mrleo1nidandClaude Opus 5.5
4fa1add80d
ci / contract (сгенерированный код совпадает с openapi.yaml) (push) Successful in 48s
ci / api (push) Successful in 51s
ci / recommender (push) Canceled after 2s
ci / ts (packages + web) (push) Canceled after 0s
ci / docker (образы собираются — их сервер собирает сам при обновлении) (apps/web/Dockerfile, web, ) (push) Canceled after 0s
ci / docker (образы собираются — их сервер собирает сам при обновлении) (services/api/Dockerfile, api, api) (push) Canceled after 0s
ci / docker (образы собираются — их сервер собирает сам при обновлении) (services/api/Dockerfile, storage-agent, storage-agent) (push) Canceled after 0s
ci / docker (образы собираются — их сервер собирает сам при обновлении) (services/recommender/Dockerfile, recommender, ) (push) Canceled after 0s
ci / mobile (Metro-бандл Android) (push) Canceled after 0s
Security and robustness: - storage-agent rejects an empty INTERNAL_TOKEN (config notEmpty + middleware) - api takes the client IP only from X-Real-IP (chi RealIP trusted True-Client-IP) - /readyz reports ok/fail and logs the cause; checks run in parallel with a timeout - storage-agent shuts down gracefully; shared httpx.NewServer/Serve with IdleTimeout - goose migrations take a Postgres advisory lock - recommender readyz: per-check timeout, redis socket timeouts Clients: - Android release allows cleartext HTTP for LAN servers (expo-build-properties) - checkServer times out after 10s; connect button is disabled while checking Deploy and CI: - install.sh hands cache/uploads/updates/models to the non-root service users - update.sh refuses downgrades unless PIPU_ALLOW_DOWNGRADE=1 - recommender/analyzer get only the env they need; required secrets fail fast - nginx security headers and CSP; strip True-Client-IP - dev compose binds ports to 127.0.0.1; postgres/redis images pinned - version.mjs fails on a malformed explicit tag instead of releasing 0.0.0-dev - contract check catches untracked generated files - final releases fail without a release keystore; changelog skips rc tags Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
60 lines
1.8 KiB
Python
60 lines
1.8 KiB
Python
from fastapi.testclient import TestClient
|
|
|
|
from pipu_rec.api.app import create_app
|
|
from pipu_rec.settings import Settings
|
|
|
|
|
|
async def ok() -> None:
|
|
return None
|
|
|
|
|
|
async def down() -> None:
|
|
raise ConnectionError("connection refused")
|
|
|
|
|
|
def client(checks=None) -> TestClient: # type: ignore[no-untyped-def]
|
|
settings = Settings(internal_token="secret", PIPU_VERSION="1.2.3")
|
|
return TestClient(create_app(settings, checks))
|
|
|
|
|
|
def test_healthz() -> None:
|
|
r = client().get("/healthz")
|
|
assert r.status_code == 200
|
|
assert r.json() == {"status": "ok"}
|
|
|
|
|
|
def test_readyz_all_up() -> None:
|
|
r = client({"postgres": ok, "redis": ok}).get("/readyz")
|
|
assert r.status_code == 200
|
|
assert r.json() == {"status": "ok", "checks": {"postgres": "ok", "redis": "ok"}}
|
|
|
|
|
|
def test_readyz_dependency_down() -> None:
|
|
r = client({"postgres": ok, "redis": down}).get("/readyz")
|
|
assert r.status_code == 503
|
|
assert r.json()["checks"]["redis"] == "fail"
|
|
|
|
|
|
def test_readyz_dependency_hangs(monkeypatch) -> None: # type: ignore[no-untyped-def]
|
|
import asyncio
|
|
|
|
from pipu_rec.api import app as app_module
|
|
|
|
async def hang() -> None:
|
|
await asyncio.sleep(10)
|
|
|
|
monkeypatch.setattr(app_module, "CHECK_TIMEOUT_S", 0.05)
|
|
r = client({"postgres": ok, "redis": hang}).get("/readyz")
|
|
assert r.status_code == 503
|
|
assert r.json()["checks"] == {"postgres": "ok", "redis": "fail"}
|
|
|
|
|
|
def test_internal_status_requires_token() -> None:
|
|
c = client()
|
|
assert c.get("/internal/status").status_code == 401
|
|
assert c.get("/internal/status", headers={"Authorization": "Bearer wrong"}).status_code == 401
|
|
|
|
r = c.get("/internal/status", headers={"Authorization": "Bearer secret"})
|
|
assert r.status_code == 200
|
|
assert r.json()["version"] == "1.2.3"
|