feat(ops): show deployment capability receipt

2026-08-07 01:59:57 +02:00
parent 71666db45c
commit d26a601dda
7 changed files with 389 additions and 1 deletions
@@ -0,0 +1,90 @@
+from __future__ import annotations
+
+import json
+from pathlib import Path
+import tempfile
+import unittest
+
+from govoplan_ops.backend.infrastructure import deployment_capability_status
+
+
+class InfrastructureCapabilityTests(unittest.TestCase):
+    def test_reads_bounded_non_secret_capability_receipt(self) -> None:
+        with tempfile.TemporaryDirectory(prefix="govoplan-ops-capabilities-") as root:
+            path = Path(root) / "capabilities.json"
+            path.write_text(
+                json.dumps(
+                    {
+                        "schema_version": 1,
+                        "installation_id": "govoplan-test",
+                        "profile": "evaluation",
+                        "capabilities": [
+                            {
+                                "id": "mail.smtp",
+                                "label": "SMTP delivery",
+                                "state": "available_unconfigured",
+                                "source": "operator-supplied",
+                                "detail": "Mail needs a profile.",
+                                "endpoint": {},
+                                "secret_refs": ["env:SMTP_CREDENTIAL_REF"],
+                                "dependent_modules": ["mail"],
+                            }
+                        ],
+                        "post_install_tasks": [
+                            {
+                                "id": "mail.smtp-profile",
+                                "resume_key": "govoplan-test:mail.smtp-profile:v1",
+                                "capability_id": "mail.smtp",
+                                "state": "pending",
+                                "owner_module": "mail",
+                                "summary": "Configure Mail.",
+                                "required_inputs": ["credential envelope reference"],
+                                "secret_boundary": "credential-envelope-reference-only",
+                            }
+                        ],
+                    }
+                ),
+                encoding="utf-8",
+            )
+
+            result = deployment_capability_status(path)
+
+        self.assertTrue(result["available"])
+        self.assertEqual("mail.smtp", result["capabilities"][0]["id"])
+        self.assertEqual("mail.smtp-profile", result["post_install_tasks"][0]["id"])
+
+    def test_rejects_inline_secret_instead_of_reference(self) -> None:
+        with tempfile.TemporaryDirectory(prefix="govoplan-ops-capabilities-") as root:
+            path = Path(root) / "capabilities.json"
+            path.write_text(
+                json.dumps(
+                    {
+                        "schema_version": 1,
+                        "installation_id": "govoplan-test",
+                        "profile": "evaluation",
+                        "capabilities": [
+                            {
+                                "id": "mail.smtp",
+                                "label": "SMTP delivery",
+                                "state": "configured",
+                                "source": "operator-supplied",
+                                "detail": "Configured.",
+                                "endpoint": {},
+                                "secret_refs": ["plaintext-secret"],
+                                "dependent_modules": [],
+                            }
+                        ],
+                        "post_install_tasks": [],
+                    }
+                ),
+                encoding="utf-8",
+            )
+
+            result = deployment_capability_status(path)
+
+        self.assertFalse(result["available"])
+        self.assertIn("environment references", str(result["error"]))
+
+
+if __name__ == "__main__":
+    unittest.main()