.info("Generating app password for %s...", username)
|
||||
|
||||
nextcloud_url = "http://localhost:8080"
|
||||
|
||||
# Navigate to Security settings
|
||||
await page.goto(f"{nextcloud_url}/settings/user/security", wait_until="networkidle")
|
||||
logger.info("Navigated to Security settings")
|
||||
|
||||
# Fill the app password input field
|
||||
app_password_input = page.locator('input[placeholder="App name"]')
|
||||
await app_password_input.fill(app_name)
|
||||
logger.info("Entered app name: %s", app_name)
|
||||
|
||||
# Wait for Vue.js to react and enable the button
|
||||
await anyio.sleep(1.0)
|
||||
|
||||
# Click the create button
|
||||
create_button = page.locator(
|
||||
'button[type="submit"]:has-text("Create new app password")'
|
||||
)
|
||||
await create_button.click()
|
||||
logger.info("Clicked create app password button")
|
||||
|
||||
# Wait for app password to be generated
|
||||
await anyio.sleep(3)
|
||||
|
||||
# Find the generated app password
|
||||
app_password = None
|
||||
try:
|
||||
await page.wait_for_selector('text="New app password"', timeout=10000)
|
||||
logger.info("App password dialog appeared")
|
||||
|
||||
all_inputs = await page.locator('input[type="text"]').all()
|
||||
for idx, input_elem in enumerate(all_inputs):
|
||||
try:
|
||||
value = await input_elem.input_value()
|
||||
if value and "-" in value and len(value) > 20:
|
||||
app_password = value.strip()
|
||||
logger.info("Found app password in input %s", idx)
|
||||
break
|
||||
except Exception:
|
||||
continue
|
||||
except Exception as e:
|
||||
logger.error("Failed to find app password dialog: %s", e)
|
||||
|
||||
if not app_password:
|
||||
screenshot_path = f"/tmp/app_password_generation_{username}.png"
|
||||
await page.screenshot(path=screenshot_path)
|
||||
raise ValueError(
|
||||
f"Could not find generated app password. Screenshot: {screenshot_path}"
|
||||
)
|
||||
|
||||
# Validate password format
|
||||
if not re.match(
|
||||
r"^[a-zA-Z0-9]{5}-[a-zA-Z0-9]{5}-[a-zA-Z0-9]{5}-[a-zA-Z0-9]{5}-[a-zA-Z0-9]{5}$",
|
||||
app_password,
|
||||
):
|
||||
raise ValueError(f"App password format validation failed: {app_password}")
|
||||
|
||||
logger.info("✓ Generated app password for %s", username)
|
||||
|
||||
# Close the dialog
|
||||
close_button = page.get_by_role("button", name="Close")
|
||||
await close_button.click()
|
||||
await anyio.sleep(0.5)
|
||||
|
||||
return app_password
|
||||
|
||||
|
||||
async def save_app_password_in_astrolabe(
|
||||
page: Page, username: str, app_password: str
|
||||
) -> bool:
|
||||
"""Save app password in Astrolabe settings (Step 2 of hybrid mode).
|
||||
|
||||
This function only saves the app password - it does NOT verify the "Active"
|
||||
badge since that requires both OAuth and app password in hybrid mode.
|
||||
|
||||
Args:
|
||||
page: Playwright page instance
|
||||
username: Username (for logging)
|
||||
app_password: App password to enter
|
||||
|
||||
Returns:
|
||||
True if the password was saved successfully (based on network response)
|
||||
"""
|
||||
logger.info("Saving app password in Astrolabe for %s...", username)
|
||||
|
||||
nextcloud_url = "http://localhost:8080"
|
||||
|
||||
# Track network responses
|
||||
credentials_response_status = None
|
||||
|
||||
def capture_response(resp):
|
||||
nonlocal credentials_response_status
|
||||
if "background-sync/credentials" in resp.url or "storeAppPassword" in resp.url:
|
||||
credentials_response_status = resp.status
|
||||
logger.info("Credentials endpoint response: %s %s", resp.status, resp.url)
|
||||
|
||||
page.on("response", capture_response)
|
||||
|
||||
# Navigate to Astrolabe settings
|
||||
await page.goto(
|
||||
f"{nextcloud_url}/settings/user/astrolabe", wait_until="networkidle"
|
||||
)
|
||||
await anyio.sleep(1)
|
||||
|
||||
# Check if Step 2 already shows "Complete"
|
||||
try:
|
||||
complete_badge = page.locator('text="Complete"').first
|
||||
if await complete_badge.is_visible(timeout=2000):
|
||||
logger.info("✓ App password already configured for %s", username)
|
||||
return True
|
||||
except Exception:
|
||||
pass
|
||||
|
||||
# Find the app password input field
|
||||
app_password_input = page.get_by_placeholder("xxxxx-xxxxx-xxxxx-xxxxx-xxxxx")
|
||||
|
||||
try:
|
||||
await app_password_input.wait_for(timeout=5000, state="visible")
|
||||
logger.info("Found app password input field")
|
||||
except Exception:
|
||||
screenshot_path = f"/tmp/astrolabe_no_password_field_{username}.png"
|
||||
await page.screenshot(path=screenshot_path)
|
||||
raise ValueError(
|
||||
f"Could not find app password input field. Screenshot: {screenshot_path}"
|
||||
)
|
||||
|
||||
# Enter the app password
|
||||
await app_password_input.fill(app_password)
|
||||
logger.info("Entered app password for %s", username)
|
||||
|
||||
await anyio.sleep(0.5)
|
||||
|
||||
# Click Save button
|
||||
save_button = page.get_by_role("button", name="Save")
|
||||
await save_button.click()
|
||||
logger.info("Clicked Save button")
|
||||
|
||||
# Wait for the request to complete and page to reload
|
||||
await page.wait_for_load_state("networkidle", timeout=15000)
|
||||
await anyio.sleep(2)
|
||||
|
||||
# Verify the save was successful by checking network response
|
||||
if credentials_response_status == 200:
|
||||
logger.info("✓ App password saved successfully for %s", username)
|
||||
return True
|
||||
else:
|
||||
logger.error(
|
||||
"App password save failed for %s, status: %s",
|
||||
username,
|
||||
credentials_response_status,
|
||||
)
|
||||
screenshot_path = f"/tmp/astrolabe_save_failed_{username}.png"
|
||||
await page.screenshot(path=screenshot_path)
|
||||
return False
|
||||
|
||||
|
||||
def get_background_sync_credentials(username: str) -> dict | None:
|
||||
"""Get background sync credentials for a user from the database.
|
||||
|
||||
Args:
|
||||
username: Nextcloud username
|
||||
|
||||
Returns:
|
||||
Dict with credential details, or None if not found
|
||||
"""
|
||||
query = f"""
|
||||
SELECT configkey, configvalue
|
||||
FROM oc_preferences
|
||||
WHERE userid = '{username}'
|
||||
AND appid = 'astrolabe'
|
||||
AND configkey IN ('background_sync_password', 'background_sync_type', 'background_sync_provisioned_at')
|
||||
ORDER BY configkey;
|
||||
"""
|
||||
|
||||
try:
|
||||
result = subprocess.run(
|
||||
[
|
||||
"docker",
|
||||
"compose",
|
||||
"exec",
|
||||
"-T",
|
||||
"db",
|
||||
"mariadb",
|
||||
"-u",
|
||||
"root",
|
||||
"-ppassword",
|
||||
"nextcloud",
|
||||
"-e",
|
||||
query,
|
||||
],
|
||||
capture_output=True,
|
||||
text=True,
|
||||
timeout=10,
|
||||
)
|
||||
|
||||
output = result.stdout
|
||||
if "background_sync_type" in output:
|
||||
return {
|
||||
"has_password": "background_sync_password" in output,
|
||||
"has_type": "background_sync_type" in output,
|
||||
"has_timestamp": "background_sync_provisioned_at" in output,
|
||||
"is_app_password": "app_password" in output,
|
||||
}
|
||||
return None
|
||||
|
||||
except Exception as e:
|
||||
logger.error("Error getting credentials for %s: %s", username, e)
|
||||
return None
|
||||
|
||||
|
||||
def delete_user_credentials(username: str) -> bool:
|
||||
"""Delete all stored credentials for a user (for cleanup).
|
||||
|
||||
Args:
|
||||
username: Nextcloud username
|
||||
|
||||
Returns:
|
||||
True if successful
|
||||
"""
|
||||
query = f"""
|
||||
DELETE FROM oc_preferences
|
||||
WHERE userid = '{username}'
|
||||
AND appid = 'astrolabe'
|
||||
AND configkey IN ('oauth_tokens', 'background_sync_password', 'background_sync_type', 'background_sync_provisioned_at');
|
||||
"""
|
||||
|
||||
try:
|
||||
result = subprocess.run(
|
||||
[
|
||||
"docker",
|
||||
"compose",
|
||||
"exec",
|
||||
"-T",
|
||||
"db",
|
||||
"mariadb",
|
||||
"-u",
|
||||
"root",
|
||||
"-ppassword",
|
||||
"nextcloud",
|
||||
"-e",
|
||||
query,
|
||||
],
|
||||
capture_output=True,
|
||||
text=True,
|
||||
timeout=10,
|
||||
)
|
||||
|
||||
logger.info("Deleted credentials for %s", username)
|
||||
return result.returncode == 0
|
||||
|
||||
except Exception as e:
|
||||
logger.error("Error deleting credentials for %s: %s", username, e)
|
||||
return False
|
||||
|
||||
|
||||
@pytest.mark.integration
|
||||
@pytest.mark.multi_user_basic
|
||||
async def test_app_password_storage_and_cleanup(
|
||||
browser,
|
||||
nc_client,
|
||||
test_users_setup,
|
||||
configure_astrolabe_for_mcp_server,
|
||||
):
|
||||
"""Test that app passwords are stored and cleaned up correctly.
|
||||
|
||||
This test verifies:
|
||||
1. User can save app password in Astrolabe settings
|
||||
2. Password is stored encrypted in the database
|
||||
3. Credentials can be revoked and are deleted from database
|
||||
|
||||
Note: In hybrid mode (mcp-multi-user-basic), this only tests Step 2
|
||||
(app password storage). The "Active" badge requires both OAuth and
|
||||
app password, which is tested separately.
|
||||
"""
|
||||
# Configure Astrolabe for mcp-multi-user-basic
|
||||
logger.info("Configuring Astrolabe for mcp-multi-user-basic server...")
|
||||
await configure_astrolabe_for_mcp_server(
|
||||
mcp_server_internal_url="http://mcp-multi-user-basic:8000",
|
||||
mcp_server_public_url="http://localhost:8003",
|
||||
)
|
||||
|
||||
username = "alice"
|
||||
user_config = test_users_setup[username]
|
||||
password = user_config["password"]
|
||||
|
||||
# Cleanup any existing credentials
|
||||
delete_user_credentials(username)
|
||||
|
||||
context = await browser.new_context(ignore_https_errors=True)
|
||||
page = await context.new_page()
|
||||
|
||||
try:
|
||||
# Step 1: Login
|
||||
await login_to_nextcloud(page, username, password)
|
||||
|
||||
# Step 2: Verify no credentials exist initially
|
||||
initial_creds = get_background_sync_credentials(username)
|
||||
assert initial_creds is None, f"Expected no credentials, found: {initial_creds}"
|
||||
logger.info("✓ Verified no initial credentials")
|
||||
|
||||
# Step 3: Generate app password
|
||||
app_password = await generate_app_password(page, username)
|
||||
assert app_password, "Failed to generate app password"
|
||||
|
||||
# Step 4: Save app password in Astrolabe
|
||||
save_success = await save_app_password_in_astrolabe(
|
||||
page, username, app_password
|
||||
)
|
||||
assert save_success, "Failed to save app password"
|
||||
|
||||
# Step 5: Verify credentials are stored in database
|
||||
stored_creds = get_background_sync_credentials(username)
|
||||
assert stored_creds is not None, "Expected credentials to be stored"
|
||||
assert stored_creds["has_password"], "Expected password to be stored"
|
||||
assert stored_creds["has_type"], "Expected type to be stored"
|
||||
assert stored_creds["is_app_password"], "Expected type to be 'app_password'"
|
||||
logger.info("✓ Verified credentials stored in database")
|
||||
|
||||
# Step 6: Verify password is encrypted (not plaintext)
|
||||
query = f"""
|
||||
SELECT configvalue
|
||||
FROM oc_preferences
|
||||
WHERE userid = '{username}'
|
||||
AND appid = 'astrolabe'
|
||||
AND configkey = 'background_sync_password';
|
||||
"""
|
||||
|
||||
result = subprocess.run(
|
||||
[
|
||||
"docker",
|
||||
"compose",
|
||||
"exec",
|
||||
"-T",
|
||||
"db",
|
||||
"mariadb",
|
||||
"-u",
|
||||
"root",
|
||||
"-ppassword",
|
||||
"nextcloud",
|
||||
"-N",
|
||||
"-e",
|
||||
query,
|
||||
],
|
||||
capture_output=True,
|
||||
text=True,
|
||||
timeout=10,
|
||||
)
|
||||
|
||||
encrypted_value = result.stdout.strip()
|
||||
assert app_password not in encrypted_value, "Password appears in plaintext!"
|
||||
assert len(encrypted_value) > len(app_password), (
|
||||
"Encrypted value should be longer"
|
||||
)
|
||||
logger.info("✓ Verified password is encrypted")
|
||||
|
||||
finally:
|
||||
await context.close()
|
||||
# Cleanup
|
||||
delete_user_credentials(username)
|
||||
|
||||
|
||||
@pytest.mark.integration
|
||||
@pytest.mark.multi_user_basic
|
||||
async def test_credential_isolation_between_users(
|
||||
browser,
|
||||
nc_client,
|
||||
test_users_setup,
|
||||
configure_astrolabe_for_mcp_server,
|
||||
):
|
||||
"""Test that credentials are properly isolated between users.
|
||||
|
||||
This test verifies:
|
||||
1. Multiple users can provision credentials independently
|
||||
2. Each user's encrypted credentials are unique
|
||||
3. Deleting one user's credentials doesn't affect others
|
||||
"""
|
||||
await configure_astrolabe_for_mcp_server(
|
||||
mcp_server_internal_url="http://mcp-multi-user-basic:8000",
|
||||
mcp_server_public_url="http://localhost:8003",
|
||||
)
|
||||
|
||||
test_users = ["alice", "bob"]
|
||||
user_passwords = {}
|
||||
|
||||
# Cleanup all users first
|
||||
for username in test_users:
|
||||
delete_user_credentials(username)
|
||||
|
||||
# Provision each user
|
||||
for username in test_users:
|
||||
user_config = test_users_setup[username]
|
||||
password = user_config["password"]
|
||||
|
||||
context = await browser.new_context(ignore_https_errors=True)
|
||||
page = await context.new_page()
|
||||
|
||||
try:
|
||||
await login_to_nextcloud(page, username, password)
|
||||
app_password = await generate_app_password(
|
||||
page, username, f"Test {username}"
|
||||
)
|
||||
save_success = await save_app_password_in_astrolabe(
|
||||
page, username, app_password
|
||||
)
|
||||
|
||||
assert save_success, f"Failed to save app password for {username}"
|
||||
user_passwords[username] = app_password
|
||||
|
||||
# Verify stored
|
||||
creds = get_background_sync_credentials(username)
|
||||
assert creds is not None, f"Credentials not stored for {username}"
|
||||
logger.info("✓ Credentials provisioned for %s", username)
|
||||
|
||||
finally:
|
||||
await context.close()
|
||||
|
||||
# Verify isolation - get encrypted values
|
||||
encrypted_values = {}
|
||||
for username in test_users:
|
||||
query = f"""
|
||||
SELECT configvalue
|
||||
FROM oc_preferences
|
||||
WHERE userid = '{username}'
|
||||
AND appid = 'astrolabe'
|
||||
AND configkey = 'background_sync_password';
|
||||
"""
|
||||
|
||||
result = subprocess.run(
|
||||
[
|
||||
"docker",
|
||||
"compose",
|
||||
"exec",
|
||||
"-T",
|
||||
"db",
|
||||
"mariadb",
|
||||
"-u",
|
||||
"root",
|
||||
"-ppassword",
|
||||
"nextcloud",
|
||||
"-N",
|
||||
"-e",
|
||||
query,
|
||||
],
|
||||
capture_output=True,
|
||||
text=True,
|
||||
timeout=10,
|
||||
)
|
||||
encrypted_values[username] = result.stdout.strip()
|
||||
|
||||
# Different users should have different encrypted values
|
||||
assert encrypted_values["alice"] != encrypted_values["bob"], (
|
||||
"Different users should have different encrypted values"
|
||||
)
|
||||
logger.info("✓ Verified credentials are unique per user")
|
||||
|
||||
# Delete alice's credentials and verify bob's are unaffected
|
||||
delete_user_credentials("alice")
|
||||
|
||||
alice_creds = get_background_sync_credentials("alice")
|
||||
bob_creds = get_background_sync_credentials("bob")
|
||||
|
||||
assert alice_creds is None, "Alice's credentials should be deleted"
|
||||
assert bob_creds is not None, "Bob's credentials should still exist"
|
||||
logger.info("✓ Verified credential deletion is isolated")
|
||||
|
||||
# Cleanup
|
||||
for username in test_users:
|
||||
delete_user_credentials(username)
|
||||
|
||||
|
||||
@pytest.mark.integration
|
||||
@pytest.mark.multi_user_basic
|
||||
async def test_credential_revoke_and_reprovision(
|
||||
browser,
|
||||
nc_client,
|
||||
test_users_setup,
|
||||
configure_astrolabe_for_mcp_server,
|
||||
):
|
||||
"""Test that credentials can be revoked and reprovisioned.
|
||||
|
||||
This test verifies:
|
||||
1. User provisions credentials
|
||||
2. User revokes credentials (deletes from database)
|
||||
3. User provisions again with new app password
|
||||
4. New credentials are stored correctly
|
||||
|
||||
Note: The UI prevents overwriting credentials directly - users must
|
||||
revoke first before provisioning new credentials.
|
||||
"""
|
||||
await configure_astrolabe_for_mcp_server(
|
||||
mcp_server_internal_url="http://mcp-multi-user-basic:8000",
|
||||
mcp_server_public_url="http://localhost:8003",
|
||||
)
|
||||
|
||||
username = "alice"
|
||||
user_config = test_users_setup[username]
|
||||
password = user_config["password"]
|
||||
|
||||
delete_user_credentials(username)
|
||||
|
||||
context = await browser.new_context(ignore_https_errors=True)
|
||||
page = await context.new_page()
|
||||
|
||||
try:
|
||||
await login_to_nextcloud(page, username, password)
|
||||
|
||||
# First provisioning
|
||||
app_password_1 = await generate_app_password(page, username, "First Password")
|
||||
await save_app_password_in_astrolabe(page, username, app_password_1)
|
||||
|
||||
# Get first encrypted value
|
||||
query = f"""
|
||||
SELECT configvalue
|
||||
FROM oc_preferences
|
||||
WHERE userid = '{username}'
|
||||
AND appid = 'astrolabe'
|
||||
AND configkey = 'background_sync_password';
|
||||
"""
|
||||
|
||||
result1 = subprocess.run(
|
||||
[
|
||||
"docker",
|
||||
"compose",
|
||||
"exec",
|
||||
"-T",
|
||||
"db",
|
||||
"mariadb",
|
||||
"-u",
|
||||
"root",
|
||||
"-ppassword",
|
||||
"nextcloud",
|
||||
"-N",
|
||||
"-e",
|
||||
query,
|
||||
],
|
||||
capture_output=True,
|
||||
text=True,
|
||||
timeout=10,
|
||||
)
|
||||
first_encrypted = result1.stdout.strip()
|
||||
assert first_encrypted, "First credential should be stored"
|
||||
logger.info("✓ First credential stored")
|
||||
|
||||
# Revoke credentials (simulating user clicking "Revoke Access")
|
||||
delete_user_credentials(username)
|
||||
logger.info("✓ Credentials revoked")
|
||||
|
||||
# Verify credentials are gone
|
||||
creds_after_revoke = get_background_sync_credentials(username)
|
||||
assert creds_after_revoke is None, "Credentials should be deleted after revoke"
|
||||
|
||||
# Second provisioning with different password
|
||||
app_password_2 = await generate_app_password(page, username, "Second Password")
|
||||
await save_app_password_in_astrolabe(page, username, app_password_2)
|
||||
|
||||
result2 = subprocess.run(
|
||||
[
|
||||
"docker",
|
||||
"compose",
|
||||
"exec",
|
||||
"-T",
|
||||
"db",
|
||||
"mariadb",
|
||||
"-u",
|
||||
"root",
|
||||
"-ppassword",
|
||||
"nextcloud",
|
||||
"-N",
|
||||
"-e",
|
||||
query,
|
||||
],
|
||||
capture_output=True,
|
||||
text=True,
|
||||
timeout=10,
|
||||
)
|
||||
second_encrypted = result2.stdout.strip()
|
||||
assert second_encrypted, "Second credential should be stored"
|
||||
logger.info("✓ Second credential stored")
|
||||
|
||||
# Verify the encrypted values are different (different passwords)
|
||||
assert first_encrypted != second_encrypted, (
|
||||
"Different passwords should produce different encrypted values"
|
||||
)
|
||||
|
||||
# Verify only one row exists
|
||||
count_query = f"""
|
||||
SELECT COUNT(*)
|
||||
FROM oc_preferences
|
||||
WHERE userid = '{username}'
|
||||
AND appid = 'astrolabe'
|
||||
AND configkey = 'background_sync_password';
|
||||
"""
|
||||
|
||||
count_result = subprocess.run(
|
||||
[
|
||||
"docker",
|
||||
"compose",
|
||||
"exec",
|
||||
"-T",
|
||||
"db",
|
||||
"mariadb",
|
||||
"-u",
|
||||
"root",
|
||||
"-ppassword",
|
||||
"nextcloud",
|
||||
"-N",
|
||||
"-e",
|
||||
count_query,
|
||||
],
|
||||
capture_output=True,
|
||||
text=True,
|
||||
timeout=10,
|
||||
)
|
||||
count = int(count_result.stdout.strip())
|
||||
assert count == 1, f"Expected 1 credential row, found {count}"
|
||||
logger.info("✓ Verified clean reprovision after revoke")
|
||||
|
||||
finally:
|
||||
await context.close()
|
||||
delete_user_credentials(username)
|
||||
@@ -23,10 +23,11 @@ behaviour separately.
|
||||
"""
|
||||
|
||||
import logging
|
||||
import os
|
||||
import uuid
|
||||
|
||||
import pytest
|
||||
from httpx import HTTPStatusError
|
||||
from httpx import BasicAuth, HTTPStatusError
|
||||
|
||||
from nextcloud_mcp_server.client import NextcloudClient
|
||||
from nextcloud_mcp_server.search import verification
|
||||
@@ -48,6 +49,28 @@ def _result_for_note(note_id: int) -> SearchResult:
|
||||
)
|
||||
|
||||
|
||||
def _result_for_file(file_id: int, path: str) -> SearchResult:
|
||||
# Mirrors what the algorithm layer propagates: doc_id IS the global file id,
|
||||
# ``path`` is carried in metadata (owner-relative) for log context only.
|
||||
return SearchResult(
|
||||
id=file_id,
|
||||
doc_type="file",
|
||||
title=path.split("/")[-1],
|
||||
excerpt="...",
|
||||
score=0.9,
|
||||
metadata={"path": path},
|
||||
)
|
||||
|
||||
|
||||
def _user_client(username: str, password: str) -> NextcloudClient:
|
||||
return NextcloudClient(
|
||||
base_url=os.environ["NEXTCLOUD_HOST"],
|
||||
username=username,
|
||||
auth=BasicAuth(username, password),
|
||||
password=password,
|
||||
)
|
||||
|
||||
|
||||
async def test_verify_keeps_accessible_note(
|
||||
nc_client: NextcloudClient, temporary_note: dict, mocker
|
||||
):
|
||||
@@ -170,3 +193,95 @@ async def test_verify_dedupes_chunks_of_same_document(
|
||||
assert dropped_count == 0
|
||||
# ...but verification only fetched the note ONCE
|
||||
assert spy_get_note.await_count == 1
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# File verifier — cross-user shared access (ACL-aware search, PR #813)
|
||||
# ---------------------------------------------------------------------------
|
||||
#
|
||||
# These exercise the verifier fix that makes ACL-aware search actually work
|
||||
# end-to-end: a file an owner shared with another user must survive
|
||||
# verify-on-read for the *recipient*, even when it lives in a subfolder of the
|
||||
# owner's tree (Nextcloud mounts received shares at the recipient's root by
|
||||
# basename, so the owner-relative path does NOT resolve under the recipient's
|
||||
# root). The fix verifies by global file id, which is ACL-aware.
|
||||
|
||||
|
||||
@pytest.fixture
|
||||
async def alice_bob_clients(test_users_setup):
|
||||
"""Direct NextcloudClients for alice (owner) and bob (recipient)."""
|
||||
alice = _user_client("alice", test_users_setup["alice"]["password"])
|
||||
bob = _user_client("bob", test_users_setup["bob"]["password"])
|
||||
try:
|
||||
yield alice, bob
|
||||
finally:
|
||||
await alice._client.aclose()
|
||||
await bob._client.aclose()
|
||||
|
||||
|
||||
async def test_verify_keeps_nested_file_shared_with_recipient(
|
||||
alice_bob_clients, mocker
|
||||
):
|
||||
"""The PR #813 acceptance check at the verifier layer.
|
||||
|
||||
Alice owns a file in a *subfolder* and shares it with Bob. Verifying the
|
||||
result as Bob must KEEP it — proving the id-based check sees the share.
|
||||
A path-based check (the old behaviour) would 404 here and wrongly drop it.
|
||||
"""
|
||||
spy_evict = mocker.AsyncMock()
|
||||
mocker.patch.object(verification, "delete_document_points", spy_evict)
|
||||
|
||||
alice, bob = alice_bob_clients
|
||||
suffix = uuid.uuid4().hex[:8]
|
||||
test_dir = f"acl_verify_{suffix}"
|
||||
nested_dir = f"{test_dir}/reports"
|
||||
shared_path = f"{nested_dir}/shared.txt"
|
||||
|
||||
await alice.webdav.create_directory(test_dir)
|
||||
await alice.webdav.create_directory(nested_dir)
|
||||
await alice.webdav.write_file(shared_path, b"alice's shared report", "text/plain")
|
||||
file_id = (await alice.webdav.get_file_info(shared_path))["id"]
|
||||
|
||||
await alice.sharing.create_share(
|
||||
path=f"/{shared_path}", share_with="bob", share_type=0, permissions=1
|
||||
)
|
||||
|
||||
try:
|
||||
kept, dropped_count = await verify_search_results(
|
||||
bob, [_result_for_file(file_id, shared_path)]
|
||||
)
|
||||
|
||||
assert [r.id for r in kept] == [file_id], (
|
||||
"a nested file shared with bob must pass verification for bob"
|
||||
)
|
||||
assert dropped_count == 0
|
||||
spy_evict.assert_not_awaited()
|
||||
finally:
|
||||
await alice.webdav.delete_resource(test_dir)
|
||||
|
||||
|
||||
async def test_verify_drops_unshared_file_for_other_user(alice_bob_clients, mocker):
|
||||
"""Negative control: a file Alice did NOT share is inaccessible to Bob and
|
||||
must be dropped + scheduled for eviction under his identity."""
|
||||
spy_evict = mocker.AsyncMock()
|
||||
mocker.patch.object(verification, "delete_document_points", spy_evict)
|
||||
|
||||
alice, bob = alice_bob_clients
|
||||
suffix = uuid.uuid4().hex[:8]
|
||||
test_dir = f"acl_verify_priv_{suffix}"
|
||||
private_path = f"{test_dir}/private.txt"
|
||||
|
||||
await alice.webdav.create_directory(test_dir)
|
||||
await alice.webdav.write_file(private_path, b"alice's private note", "text/plain")
|
||||
file_id = (await alice.webdav.get_file_info(private_path))["id"]
|
||||
|
||||
try:
|
||||
kept, dropped_count = await verify_search_results(
|
||||
bob, [_result_for_file(file_id, private_path)]
|
||||
)
|
||||
|
||||
assert kept == [], "an unshared file must not pass verification for bob"
|
||||
assert dropped_count == 1
|
||||
spy_evict.assert_awaited_once_with(file_id, "file", bob.username)
|
||||
finally:
|
||||
await alice.webdav.delete_resource(test_dir)
|
||||
|
||||
@@ -0,0 +1,188 @@
|
||||
"""Tests for nextcloud_mcp_server.search.access_filter."""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
from unittest.mock import AsyncMock
|
||||
|
||||
import pytest
|
||||
|
||||
from nextcloud_mcp_server.search import access_filter
|
||||
from nextcloud_mcp_server.search.access_filter import (
|
||||
build_ownership_filter,
|
||||
clear_accessible_owners_cache,
|
||||
list_accessible_owners,
|
||||
)
|
||||
|
||||
|
||||
@pytest.fixture(autouse=True)
|
||||
def _reset_owners_cache():
|
||||
"""The accessible-owners cache is process-global; reset it around each test
|
||||
so the shared "alice" user_id can't leak cached results between tests."""
|
||||
clear_accessible_owners_cache()
|
||||
yield
|
||||
clear_accessible_owners_cache()
|
||||
|
||||
|
||||
class TestListAccessibleOwners:
|
||||
@pytest.mark.unit
|
||||
async def test_includes_self_even_with_no_shares(self) -> None:
|
||||
sharing = AsyncMock()
|
||||
sharing.list_shares.return_value = []
|
||||
|
||||
owners = await list_accessible_owners(sharing, "alice")
|
||||
assert owners == ["alice"]
|
||||
|
||||
@pytest.mark.unit
|
||||
async def test_collects_uid_owner_from_shares(self) -> None:
|
||||
sharing = AsyncMock()
|
||||
sharing.list_shares.return_value = [
|
||||
{"uid_owner": "bob", "share_with": "alice"},
|
||||
{"uid_owner": "carol", "share_with": "alice"},
|
||||
]
|
||||
|
||||
owners = await list_accessible_owners(sharing, "alice")
|
||||
assert set(owners) == {"alice", "bob", "carol"}
|
||||
|
||||
@pytest.mark.unit
|
||||
async def test_deduplicates_repeated_owners(self) -> None:
|
||||
sharing = AsyncMock()
|
||||
sharing.list_shares.return_value = [
|
||||
{"uid_owner": "bob"},
|
||||
{"uid_owner": "bob"}, # same owner shares many files
|
||||
{"uid_owner": "bob"},
|
||||
]
|
||||
|
||||
owners = await list_accessible_owners(sharing, "alice")
|
||||
assert sorted(owners) == ["alice", "bob"]
|
||||
|
||||
@pytest.mark.unit
|
||||
async def test_falls_back_to_owner_field_when_uid_owner_missing(self) -> None:
|
||||
# Some Nextcloud versions surface `owner` instead of `uid_owner`
|
||||
# on the shared-with-me response.
|
||||
sharing = AsyncMock()
|
||||
sharing.list_shares.return_value = [{"owner": "bob"}]
|
||||
|
||||
owners = await list_accessible_owners(sharing, "alice")
|
||||
assert sorted(owners) == ["alice", "bob"]
|
||||
|
||||
@pytest.mark.unit
|
||||
async def test_ignores_share_with_no_owner_field(self) -> None:
|
||||
sharing = AsyncMock()
|
||||
sharing.list_shares.return_value = [
|
||||
{"id": 42}, # malformed share entry
|
||||
{"uid_owner": "bob"},
|
||||
{"uid_owner": 12345}, # non-string owner — skip
|
||||
]
|
||||
|
||||
owners = await list_accessible_owners(sharing, "alice")
|
||||
assert sorted(owners) == ["alice", "bob"]
|
||||
|
||||
@pytest.mark.unit
|
||||
async def test_degrades_to_self_on_sharing_api_failure(self) -> None:
|
||||
sharing = AsyncMock()
|
||||
sharing.list_shares.side_effect = RuntimeError("OCS down")
|
||||
|
||||
owners = await list_accessible_owners(sharing, "alice")
|
||||
# Fail-open to "self only" rather than blowing up search.
|
||||
assert owners == ["alice"]
|
||||
|
||||
@pytest.mark.unit
|
||||
async def test_calls_shared_with_me(self) -> None:
|
||||
sharing = AsyncMock()
|
||||
sharing.list_shares.return_value = []
|
||||
|
||||
await list_accessible_owners(sharing, "alice")
|
||||
sharing.list_shares.assert_awaited_once_with(shared_with_me=True)
|
||||
|
||||
|
||||
class TestOwnersCacheBehavior:
|
||||
@pytest.mark.unit
|
||||
async def test_second_call_within_ttl_uses_cache(self) -> None:
|
||||
sharing = AsyncMock()
|
||||
sharing.list_shares.return_value = [{"uid_owner": "bob"}]
|
||||
|
||||
first = await list_accessible_owners(sharing, "alice")
|
||||
second = await list_accessible_owners(sharing, "alice")
|
||||
|
||||
assert sorted(first) == ["alice", "bob"]
|
||||
assert second == first
|
||||
# Only one OCS round-trip — the second call was served from cache.
|
||||
sharing.list_shares.assert_awaited_once()
|
||||
|
||||
@pytest.mark.unit
|
||||
async def test_expired_entry_triggers_fresh_ocs_call(self) -> None:
|
||||
sharing = AsyncMock()
|
||||
sharing.list_shares.return_value = [{"uid_owner": "bob"}]
|
||||
|
||||
await list_accessible_owners(sharing, "alice")
|
||||
# Age the cached entry past the TTL without sleeping/patching the clock.
|
||||
ts, value = access_filter._owners_cache["alice"]
|
||||
access_filter._owners_cache["alice"] = (
|
||||
ts - access_filter._OWNERS_CACHE_TTL_SECONDS - 1.0,
|
||||
value,
|
||||
)
|
||||
await list_accessible_owners(sharing, "alice")
|
||||
|
||||
assert sharing.list_shares.await_count == 2
|
||||
|
||||
@pytest.mark.unit
|
||||
async def test_failure_is_not_cached(self) -> None:
|
||||
sharing = AsyncMock()
|
||||
sharing.list_shares.side_effect = RuntimeError("OCS down")
|
||||
|
||||
await list_accessible_owners(sharing, "alice") # degrades to self-only
|
||||
# A later success must not be masked by a cached failure.
|
||||
sharing.list_shares.side_effect = None
|
||||
sharing.list_shares.return_value = [{"uid_owner": "bob"}]
|
||||
|
||||
owners = await list_accessible_owners(sharing, "alice")
|
||||
assert sorted(owners) == ["alice", "bob"]
|
||||
|
||||
@pytest.mark.unit
|
||||
async def test_cache_is_bounded_lru(self, monkeypatch) -> None:
|
||||
monkeypatch.setattr(access_filter, "_OWNERS_CACHE_MAXSIZE", 2)
|
||||
sharing = AsyncMock()
|
||||
sharing.list_shares.return_value = []
|
||||
|
||||
await list_accessible_owners(sharing, "u1")
|
||||
await list_accessible_owners(sharing, "u2")
|
||||
await list_accessible_owners(sharing, "u3") # evicts u1 (least recent)
|
||||
|
||||
assert set(access_filter._owners_cache.keys()) == {"u2", "u3"}
|
||||
assert len(access_filter._owners_cache) == 2
|
||||
|
||||
|
||||
class TestBuildOwnershipFilter:
|
||||
def test_defaults_to_self_only_when_owners_omitted(self) -> None:
|
||||
flt = build_ownership_filter("alice")
|
||||
|
||||
# Self-only: just the user_id branch. Self is NOT duplicated into an
|
||||
# owner_id branch (the user_id branch already covers self-owned content).
|
||||
assert flt.should is not None
|
||||
assert len(flt.should) == 1
|
||||
(user_branch,) = flt.should
|
||||
assert user_branch.key == "user_id"
|
||||
assert user_branch.match.value == "alice"
|
||||
|
||||
def test_expands_owner_branch_with_accessible_owners(self) -> None:
|
||||
flt = build_ownership_filter("alice", ["alice", "bob", "carol"])
|
||||
|
||||
owner_branch, user_branch = flt.should
|
||||
# Owner branch holds only the OTHER owners — self ("alice") is excluded
|
||||
# because the user_id branch already matches self-owned content.
|
||||
assert set(owner_branch.match.any) == {"bob", "carol"}
|
||||
assert user_branch.key == "user_id"
|
||||
assert user_branch.match.value == "alice"
|
||||
|
||||
def test_explicit_empty_list_omits_owner_branch_keeps_legacy(self) -> None:
|
||||
# Edge case: caller passed an explicit empty list. The owner_id branch
|
||||
# is omitted entirely (rather than relying on MatchAny(any=[]) matching
|
||||
# nothing); the legacy user_id branch remains as the safety net so the
|
||||
# user still finds their own content from before the migration.
|
||||
flt = build_ownership_filter("alice", [])
|
||||
|
||||
assert flt.should is not None
|
||||
assert len(flt.should) == 1
|
||||
(user_branch,) = flt.should
|
||||
assert user_branch.key == "user_id"
|
||||
assert user_branch.match.value == "alice"
|
||||
@@ -438,10 +438,16 @@ async def test_verify_news_items_malformed_api_response_keeps_all(mocker):
|
||||
|
||||
|
||||
@pytest.mark.unit
|
||||
async def test_verify_files_uses_path_from_metadata(mocker):
|
||||
"""File verifier reads path from SearchResult.metadata, no Qdrant round-trip."""
|
||||
async def test_verify_files_accessible_by_global_id_is_kept(mocker):
|
||||
"""File verifier resolves the file by its global ID (the doc_id), ACL-aware.
|
||||
|
||||
This is what lets a recipient verify a file an owner shared with them:
|
||||
file_accessible_by_id searches the user's whole tree (incl. mounted
|
||||
shares) by global file id, not a path under the caller's own root (which
|
||||
would 404 on shared files mounted at a different path).
|
||||
"""
|
||||
webdav_client = SimpleNamespace(
|
||||
get_file_info=mocker.AsyncMock(return_value={"id": 100})
|
||||
file_accessible_by_id=mocker.AsyncMock(return_value=True)
|
||||
)
|
||||
client = SimpleNamespace(webdav=webdav_client, username="alice")
|
||||
|
||||
@@ -452,14 +458,15 @@ async def test_verify_files_uses_path_from_metadata(mocker):
|
||||
)
|
||||
|
||||
assert result == {"100"}
|
||||
webdav_client.get_file_info.assert_awaited_once_with("Documents/foo.txt")
|
||||
webdav_client.file_accessible_by_id.assert_awaited_once_with(100)
|
||||
|
||||
|
||||
@pytest.mark.unit
|
||||
async def test_verify_files_404_drops(mocker):
|
||||
"""get_file_info raising HTTPStatusError(404) is a definitive drop."""
|
||||
async def test_verify_files_inaccessible_id_drops(mocker):
|
||||
"""file_accessible_by_id returning False (file not in the user's tree) is a
|
||||
definitive drop — the file is neither owned by nor shared with the user."""
|
||||
webdav_client = SimpleNamespace(
|
||||
get_file_info=mocker.AsyncMock(side_effect=_http_error(404))
|
||||
file_accessible_by_id=mocker.AsyncMock(return_value=False)
|
||||
)
|
||||
client = SimpleNamespace(webdav=webdav_client, username="alice")
|
||||
|
||||
@@ -473,68 +480,49 @@ async def test_verify_files_404_drops(mocker):
|
||||
|
||||
|
||||
@pytest.mark.unit
|
||||
async def test_verify_files_malformed_propfind_keeps_result(mocker):
|
||||
"""get_file_info returning None means malformed PROPFIND — keep the result.
|
||||
async def test_verify_files_403_404_drops(mocker):
|
||||
"""A 403/404 raised by the SEARCH call is treated as a definitive drop,
|
||||
consistent with the shared _is_definitive_404_or_403 policy used by every
|
||||
verifier. (Normal inaccessibility surfaces as an empty result set, not a
|
||||
status code, and is covered by test_verify_files_inaccessible_id_drops.)"""
|
||||
for status in (403, 404):
|
||||
webdav_client = SimpleNamespace(
|
||||
file_accessible_by_id=mocker.AsyncMock(side_effect=_http_error(status))
|
||||
)
|
||||
client = SimpleNamespace(webdav=webdav_client, username="alice")
|
||||
|
||||
Per the contract change in webdav.py: ``None`` is now reserved for the
|
||||
ambiguous "malformed XML" case. Real 404s raise HTTPStatusError. The
|
||||
file verifier must NOT evict on the ambiguous case (we cannot tell
|
||||
whether the file exists), only log a warning and keep the result.
|
||||
"""
|
||||
webdav_client = SimpleNamespace(get_file_info=mocker.AsyncMock(return_value=None))
|
||||
client = SimpleNamespace(webdav=webdav_client, username="alice")
|
||||
result = await _verify_files(
|
||||
client,
|
||||
[_make_result(124, doc_type="file", metadata={"path": "x.txt"})],
|
||||
_sem(),
|
||||
)
|
||||
|
||||
result = await _verify_files(
|
||||
client,
|
||||
[_make_result(123, doc_type="file", metadata={"path": "brittle.txt"})],
|
||||
_sem(),
|
||||
)
|
||||
|
||||
assert result == {"123"}, "ambiguous None must keep result, not evict"
|
||||
assert result == set(), f"{status} on the SEARCH call must drop"
|
||||
|
||||
|
||||
@pytest.mark.unit
|
||||
async def test_verify_files_403_drops(mocker):
|
||||
"""get_file_info raising HTTPStatusError(403) is a definitive drop."""
|
||||
async def test_verify_files_non_numeric_id_keeps_unverified(mocker):
|
||||
"""Without a numeric file id we cannot verify — fail open, don't drop."""
|
||||
webdav_client = SimpleNamespace(
|
||||
get_file_info=mocker.AsyncMock(side_effect=_http_error(403))
|
||||
file_accessible_by_id=mocker.AsyncMock(
|
||||
side_effect=AssertionError("must not be called")
|
||||
)
|
||||
)
|
||||
client = SimpleNamespace(webdav=webdav_client, username="alice")
|
||||
|
||||
result = await _verify_files(
|
||||
client,
|
||||
[_make_result(124, doc_type="file", metadata={"path": "forbidden.txt"})],
|
||||
[_make_result("not-a-file-id", doc_type="file", metadata={"path": "x.txt"})],
|
||||
_sem(),
|
||||
)
|
||||
|
||||
assert result == set()
|
||||
|
||||
|
||||
@pytest.mark.unit
|
||||
async def test_verify_files_missing_path_metadata_keeps_unverified(mocker):
|
||||
"""Without a path in metadata we cannot verify — fail open, don't drop."""
|
||||
webdav_client = SimpleNamespace(
|
||||
get_file_info=mocker.AsyncMock(side_effect=AssertionError("must not be called"))
|
||||
)
|
||||
client = SimpleNamespace(webdav=webdav_client, username="alice")
|
||||
|
||||
# No metadata at all
|
||||
result = await _verify_files(client, [_make_result(555, doc_type="file")], _sem())
|
||||
assert result == {"555"}
|
||||
webdav_client.get_file_info.assert_not_awaited()
|
||||
|
||||
# Metadata present but no "path" key
|
||||
result = await _verify_files(
|
||||
client, [_make_result(556, doc_type="file", metadata={})], _sem()
|
||||
)
|
||||
assert result == {"556"}
|
||||
webdav_client.get_file_info.assert_not_awaited()
|
||||
assert result == {"not-a-file-id"}
|
||||
webdav_client.file_accessible_by_id.assert_not_awaited()
|
||||
|
||||
|
||||
@pytest.mark.unit
|
||||
async def test_verify_files_transient_5xx_keeps(mocker):
|
||||
webdav_client = SimpleNamespace(
|
||||
get_file_info=mocker.AsyncMock(side_effect=_http_error(503))
|
||||
file_accessible_by_id=mocker.AsyncMock(side_effect=_http_error(503))
|
||||
)
|
||||
client = SimpleNamespace(webdav=webdav_client, username="alice")
|
||||
|
||||
@@ -549,9 +537,9 @@ async def test_verify_files_transient_5xx_keeps(mocker):
|
||||
|
||||
@pytest.mark.unit
|
||||
async def test_verify_files_429_keeps_as_transient(mocker):
|
||||
"""HTTP 429 from get_file_info must NOT silently drop file results."""
|
||||
"""HTTP 429 from the SEARCH call must NOT silently drop file results."""
|
||||
webdav_client = SimpleNamespace(
|
||||
get_file_info=mocker.AsyncMock(side_effect=_http_error(429))
|
||||
file_accessible_by_id=mocker.AsyncMock(side_effect=_http_error(429))
|
||||
)
|
||||
client = SimpleNamespace(webdav=webdav_client, username="alice")
|
||||
|
||||
@@ -566,14 +554,14 @@ async def test_verify_files_429_keeps_as_transient(mocker):
|
||||
|
||||
@pytest.mark.unit
|
||||
async def test_verify_files_unexpected_exception_keeps(mocker):
|
||||
"""A non-HTTP exception from get_file_info must not drop the result.
|
||||
"""A non-HTTP exception from file_accessible_by_id must not drop the result.
|
||||
|
||||
The catch-all ``except Exception`` branch in the file verifier exists
|
||||
so a bug in the WebDAV client (or an httpx ConnectError on a flaky
|
||||
network) cannot silently shrink result pages.
|
||||
"""
|
||||
webdav_client = SimpleNamespace(
|
||||
get_file_info=mocker.AsyncMock(side_effect=RuntimeError("dav blew up"))
|
||||
file_accessible_by_id=mocker.AsyncMock(side_effect=RuntimeError("dav blew up"))
|
||||
)
|
||||
client = SimpleNamespace(webdav=webdav_client, username="alice")
|
||||
|
||||
@@ -886,6 +874,37 @@ async def test_verify_search_results_drops_inaccessible_and_evicts(mocker):
|
||||
spy_evict.assert_awaited_once_with("99", "note", "alice")
|
||||
|
||||
|
||||
@pytest.mark.unit
|
||||
async def test_verify_evicts_cross_user_file_under_querying_user_id(mocker):
|
||||
"""A shared file the recipient can no longer access is evicted under the
|
||||
QUERYING user's id, never the owner's.
|
||||
|
||||
This guards the cross-user eviction no-op: a point owned by alice
|
||||
(user_id=alice) surfaced to bob via accessible_owners and then found
|
||||
inaccessible must be evicted with user_id=bob — which deletes nothing of
|
||||
alice's (her points carry user_id=alice). So a recipient's revoked access
|
||||
can never delete the owner's index entries; bob's view self-heals via
|
||||
list_accessible_owners instead. A future change that evicted under the
|
||||
owner's id would corrupt the owner's index, and this test would catch it.
|
||||
"""
|
||||
spy_evict = mocker.AsyncMock()
|
||||
mocker.patch.object(verification, "delete_document_points", spy_evict)
|
||||
|
||||
webdav_client = SimpleNamespace(
|
||||
file_accessible_by_id=mocker.AsyncMock(return_value=False)
|
||||
)
|
||||
client = SimpleNamespace(webdav=webdav_client, username="bob")
|
||||
|
||||
kept, dropped_count = await verify_search_results(
|
||||
client,
|
||||
[_make_result(777, doc_type="file", metadata={"path": "shared.txt"})],
|
||||
)
|
||||
|
||||
assert kept == []
|
||||
assert dropped_count == 1
|
||||
spy_evict.assert_awaited_once_with("777", "file", "bob")
|
||||
|
||||
|
||||
@pytest.mark.unit
|
||||
async def test_verify_search_results_fire_and_forget_eviction(mocker):
|
||||
"""When eviction_task_group is provided, eviction does not block the response.
|
||||
|
||||
@@ -68,7 +68,11 @@ class TestIndexedPath:
|
||||
# One scroll call, and the filter must include chunk_index (not offsets)
|
||||
qdrant_client.scroll.assert_awaited_once()
|
||||
scroll_kwargs = qdrant_client.scroll.await_args.kwargs
|
||||
filter_keys = [c.key for c in scroll_kwargs["scroll_filter"].must]
|
||||
# Skip nested Filters (the ACL ownership sub-filter) — only field
|
||||
# conditions carry a `.key`.
|
||||
filter_keys = [
|
||||
c.key for c in scroll_kwargs["scroll_filter"].must if hasattr(c, "key")
|
||||
]
|
||||
assert "chunk_index" in filter_keys
|
||||
assert "chunk_start_offset" not in filter_keys
|
||||
assert "chunk_end_offset" not in filter_keys
|
||||
@@ -92,7 +96,11 @@ class TestOffsetFallbackPath:
|
||||
|
||||
assert result == (bbox, 2)
|
||||
scroll_kwargs = qdrant_client.scroll.await_args.kwargs
|
||||
filter_keys = [c.key for c in scroll_kwargs["scroll_filter"].must]
|
||||
# Skip nested Filters (the ACL ownership sub-filter) — only field
|
||||
# conditions carry a `.key`.
|
||||
filter_keys = [
|
||||
c.key for c in scroll_kwargs["scroll_filter"].must if hasattr(c, "key")
|
||||
]
|
||||
assert "chunk_start_offset" in filter_keys
|
||||
assert "chunk_end_offset" in filter_keys
|
||||
assert "chunk_index" not in filter_keys
|
||||
|
||||
@@ -151,6 +151,45 @@ async def test_poll_expired(flow_client):
|
||||
assert result.app_password is None
|
||||
|
||||
|
||||
async def test_initiate_rewrites_login_url_to_public_host():
|
||||
"""When server↔Nextcloud uses an internal host (e.g. the ``app`` Docker
|
||||
service), the browser-facing login URL must be rewritten to the configured
|
||||
public host; the poll endpoint stays on the internal host for server-side
|
||||
polling. Mock URLs use https to match this file's convention (the rewrite
|
||||
is scheme-agnostic, so this exercises the same origin-replacement logic)."""
|
||||
client = LoginFlowV2Client(
|
||||
nextcloud_host="https://nc-internal.test", # server↔Nextcloud origin
|
||||
verify_ssl=False,
|
||||
public_host="https://cloud.example.com", # browser-reachable origin
|
||||
)
|
||||
mock_response = _mock_response(
|
||||
200,
|
||||
{
|
||||
# Nextcloud builds these from the request (internal) host.
|
||||
"login": "https://nc-internal.test/login/v2/flow/tok123",
|
||||
"poll": {
|
||||
"endpoint": "https://nc-internal.test/login/v2/poll",
|
||||
"token": "tok", # value irrelevant here; this test asserts the URLs
|
||||
},
|
||||
},
|
||||
)
|
||||
mock_client = AsyncMock()
|
||||
mock_client.post.return_value = mock_response
|
||||
mock_client.__aenter__ = AsyncMock(return_value=mock_client)
|
||||
mock_client.__aexit__ = AsyncMock(return_value=False)
|
||||
|
||||
with patch(
|
||||
"nextcloud_mcp_server.auth.login_flow.nextcloud_httpx_client",
|
||||
return_value=mock_client,
|
||||
):
|
||||
result = await client.initiate()
|
||||
|
||||
# Browser-facing URL uses the public host...
|
||||
assert result.login_url == "https://cloud.example.com/login/v2/flow/tok123"
|
||||
# ...while the poll endpoint stays on the internal host (server polls it).
|
||||
assert result.poll_endpoint == "https://nc-internal.test/login/v2/poll"
|
||||
|
||||
|
||||
async def test_initiate_with_custom_user_agent(flow_client):
|
||||
"""Test that custom user agent is passed in the request."""
|
||||
mock_response = _mock_response(
|
||||
|
||||
@@ -180,6 +180,25 @@ async def test_provision_app_password_invalid_format():
|
||||
assert "Invalid app password format" in response.json()["error"]
|
||||
|
||||
|
||||
def test_app_password_pattern_accepts_dashed_and_raw_tokens():
|
||||
"""The format guard accepts both the dashed Security-settings format and
|
||||
the raw token from the one-click ``core/getapppassword`` flow, and still
|
||||
rejects short / illegal-character input."""
|
||||
from nextcloud_mcp_server.api.passwords import APP_PASSWORD_PATTERN
|
||||
|
||||
# Dashed format a user copies from Security settings.
|
||||
assert APP_PASSWORD_PATTERN.match("abcde-ABCDE-12345-fghij-67890")
|
||||
# Raw 72-char token returned by core/getapppassword (one-click opt-in).
|
||||
assert APP_PASSWORD_PATTERN.match(
|
||||
"kZmgLDQnqQHUAxhRq4d2VssBfjsI0PaHbL4JySWtwJkzVgAf34c0sZshEjZjuj1PLbwrf83q"
|
||||
)
|
||||
# Still rejects obviously-bad input.
|
||||
assert not APP_PASSWORD_PATTERN.match("short")
|
||||
assert not APP_PASSWORD_PATTERN.match("invalid-password") # < 20 chars
|
||||
assert not APP_PASSWORD_PATTERN.match("has spaces not allowed in this token")
|
||||
assert not APP_PASSWORD_PATTERN.match("contains/slash/" + "a" * 20)
|
||||
|
||||
|
||||
async def test_provision_app_password_success(temp_storage, mocker):
|
||||
"""Test successful app password provisioning."""
|
||||
# Mock settings (imported locally in the function)
|
||||
|
||||
@@ -0,0 +1,93 @@
|
||||
"""Unit tests for app-password-store awareness in the provisioning tools.
|
||||
|
||||
Login Flow v2 (nc_auth_provision_access) and the management app-password API
|
||||
write the credential to this server's ``app_passwords`` store — the same store
|
||||
``require_provisioning``/``get_client`` use to grant tool access. The OAuth
|
||||
provisioning tools (check_provisioning_status / revoke_nextcloud_access) must
|
||||
read and clear that store too, otherwise they report "not provisioned" while
|
||||
tools still work, and "nothing to revoke" while the credential persists.
|
||||
"""
|
||||
|
||||
from types import SimpleNamespace
|
||||
from unittest.mock import AsyncMock, MagicMock
|
||||
|
||||
import pytest
|
||||
|
||||
from nextcloud_mcp_server.server import oauth_tools
|
||||
from nextcloud_mcp_server.server.oauth_tools import (
|
||||
_get_provisioning_status,
|
||||
_revoke_nextcloud_access,
|
||||
)
|
||||
|
||||
pytestmark = pytest.mark.unit
|
||||
|
||||
|
||||
@pytest.fixture
|
||||
def _no_astrolabe_settings(mocker):
|
||||
"""Disable the astrolabe-status branch so the app_passwords store is hit."""
|
||||
mocker.patch.object(
|
||||
oauth_tools,
|
||||
"get_settings",
|
||||
return_value=SimpleNamespace(oidc_client_id=None, oidc_client_secret=None),
|
||||
)
|
||||
|
||||
|
||||
async def test_status_reports_provisioned_for_app_password_store(
|
||||
mocker, _no_astrolabe_settings
|
||||
):
|
||||
"""A Login Flow v2 app password in storage => is_provisioned with the
|
||||
app_password credential type (was previously reported as not provisioned)."""
|
||||
storage = MagicMock()
|
||||
# Only truthiness + "scopes" are read by _get_provisioning_status; omit the
|
||||
# app_password value entirely (avoids a false-positive hard-coded-credential
|
||||
# finding and keeps the mock to what the code under test actually uses).
|
||||
storage.get_app_password_with_scopes = AsyncMock(
|
||||
return_value={"scopes": ["notes.read"]}
|
||||
)
|
||||
storage.get_refresh_token = AsyncMock(return_value=None)
|
||||
mocker.patch.object(
|
||||
oauth_tools, "get_shared_storage", AsyncMock(return_value=storage)
|
||||
)
|
||||
|
||||
status = await _get_provisioning_status(MagicMock(), "tester")
|
||||
|
||||
assert status.is_provisioned is True
|
||||
assert status.credential_type == "app_password"
|
||||
assert status.flow_type == "login_flow_v2"
|
||||
assert status.scopes == ["notes.read"]
|
||||
storage.get_refresh_token.assert_not_awaited() # app password short-circuits
|
||||
|
||||
|
||||
async def test_revoke_deletes_app_password(mocker, _no_astrolabe_settings):
|
||||
"""Revoke must delete the app password from storage (not just refresh tokens)."""
|
||||
storage = MagicMock()
|
||||
storage.get_app_password_with_scopes = AsyncMock(return_value={"scopes": None})
|
||||
storage.get_refresh_token = AsyncMock(return_value=None)
|
||||
storage.delete_app_password = AsyncMock(return_value=True)
|
||||
mocker.patch.object(
|
||||
oauth_tools, "get_shared_storage", AsyncMock(return_value=storage)
|
||||
)
|
||||
mocker.patch.object(oauth_tools, "invalidate_scope_cache")
|
||||
|
||||
result = await _revoke_nextcloud_access(MagicMock(), "tester")
|
||||
|
||||
assert result.success is True
|
||||
storage.delete_app_password.assert_awaited_once_with("tester")
|
||||
oauth_tools.invalidate_scope_cache.assert_called_once_with("tester")
|
||||
|
||||
|
||||
async def test_revoke_noop_when_nothing_provisioned(mocker, _no_astrolabe_settings):
|
||||
"""No credential of any kind => graceful no-op, no deletion attempted."""
|
||||
storage = MagicMock()
|
||||
storage.get_app_password_with_scopes = AsyncMock(return_value=None)
|
||||
storage.get_refresh_token = AsyncMock(return_value=None)
|
||||
storage.delete_app_password = AsyncMock()
|
||||
mocker.patch.object(
|
||||
oauth_tools, "get_shared_storage", AsyncMock(return_value=storage)
|
||||
)
|
||||
|
||||
result = await _revoke_nextcloud_access(MagicMock(), "tester")
|
||||
|
||||
assert result.success is True
|
||||
assert "No Nextcloud access to revoke" in result.message
|
||||
storage.delete_app_password.assert_not_awaited()
|
||||
Reference in New Issue
Block a user