Add shared automation and WebUI editing primitives

tests/test_install_config.py

@@ -10,6 +10,25 @@ from govoplan_core.settings import Settings
 
 
 class InstallConfigTests(unittest.TestCase):
+    def test_archive_preview_safety_defaults_are_validated(self) -> None:
+        defaults = Settings()
+        self.assertEqual(defaults.file_archive_max_entries, 10_000)
+        self.assertEqual(
+            defaults.file_archive_max_expanded_bytes,
+            2 * 1024 * 1024 * 1024,
+        )
+        self.assertEqual(defaults.file_archive_max_expansion_ratio, 100)
+        self.assertEqual(defaults.file_archive_preview_ttl_seconds, 30 * 60)
+
+        for values in (
+            {"FILE_ARCHIVE_MAX_ENTRIES": "0"},
+            {"FILE_ARCHIVE_MAX_EXPANDED_BYTES": "0"},
+            {"FILE_ARCHIVE_MAX_EXPANSION_RATIO": "0"},
+            {"FILE_ARCHIVE_PREVIEW_TTL_SECONDS": "59"},
+        ):
+            with self.subTest(values=values), self.assertRaises(ValidationError):
+                Settings(**values)
+
     def test_calendar_outbox_retention_setting_is_validated(self) -> None:
         self.assertEqual(Settings().calendar_outbox_terminal_retention_days, 90)
         self.assertEqual(
@@ -128,6 +147,45 @@ class InstallConfigTests(unittest.TestCase):
         self.assertIn("GOVOPLAN_TRUSTED_HOSTS", error_keys)
         self.assertIn("FORWARDED_ALLOW_IPS", error_keys)
 
+    def test_managed_s3_trust_is_limited_to_installer_garage(self) -> None:
+        base = {
+            "APP_ENV": "development",
+            "FILE_STORAGE_BACKEND": "s3",
+            "FILE_STORAGE_S3_REGION": "garage",
+            "FILE_STORAGE_S3_ACCESS_KEY_ID": "access",
+            "FILE_STORAGE_S3_SECRET_ACCESS_KEY": "secret",
+            "FILE_STORAGE_S3_BUCKET": "files",
+            "FILE_STORAGE_S3_DEPLOYMENT_MANAGED": "true",
+        }
+        accepted = validate_runtime_configuration(
+            {
+                **base,
+                "FILE_STORAGE_S3_ENDPOINT_URL": "http://garage:3900",
+            },
+            profile="development",
+        )
+        rejected = validate_runtime_configuration(
+            {
+                **base,
+                "FILE_STORAGE_S3_ENDPOINT_URL": "http://other-s3:3900",
+            },
+            profile="development",
+        )
+
+        self.assertNotIn(
+            "FILE_STORAGE_S3_ENDPOINT_URL",
+            {issue.key for issue in accepted.errors},
+        )
+        self.assertIn(
+            "FILE_STORAGE_S3_ENDPOINT_URL",
+            {issue.key for issue in rejected.errors},
+        )
+        self.assertTrue(
+            Settings(
+                FILE_STORAGE_S3_DEPLOYMENT_MANAGED="true"
+            ).file_storage_s3_deployment_managed
+        )
+
     def test_connector_deployment_allowlists_require_exact_names_and_absolute_paths(self) -> None:
         result = validate_runtime_configuration(
             {
@@ -156,6 +214,7 @@ class InstallConfigTests(unittest.TestCase):
         self.assertIn("GOVOPLAN_TRUSTED_HOSTS=govoplan.example.org", self_hosted)
         self.assertIn("GOVOPLAN_HTTP_HSTS_SECONDS=31536000", self_hosted)
         self.assertIn("AUTH_LOGIN_THROTTLE_IDENTITY_LIMIT=10", self_hosted)
+        self.assertIn("FILE_STORAGE_S3_DEPLOYMENT_MANAGED=false", self_hosted)
         self.assertIn("GOVOPLAN_INSTALL_PROFILE=production-like", production_like)
         self.assertNotIn("MASTER_KEY_B64=<generate", production_like)
         self.assertIn("CALENDAR_OUTBOX_TERMINAL_RETENTION_DAYS=90", production_like)
@@ -166,6 +225,10 @@ class InstallConfigTests(unittest.TestCase):
         self.assertIn("GOVOPLAN_TRUSTED_HOSTS=127.0.0.1,localhost,testserver", production_like)
         self.assertIn("GOVOPLAN_HTTP_HSTS_SECONDS=0", production_like)
         self.assertIn("AUTH_LOGIN_THROTTLE_IDENTITY_LIMIT=10", production_like)
+        self.assertIn(
+            "FILE_STORAGE_S3_DEPLOYMENT_MANAGED=false",
+            production_like,
+        )
 
 
 if __name__ == "__main__":