@agentikos/omega-os 0.2.0 → 0.19.6

package/omega/Agentik_Engine/tests/test_webhooks_and_readiness.py

@@ -0,0 +1,277 @@
+"""Tests for inbound webhooks (HMAC gate) + the doctor's Ready verdict.
+
+Two pieces under test:
+
+1. ``omega_engine.webhooks``
+   * ``WebhookRegistry`` loads from the SSOT YAML
+   * ``verify_signature`` rejects missing/wrong-format/wrong-value sigs
+   * ``handle_webhook`` runs the gate end-to-end + fires the supervisor
+   * GitHub + Linear + generic source formats
+
+2. ``omega doctor`` ends with READY / PARTIAL / NOT_READY
+   * Empty tree → NOT_READY
+   * Full tree with no provider creds → PARTIAL
+"""
+from __future__ import annotations
+
+import io
+import json
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+from unittest import mock
+
+import yaml
+
+
+HERE = Path(__file__).resolve().parent
+sys.path.insert(0, str(HERE.parent))
+
+from omega_engine.webhooks import (  # noqa: E402
+    WebhookRegistry,
+    WebhookSpec,
+    generate_test_signature,
+    handle_webhook,
+    load_registry,
+    signature_header_for,
+    verify_signature,
+)
+
+
+# ---------------------------------------------------------------------------
+# Signature verification — the hard line
+# ---------------------------------------------------------------------------
+
+
+class TestVerifySignature(unittest.TestCase):
+    SECRET = "hunter2"
+
+    def test_missing_header_rejected(self):
+        ok, reason = verify_signature("github", b"body", None, self.SECRET)
+        self.assertFalse(ok)
+        self.assertIn("missing signature", reason)
+
+    def test_missing_secret_rejected(self):
+        ok, reason = verify_signature("github", b"body",
+                                       "sha256=" + "0" * 64, "")
+        self.assertFalse(ok)
+        self.assertIn("secret not set", reason)
+
+    def test_github_correct(self):
+        body = b'{"action":"opened"}'
+        sig = generate_test_signature("github", body, self.SECRET)
+        ok, _ = verify_signature("github", body, sig, self.SECRET)
+        self.assertTrue(ok)
+
+    def test_github_wrong_secret(self):
+        body = b'{"action":"opened"}'
+        sig = generate_test_signature("github", body, "different")
+        ok, reason = verify_signature("github", body, sig, self.SECRET)
+        self.assertFalse(ok)
+        self.assertIn("mismatch", reason)
+
+    def test_github_missing_prefix(self):
+        ok, reason = verify_signature("github", b"x",
+                                       "0" * 64,  # no "sha256=" prefix
+                                       self.SECRET)
+        self.assertFalse(ok)
+        self.assertIn("prefix", reason)
+
+    def test_linear_correct(self):
+        body = b'{"data":"..."}'
+        sig = generate_test_signature("linear", body, self.SECRET)
+        ok, _ = verify_signature("linear", body, sig, self.SECRET)
+        self.assertTrue(ok)
+
+    def test_generic_correct(self):
+        body = b'arbitrary payload'
+        sig = generate_test_signature("generic", body, self.SECRET)
+        ok, _ = verify_signature("generic", body, sig, self.SECRET)
+        self.assertTrue(ok)
+
+    def test_unknown_source(self):
+        ok, reason = verify_signature("aliens", b"x", "sha256=0", self.SECRET)
+        self.assertFalse(ok)
+        self.assertIn("unknown source", reason)
+
+
+# ---------------------------------------------------------------------------
+# Registry
+# ---------------------------------------------------------------------------
+
+
+class TestRegistry(unittest.TestCase):
+    def _seed(self, td: Path) -> Path:
+        d = td / "Agentik_SSOT" / "webhooks"
+        d.mkdir(parents=True)
+        (d / "webhooks.yaml").write_text(yaml.safe_dump({
+            "webhooks": [
+                {"id": "github-prs", "path": "/webhook/github-prs",
+                 "source": "github", "secret_ref": "GITHUB_HOOK_SECRET"},
+                {"id": "linear-issues", "path": "/webhook/linear-issues",
+                 "source": "linear", "secret_ref": "LINEAR_HOOK_SECRET"},
+            ],
+        }))
+        return td
+
+    def test_load(self):
+        with tempfile.TemporaryDirectory() as td:
+            home = self._seed(Path(td))
+            reg = load_registry(home)
+            self.assertEqual(len(reg.specs), 2)
+            self.assertEqual(reg.by_path("/webhook/github-prs").source, "github")
+            self.assertIsNone(reg.by_path("/webhook/nope"))
+
+    def test_load_missing_file(self):
+        with tempfile.TemporaryDirectory() as td:
+            reg = load_registry(Path(td))
+            self.assertEqual(reg.specs, [])
+
+
+# ---------------------------------------------------------------------------
+# handle_webhook — end to end
+# ---------------------------------------------------------------------------
+
+
+class TestHandleWebhook(unittest.TestCase):
+    def _seed_with_secret(self, td: Path) -> Path:
+        # SSOT + a vault entry for the secret.
+        d = td / "Agentik_SSOT" / "webhooks"
+        d.mkdir(parents=True)
+        (d / "webhooks.yaml").write_text(yaml.safe_dump({
+            "webhooks": [{
+                "id": "github-prs",
+                "path": "/webhook/github-prs",
+                "source": "github",
+                "secret_ref": "GITHUB_HOOK_SECRET",
+            }],
+        }))
+        from omega_engine.vault import vault_write
+        vault_write(td, "GITHUB_HOOK_SECRET", "hunter2")
+        return td
+
+    def test_unknown_path_404(self):
+        with tempfile.TemporaryDirectory() as td:
+            self._seed_with_secret(Path(td))
+            r = handle_webhook(
+                td, path="/webhook/does-not-exist",
+                headers={}, body=b"",
+            )
+            self.assertEqual(r["status"], 404)
+            self.assertFalse(r["ok"])
+
+    def test_bad_signature_401(self):
+        with tempfile.TemporaryDirectory() as td:
+            self._seed_with_secret(Path(td))
+            r = handle_webhook(
+                td, path="/webhook/github-prs",
+                headers={"X-Hub-Signature-256": "sha256=" + "0" * 64},
+                body=b'{"action":"opened"}',
+            )
+            self.assertEqual(r["status"], 401)
+            self.assertFalse(r["ok"])
+
+    def test_valid_signature_no_supervisor_returns_200(self):
+        with tempfile.TemporaryDirectory() as td:
+            self._seed_with_secret(Path(td))
+            body = b'{"action":"opened"}'
+            sig = generate_test_signature("github", body, "hunter2")
+            r = handle_webhook(
+                td, path="/webhook/github-prs",
+                headers={"X-Hub-Signature-256": sig},
+                body=body,
+            )
+            self.assertEqual(r["status"], 200)
+            self.assertTrue(r["ok"])
+            self.assertEqual(r["fired"], [])
+
+    def test_valid_signature_fires_supervisor(self):
+        with tempfile.TemporaryDirectory() as td:
+            self._seed_with_secret(Path(td))
+            body = b'{"action":"opened"}'
+            sig = generate_test_signature("github", body, "hunter2")
+
+            class _FakeSupervisor:
+                def __init__(self): self.calls = []
+                def wake_webhook(self, path, payload):
+                    self.calls.append((path, payload))
+                    return ["fake-charter-1"]
+
+            sup = _FakeSupervisor()
+            r = handle_webhook(
+                td, path="/webhook/github-prs",
+                headers={"X-Hub-Signature-256": sig},
+                body=body, supervisor=sup,
+            )
+            self.assertEqual(r["status"], 202)
+            self.assertEqual(r["fired"], ["fake-charter-1"])
+            self.assertEqual(sup.calls[0][0], "/webhook/github-prs")
+            self.assertEqual(sup.calls[0][1]["action"], "opened")
+
+
+# ---------------------------------------------------------------------------
+# Doctor's Ready / Partial / Not Ready verdict
+# ---------------------------------------------------------------------------
+
+
+class TestDoctorReadiness(unittest.TestCase):
+    """We don't run the full doctor here (it touches dozens of subsystems);
+    we exercise the verdict logic by feeding it controlled results."""
+
+    def _verdict_from_results(self, results):
+        """Replicate the in-cli verdict logic against a controlled list."""
+        CRITICAL = {
+            "structure", "event store", "vault", "providers",
+            "accounts", "aisb suite", "educators",
+        }
+        IMPORTANT = {
+            "24/7 services", "telegram", "llm clis",
+            "claude code settings", "audit history", "mcp",
+        }
+        critical_fails = []
+        important_warns = []
+        for r in results:
+            if r["status"] == "FAIL":
+                critical_fails.append(r)
+            elif r["status"] == "warn" and r["section"] in IMPORTANT:
+                important_warns.append(r)
+        if critical_fails:
+            return "NOT_READY"
+        if important_warns:
+            return "PARTIAL"
+        return "READY"
+
+    def test_all_ok_is_ready(self):
+        results = [
+            {"section": "structure", "status": "ok", "msg": "..."},
+            {"section": "vault", "status": "ok", "msg": "..."},
+            {"section": "providers", "status": "ok", "msg": "..."},
+        ]
+        self.assertEqual(self._verdict_from_results(results), "READY")
+
+    def test_one_fail_is_not_ready(self):
+        results = [
+            {"section": "vault", "status": "FAIL", "msg": "no backend"},
+            {"section": "structure", "status": "ok", "msg": "..."},
+        ]
+        self.assertEqual(self._verdict_from_results(results), "NOT_READY")
+
+    def test_warns_on_important_is_partial(self):
+        results = [
+            {"section": "structure", "status": "ok", "msg": "..."},
+            {"section": "telegram", "status": "warn", "msg": "no token"},
+        ]
+        self.assertEqual(self._verdict_from_results(results), "PARTIAL")
+
+    def test_warns_only_on_optional_is_ready(self):
+        results = [
+            {"section": "structure", "status": "ok", "msg": "..."},
+            {"section": "event store", "status": "warn", "msg": "empty"},
+        ]
+        # "event store" is NOT in IMPORTANT — empty is fine on a fresh install.
+        self.assertEqual(self._verdict_from_results(results), "READY")
+
+
+if __name__ == "__main__":
+    unittest.main(verbosity=2)