ryan
b02bf0a6df
The container ran Obsidian Sync in pull-only mode, so notes, tasks and journal entries the agent wrote stayed in its local copy. OBSIDIAN_SYNC_MODE now defaults to bidirectional (merge on conflict); pull-only and mirror-remote remain available. Blue and green share the vault volume, and two sync clients writing one vault and its sync state would race during a deploy. Setup and sync now run under a flock on a file in the vault, so a new container starts syncing only after the old container's sync process exits. Clearing Obsidian's stale sync lock is safe inside that lock. Setup runs in the background, so startup no longer waits for Obsidian login. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
320 lines
11 KiB
Python
320 lines
11 KiB
Python
"""Startup policy and the environment contract shared by blue/green services."""
|
|
|
|
import base64
|
|
import json
|
|
import os
|
|
import shutil
|
|
import subprocess
|
|
import sys
|
|
from pathlib import Path
|
|
|
|
import pytest
|
|
|
|
from config.validation import ConfigurationError, validate_configuration
|
|
|
|
ROOT = Path(__file__).resolve().parents[2]
|
|
|
|
|
|
@pytest.fixture
|
|
def production_env():
|
|
return {
|
|
"DATABASE_URL": "postgres://raggr:a-random-test-password@postgres:5432/raggr",
|
|
"JWT_SECRET_KEY": "a-long-test-signing-secret-with-32-characters",
|
|
"FERNET_KEY": base64.urlsafe_b64encode(bytes(range(32))).decode(),
|
|
"OPENAI_API_KEY": "synthetic-test-api-key",
|
|
}
|
|
|
|
|
|
def test_optional_integrations_are_not_required(production_env):
|
|
validate_configuration(production_env)
|
|
validate_configuration({}, production=False)
|
|
|
|
|
|
@pytest.mark.parametrize(
|
|
"name", ["DATABASE_URL", "JWT_SECRET_KEY", "FERNET_KEY", "OPENAI_API_KEY"]
|
|
)
|
|
def test_missing_required_settings(production_env, name):
|
|
del production_env[name]
|
|
with pytest.raises(ConfigurationError, match=name):
|
|
validate_configuration(production_env)
|
|
|
|
|
|
@pytest.mark.parametrize(
|
|
"name,value",
|
|
[
|
|
("JWT_SECRET_KEY", "SECRET_KEY"),
|
|
("JWT_SECRET_KEY", "your-" + "x" * 40),
|
|
("JWT_SECRET_KEY", "short"),
|
|
("OPENAI_API_KEY", "your-openai-api-key"),
|
|
("FERNET_KEY", "not-base64"),
|
|
("FERNET_KEY", base64.urlsafe_b64encode(b"short").decode()),
|
|
("FERNET_KEY", base64.b64encode(b"\xff" * 32).decode()),
|
|
("DATABASE_URL", "sqlite://test.db"),
|
|
("DATABASE_URL", "postgres://raggr:change%6de@postgres/raggr"),
|
|
("DATABASE_URL", "postgres://raggr:password@postgres/raggr"),
|
|
("DATABASE_URL", "postgres://raggr:strong@postgres:70000/raggr"),
|
|
("DATABASE_URL", "postgres://raggr@postgres/raggr"),
|
|
("LLAMA_SERVER_URL", "localhost:8080/v1"),
|
|
("EMBEDDING_SERVER_URL", "http://server:invalid/v1"),
|
|
("LLAMA_SERVER_URL", "http://user:private@server/v1"),
|
|
("LLAMA_MODEL_NAME", ""),
|
|
("METRICS_TOKEN", "short"),
|
|
("CHECKPOINT_DB_PATH", ":memory:"),
|
|
("CHECKPOINT_DB_PATH", "/data/invalid\x00.db"),
|
|
("CONVERSATION_SUMMARY_DB_PATH", ""),
|
|
("OBSIDIAN_CONTINUOUS_SYNC", "yes"),
|
|
("OBSIDIAN_SYNC_MODE", "push-only"),
|
|
],
|
|
)
|
|
def test_malformed_and_unsafe_settings(production_env, name, value):
|
|
production_env[name] = value
|
|
with pytest.raises(ConfigurationError, match=name) as error:
|
|
validate_configuration(production_env)
|
|
if value and value not in name:
|
|
assert value not in str(error.value)
|
|
|
|
|
|
@pytest.mark.parametrize("value", ["0", "-1", "abc", "", "nan", "inf", "-inf"])
|
|
@pytest.mark.parametrize(
|
|
"name",
|
|
[
|
|
"TTFT_TIMEOUT_SECONDS",
|
|
"LLAMA_TIMEOUT_SECONDS",
|
|
"PROMPT_BUDGET_TOKENS",
|
|
"WHATSAPP_RATE_LIMIT_MAX",
|
|
],
|
|
)
|
|
def test_invalid_numbers(production_env, name, value):
|
|
production_env[name] = value
|
|
with pytest.raises(ConfigurationError, match=name):
|
|
validate_configuration(production_env)
|
|
|
|
|
|
def test_context_budget_boundary(production_env):
|
|
production_env.update(
|
|
CONTEXT_WINDOW_TOKENS="100",
|
|
PROMPT_BUDGET_TOKENS="80",
|
|
RESPONSE_RESERVE_TOKENS="20",
|
|
)
|
|
validate_configuration(production_env)
|
|
production_env["RESPONSE_RESERVE_TOKENS"] = "21"
|
|
with pytest.raises(ConfigurationError, match="exceeds context window"):
|
|
validate_configuration(production_env)
|
|
|
|
|
|
def test_oidc_partial_insecure_and_manual_endpoints(production_env):
|
|
production_env["OIDC_ISSUER"] = "https://auth.example.test"
|
|
with pytest.raises(ConfigurationError, match="OIDC_CLIENT_ID"):
|
|
validate_configuration(production_env)
|
|
production_env.update(
|
|
OIDC_CLIENT_ID="raggr",
|
|
OIDC_CLIENT_SECRET="synthetic-client-secret",
|
|
OIDC_REDIRECT_URI="http://localhost:8080/api/user/oidc/callback",
|
|
)
|
|
with pytest.raises(ConfigurationError, match="OIDC_REDIRECT_URI"):
|
|
validate_configuration(production_env)
|
|
production_env["OIDC_REDIRECT_URI"] = (
|
|
"https://app.example.test/api/user/oidc/callback"
|
|
)
|
|
validate_configuration(production_env)
|
|
production_env["OIDC_USE_DISCOVERY"] = "false"
|
|
with pytest.raises(ConfigurationError, match="OIDC_TOKEN_ENDPOINT"):
|
|
validate_configuration(production_env)
|
|
for name in (
|
|
"OIDC_AUTHORIZATION_ENDPOINT",
|
|
"OIDC_TOKEN_ENDPOINT",
|
|
"OIDC_USERINFO_ENDPOINT",
|
|
"OIDC_JWKS_URI",
|
|
):
|
|
production_env[name] = "https://auth.example.test/endpoint"
|
|
validate_configuration(production_env)
|
|
|
|
|
|
@pytest.mark.parametrize(
|
|
"trigger,key,flag",
|
|
[
|
|
("TWILIO_ACCOUNT_SID", "TWILIO_AUTH_TOKEN", "TWILIO_SIGNATURE_VALIDATION"),
|
|
(
|
|
"MAILGUN_DOMAIN",
|
|
"MAILGUN_WEBHOOK_SIGNING_KEY",
|
|
"MAILGUN_SIGNATURE_VALIDATION",
|
|
),
|
|
(
|
|
"SENDBLUE_API_KEY",
|
|
"SENDBLUE_WEBHOOK_SECRET",
|
|
"SENDBLUE_SIGNATURE_VALIDATION",
|
|
),
|
|
],
|
|
)
|
|
def test_enabled_webhooks_require_signatures(production_env, trigger, key, flag):
|
|
production_env[trigger] = "synthetic-test-value"
|
|
with pytest.raises(ConfigurationError, match=key):
|
|
validate_configuration(production_env)
|
|
production_env[key] = "synthetic-signing-key"
|
|
validate_configuration(production_env)
|
|
production_env[flag] = "false"
|
|
with pytest.raises(ConfigurationError, match=flag):
|
|
validate_configuration(production_env)
|
|
|
|
|
|
@pytest.mark.parametrize(
|
|
"flag",
|
|
[
|
|
"TWILIO_SIGNATURE_VALIDATION",
|
|
"MAILGUN_SIGNATURE_VALIDATION",
|
|
"SENDBLUE_SIGNATURE_VALIDATION",
|
|
],
|
|
)
|
|
def test_production_never_disables_webhook_verification(production_env, flag):
|
|
production_env[flag] = "false"
|
|
with pytest.raises(ConfigurationError, match=flag):
|
|
validate_configuration(production_env)
|
|
validate_configuration(production_env, production=False)
|
|
|
|
|
|
def test_sync_and_summary_requirements(production_env):
|
|
production_env["OBSIDIAN_CONTINUOUS_SYNC"] = "true"
|
|
with pytest.raises(ConfigurationError, match="OBSIDIAN_VAULT_ID"):
|
|
validate_configuration(production_env)
|
|
production_env.update(
|
|
OBSIDIAN_EMAIL="test@example.test",
|
|
OBSIDIAN_PASSWORD="test-password",
|
|
OBSIDIAN_VAULT_ID="test-vault",
|
|
)
|
|
validate_configuration(production_env)
|
|
production_env.update(
|
|
CHECKPOINT_DB_PATH="/data/store.db",
|
|
CONVERSATION_SUMMARY_DB_PATH="/data/../data/store.db",
|
|
)
|
|
with pytest.raises(ConfigurationError, match="must differ"):
|
|
validate_configuration(production_env)
|
|
|
|
|
|
def test_compose_forwards_runtime_settings():
|
|
text = (ROOT / "docker-compose.yml").read_text()
|
|
common = text.split("services:")[0]
|
|
for name in (
|
|
"METRICS_TOKEN",
|
|
"TTFT_TIMEOUT_SECONDS",
|
|
"LLAMA_TIMEOUT_SECONDS",
|
|
"CONTEXT_WINDOW_TOKENS",
|
|
"PROMPT_BUDGET_TOKENS",
|
|
"RESPONSE_RESERVE_TOKENS",
|
|
"CHECKPOINT_DB_PATH",
|
|
"CONVERSATION_SUMMARY_DB_PATH",
|
|
"OBSIDIAN_SYNC_INTERVAL",
|
|
"OBSIDIAN_SYNC_MODE",
|
|
"OIDC_AUTHORIZATION_ENDPOINT",
|
|
"OIDC_TOKEN_ENDPOINT",
|
|
"OIDC_USERINFO_ENDPOINT",
|
|
"OIDC_JWKS_URI",
|
|
"EMAIL_HMAC_SECRET",
|
|
"WHATSAPP_RATE_LIMIT_MAX",
|
|
"WHATSAPP_RATE_LIMIT_WINDOW",
|
|
"IMESSAGE_RATE_LIMIT_MAX",
|
|
"IMESSAGE_RATE_LIMIT_WINDOW",
|
|
):
|
|
assert f"- {name}=${{{name}" in common
|
|
assert "TAVILY_API_KEY=${TAVILY_API_KEY:-${TAVILIY_API_KEY:-}}" in common
|
|
assert text.count("<<: *raggr-common") == 2
|
|
|
|
|
|
@pytest.mark.parametrize(
|
|
"canonical,legacy,expected",
|
|
[("new-key", "old-key", "new-key"), ("", "old-key", "old-key")],
|
|
)
|
|
def test_compose_interpolation_without_secrets(canonical, legacy, expected):
|
|
if not shutil.which("docker"):
|
|
pytest.skip("Docker Compose is unavailable")
|
|
env = {
|
|
"PATH": os.environ["PATH"],
|
|
"HOME": os.environ.get("HOME", "/tmp"),
|
|
"TAVILY_API_KEY": canonical,
|
|
"TAVILIY_API_KEY": legacy,
|
|
"METRICS_TOKEN": "test-metrics",
|
|
"TTFT_TIMEOUT_SECONDS": "42",
|
|
"CHECKPOINT_DB_PATH": "/data/custom.db",
|
|
}
|
|
result = subprocess.run(
|
|
[
|
|
"docker",
|
|
"compose",
|
|
"--env-file",
|
|
"/dev/null",
|
|
"--profile",
|
|
"blue",
|
|
"--profile",
|
|
"green",
|
|
"config",
|
|
"--format",
|
|
"json",
|
|
],
|
|
cwd=ROOT,
|
|
env=env,
|
|
capture_output=True,
|
|
text=True,
|
|
)
|
|
if result.returncode and "not a docker command" in result.stderr:
|
|
pytest.skip("Docker Compose is unavailable")
|
|
assert result.returncode == 0, result.stderr
|
|
services = json.loads(result.stdout)["services"]
|
|
for color in ("blue", "green"):
|
|
actual = services[f"raggr-{color}"]["environment"]
|
|
assert actual["TAVILY_API_KEY"] == expected
|
|
assert actual["METRICS_TOKEN"] == "test-metrics"
|
|
assert actual["TTFT_TIMEOUT_SECONDS"] == "42"
|
|
assert actual["CONVERSATION_SUMMARY_DB_PATH"] == "/data/custom.db.summaries.db"
|
|
|
|
|
|
@pytest.mark.parametrize(
|
|
"validation_status,migration_status,expected", [(0, 19, 19), (23, 0, 23)]
|
|
)
|
|
def test_startup_stops_before_app_on_failure(
|
|
tmp_path, validation_status, migration_status, expected
|
|
):
|
|
log = tmp_path / "commands"
|
|
for name, body in {
|
|
"python": f'echo "python $*" >> "$COMMAND_LOG"\nexit {validation_status}\n',
|
|
"aerich": f'echo "aerich $*" >> "$COMMAND_LOG"\nexit {migration_status}\n',
|
|
}.items():
|
|
executable = tmp_path / name
|
|
executable.write_text("#!/bin/sh\n" + body)
|
|
executable.chmod(0o755)
|
|
result = subprocess.run(
|
|
["/bin/bash", str(ROOT / "startup.sh")],
|
|
cwd=ROOT,
|
|
env={"PATH": str(tmp_path), "COMMAND_LOG": str(log)},
|
|
capture_output=True,
|
|
text=True,
|
|
)
|
|
assert result.returncode == expected
|
|
commands = log.read_text()
|
|
assert "python scripts/validate_config.py" in commands
|
|
assert "python app.py" not in commands
|
|
assert ("aerich upgrade" in commands) == (validation_status == 0)
|
|
|
|
|
|
def test_validation_cli_reports_errors_without_values(tmp_path, production_env):
|
|
# A separate project tree avoids loading any real .env in the shared checkout.
|
|
(tmp_path / "scripts").mkdir()
|
|
(tmp_path / "config").mkdir()
|
|
(tmp_path / "config" / "__init__.py").touch()
|
|
shutil.copy(ROOT / "scripts" / "validate_config.py", tmp_path / "scripts")
|
|
shutil.copy(ROOT / "config" / "validation.py", tmp_path / "config")
|
|
command = [sys.executable, str(tmp_path / "scripts" / "validate_config.py")]
|
|
env = {"PATH": os.environ["PATH"], **production_env}
|
|
result = subprocess.run(command, env=env, capture_output=True, text=True)
|
|
assert result.returncode == 0
|
|
assert result.stdout == "Configuration valid.\n"
|
|
env["JWT_SECRET_KEY"] = "private-invalid-value"
|
|
result = subprocess.run(command, env=env, capture_output=True, text=True)
|
|
assert result.returncode == 1
|
|
assert "JWT_SECRET_KEY" in result.stderr
|
|
assert env["JWT_SECRET_KEY"] not in result.stderr
|
|
assert env["OPENAI_API_KEY"] not in result.stderr
|
|
# dotenv values are validated too, but do not override exported settings.
|
|
(tmp_path / ".env").write_text("JWT_SECRET_KEY=invalid-dotenv-value\n")
|
|
env["JWT_SECRET_KEY"] = production_env["JWT_SECRET_KEY"]
|
|
result = subprocess.run(command, env=env, capture_output=True, text=True)
|
|
assert result.returncode == 0
|