@kernel-sig/console 0.1.0

package/backend/tests/test_analysis_api.py

@@ -0,0 +1,154 @@
+"""分类 / 关注项 / AI 三组接口的契约测试。
+
+这些接口大多需要真实数据库，因此这里只断言**不依赖数据的前置条件**：
+路由已注册、未登录一律 401、参数校验在进业务逻辑前拦下。
+认证与校验是最容易在重构中悄悄失守的部分，而它们失守时不会有任何报错。
+"""
+
+import re
+import uuid
+
+import pytest
+from fastapi.testclient import TestClient
+
+from app.core.config import get_settings
+
+SECRET = "0123456789abcdef0123456789abcdef"
+SOME_UUID = str(uuid.UUID("00000000-0000-0000-0000-000000000001"))
+
+# (方法, 路径, 请求体) —— 覆盖三组新增接口的每一个入口
+ENDPOINTS: list[tuple[str, str, dict | None]] = [
+    ("GET", f"/api/v1/pulls/{SOME_UUID}/classification", None),
+    ("GET", f"/api/v1/pulls/{SOME_UUID}/attention", None),
+    ("GET", f"/api/v1/repositories/{SOME_UUID}/classifications", None),
+    ("GET", f"/api/v1/repositories/{SOME_UUID}/classifications/kinds", None),
+    ("GET", f"/api/v1/repositories/{SOME_UUID}/classifications/subsystems", None),
+    ("POST", f"/api/v1/repositories/{SOME_UUID}/classifications/recompute", None),
+    ("PUT", f"/api/v1/classifications/{SOME_UUID}", {"kind": "cve"}),
+    ("DELETE", f"/api/v1/classifications/{SOME_UUID}/override", None),
+    ("GET", f"/api/v1/repositories/{SOME_UUID}/attention", None),
+    ("GET", f"/api/v1/repositories/{SOME_UUID}/attention/counts", None),
+    ("GET", "/api/v1/attention/rules", None),
+    ("POST", f"/api/v1/attention/{SOME_UUID}/acknowledge", None),
+    ("DELETE", f"/api/v1/attention/{SOME_UUID}/acknowledge", None),
+    ("POST", f"/api/v1/repositories/{SOME_UUID}/attention/recompute", None),
+    # 关注队列的订阅与分组：队列返回分组而非逐条，设置决定哪些规则进队列
+    ("GET", f"/api/v1/repositories/{SOME_UUID}/attention/queue", None),
+    ("GET", f"/api/v1/repositories/{SOME_UUID}/attention/summary", None),
+    ("GET", "/api/v1/attention/rule-settings", None),
+    ("PUT", "/api/v1/attention/rule-settings/stale", {"enabled": True, "days": 30}),
+    ("GET", "/api/v1/ai/providers", None),
+    ("POST", "/api/v1/ai/providers", {"name": "x", "base_url": "http://x/v1", "model": "m"}),
+    ("PATCH", f"/api/v1/ai/providers/{SOME_UUID}", {"model": "m2"}),
+    ("DELETE", f"/api/v1/ai/providers/{SOME_UUID}", None),
+    ("POST", f"/api/v1/ai/providers/{SOME_UUID}/test", None),
+    ("GET", "/api/v1/ai/routing", None),
+    ("PUT", "/api/v1/ai/routing/classify", {"provider_id": SOME_UUID}),
+    ("DELETE", "/api/v1/ai/routing/classify", None),
+    ("GET", f"/api/v1/ai/analyses/pull_request/{SOME_UUID}", None),
+    ("GET", "/api/v1/ai/usage", None),
+    ("GET", "/api/v1/ai/tasks", None),
+    ("POST", f"/api/v1/pulls/{SOME_UUID}/ai/analyze", None),
+    ("POST", f"/api/v1/repositories/{SOME_UUID}/ai/classify-missing", None),
+]
+
+
+@pytest.fixture
+def client(monkeypatch):
+    monkeypatch.setenv("KSC_SECRET_KEY", SECRET)
+    get_settings.cache_clear()
+    from app.main import create_app
+
+    with TestClient(create_app()) as c:
+        yield c
+    get_settings.cache_clear()
+
+
+@pytest.mark.parametrize(("method", "path", "payload"), ENDPOINTS)
+def test_endpoint_is_registered(client, method, path, payload):
+    """路由存在。写错路径会退化成 404，与 401 很容易混淆，因此单独断言。"""
+    resp = client.request(method, path, json=payload)
+    assert resp.status_code != 404, f"{method} {path} 未注册"
+
+
+@pytest.mark.parametrize(("method", "path", "payload"), ENDPOINTS)
+def test_endpoint_requires_authentication(client, method, path, payload):
+    """未登录一律 401，且是 Problem Details。
+
+    这里刻意不排除任何端点：AI 端点的 GET 会暴露平台接了哪些模型与用量，
+    同样不该对匿名用户开放。
+    """
+    resp = client.request(method, path, json=payload)
+    assert resp.status_code == 401, f"{method} {path} 返回 {resp.status_code}"
+    assert resp.json()["code"] == "unauthorized"
+
+
+def _template_to_regex(path: str) -> re.Pattern[str]:
+    """把 OpenAPI 的路径模板转成正则，用于匹配带具体取值的测试路径。"""
+    parts = re.split(r"\{[^}]+\}", path)
+    return re.compile("^" + "[^/]+".join(re.escape(part) for part in parts) + "$")
+
+
+def test_all_new_endpoints_are_covered():
+    """新增接口必须被上面的清单覆盖到。
+
+    漏掉一个入口意味着它既没有认证测试、也没有注册测试，这种"没人看着"
+    的接口是权限漏洞最常出现的地方。反向也查：清单里不能有已删掉的路由，
+    否则认证测试会变成对 404 的断言，看着是绿的其实什么都没测到。
+    """
+    get_settings.cache_clear()
+    import os
+
+    os.environ.setdefault("KSC_SECRET_KEY", SECRET)
+    from app.main import create_app
+
+    paths = create_app().openapi()["paths"]
+    get_settings.cache_clear()
+
+    registered = [
+        (method.upper(), _template_to_regex(path))
+        for path, operations in paths.items()
+        for method in operations
+        if "/ai/" in path or "attention" in path or "classification" in path
+    ]
+
+    uncovered = [
+        (method, path)
+        for method, path, _ in ENDPOINTS
+        if not any(
+            method == reg_method and pattern.match(path) for reg_method, pattern in registered
+        )
+    ]
+    assert not uncovered, f"以下接口未被认证测试覆盖：{uncovered}"
+
+    unmatched = [
+        (reg_method, pattern.pattern)
+        for reg_method, pattern in registered
+        if not any(method == reg_method and pattern.match(path) for method, path, _ in ENDPOINTS)
+    ]
+    assert not unmatched, f"以下已注册接口不在测试清单中：{unmatched}"
+
+
+def test_task_routing_rejects_unknown_task(client):
+    """任务名是枚举，拼错的取值必须在进入业务逻辑前被拦下。"""
+    resp = client.put("/api/v1/ai/routing/not-a-task", json={"provider_id": SOME_UUID})
+    # 未登录时认证先于校验，两者都会拦下，关键是不能是 404
+    assert resp.status_code in (401, 422)
+
+
+def test_classification_override_rejects_unknown_kind(client):
+    resp = client.put(f"/api/v1/classifications/{SOME_UUID}", json={"kind": "not-a-kind"})
+    assert resp.status_code in (401, 422)
+
+
+def test_attention_list_rejects_unknown_severity(client):
+    resp = client.get(f"/api/v1/repositories/{SOME_UUID}/attention", params={"severity": "nope"})
+    assert resp.status_code in (401, 422)
+
+
+def test_ai_analyze_accepts_task_and_force_params(client):
+    """参数形状不对会在 422 暴露出来，与认证失败区分开。"""
+    resp = client.post(
+        f"/api/v1/pulls/{SOME_UUID}/ai/analyze", params={"task": "bogus", "force": "true"}
+    )
+    assert resp.status_code in (401, 422)

package/backend/tests/test_atomgit_client.py

@@ -0,0 +1,360 @@
+"""AtomGit 客户端行为测试。
+
+用 httpx.MockTransport 拦截请求，断言客户端发出的**实际**请求
+（请求头、查询参数、重试次数），而非仅仅断言返回值。
+"""
+
+import json
+from pathlib import Path
+
+import httpx
+import pytest
+
+from app.integrations.atomgit.client import (
+    AtomGitAuthError,
+    AtomGitClient,
+    AtomGitNotFoundError,
+    AtomGitRateLimitError,
+    AtomGitUpstreamError,
+)
+
+FIXTURES = Path(__file__).parent / "fixtures" / "atomgit"
+TOKEN = "test-token-abcdef"
+
+
+def load(name: str):
+    return json.loads((FIXTURES / name).read_text(encoding="utf-8"))
+
+
+@pytest.fixture(autouse=True)
+def _no_sleep(monkeypatch):
+    """重试退避在测试中不应真的等待。"""
+
+    async def _instant(*args, **kwargs):
+        return None
+
+    monkeypatch.setattr(AtomGitClient, "_sleep_backoff", staticmethod(_instant))
+
+
+def make_client(handler, **kwargs) -> AtomGitClient:
+    return AtomGitClient(TOKEN, transport=httpx.MockTransport(handler), **kwargs)
+
+
+# --- 认证 -------------------------------------------------------------
+
+
+async def test_uses_private_token_header():
+    """关键：AtomGit 要求 private-token 头。
+
+    官方文档所载的 Authorization: token 写法在 atomgit.com 上返回 400，
+    此处断言客户端发出的确实是 private-token。
+    """
+    seen: dict[str, str] = {}
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        seen.update(dict(request.headers))
+        return httpx.Response(200, json=load("repo.json"))
+
+    async with make_client(handler) as client:
+        await client.get_repository("openeuler", "kernel")
+
+    assert seen.get("private-token") == TOKEN
+    assert "authorization" not in seen
+
+
+async def test_empty_token_is_rejected():
+    with pytest.raises(ValueError, match="token"):
+        AtomGitClient("")
+
+
+async def test_401_raises_auth_error_with_actionable_message():
+    def handler(request: httpx.Request) -> httpx.Response:
+        return httpx.Response(401, json={"message": "Bad credentials"})
+
+    async with make_client(handler) as client:
+        with pytest.raises(AtomGitAuthError, match="凭据无效"):
+            await client.get_repository("openeuler", "kernel")
+
+
+async def test_403_permission_raises_auth_error():
+    def handler(request: httpx.Request) -> httpx.Response:
+        return httpx.Response(403, json={"message": "Forbidden"})
+
+    async with make_client(handler) as client:
+        with pytest.raises(AtomGitAuthError, match="无权访问"):
+            await client.create_issue_comment("o", "r", 1, "hi")
+
+
+async def test_403_rate_limit_raises_rate_limit_error():
+    """AtomGit 用 403 同时表达权限不足与限流，需按文案区分。"""
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        return httpx.Response(403, json={"message": "Rate limit exceeded"})
+
+    async with make_client(handler) as client:
+        with pytest.raises(AtomGitRateLimitError):
+            await client.get_repository("o", "r")
+
+
+async def test_404_raises_not_found():
+    def handler(request: httpx.Request) -> httpx.Response:
+        return httpx.Response(404, json={"message": "Not Found"})
+
+    async with make_client(handler) as client:
+        with pytest.raises(AtomGitNotFoundError):
+            await client.get_pull("o", "r", 999999)
+
+
+async def test_429_raises_rate_limit():
+    def handler(request: httpx.Request) -> httpx.Response:
+        return httpx.Response(429, json={"message": "slow down"})
+
+    async with make_client(handler) as client:
+        with pytest.raises(AtomGitRateLimitError):
+            await client.get_repository("o", "r")
+
+
+# --- 重试 -------------------------------------------------------------
+
+
+async def test_retries_on_500_then_succeeds():
+    calls = {"n": 0}
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        calls["n"] += 1
+        if calls["n"] < 3:
+            return httpx.Response(500, json={"message": "boom"})
+        return httpx.Response(200, json=load("repo.json"))
+
+    async with make_client(handler) as client:
+        repo = await client.get_repository("openeuler", "kernel")
+
+    assert calls["n"] == 3
+    assert repo.full_name == "openeuler/kernel"
+    assert client.stats.retries == 2
+
+
+async def test_gives_up_after_max_attempts():
+    calls = {"n": 0}
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        calls["n"] += 1
+        return httpx.Response(503, json={"message": "unavailable"})
+
+    async with make_client(handler) as client:
+        with pytest.raises(AtomGitUpstreamError, match="重试"):
+            await client.get_repository("o", "r")
+
+    assert calls["n"] == 4
+
+
+async def test_does_not_retry_on_404():
+    calls = {"n": 0}
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        calls["n"] += 1
+        return httpx.Response(404, json={"message": "Not Found"})
+
+    async with make_client(handler) as client:
+        with pytest.raises(AtomGitNotFoundError):
+            await client.get_pull("o", "r", 1)
+
+    assert calls["n"] == 1
+
+
+async def test_network_error_is_retried_then_wrapped():
+    calls = {"n": 0}
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        calls["n"] += 1
+        raise httpx.ConnectTimeout("timed out")
+
+    async with make_client(handler) as client:
+        with pytest.raises(AtomGitUpstreamError):
+            await client.get_repository("o", "r")
+
+    assert calls["n"] == 4
+
+
+# --- 分页 -------------------------------------------------------------
+
+
+async def test_pagination_reads_total_count_from_headers():
+    """实测总数在响应头 total_count / total_page，不在响应体。"""
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        return httpx.Response(
+            200,
+            json=load("pulls_page1.json"),
+            headers={"total_count": "1124", "total_page": "12"},
+        )
+
+    async with make_client(handler) as client:
+        page = await client.list_pulls("openeuler", "kernel", state="open")
+
+    assert page.total_count == 1124
+    assert page.total_page == 12
+    assert page.has_more is True
+    assert len(page.items) == 5
+
+
+async def test_has_more_false_on_last_page():
+    def handler(request: httpx.Request) -> httpx.Response:
+        return httpx.Response(200, json=load("pulls_page1.json"), headers={"total_page": "1"})
+
+    async with make_client(handler) as client:
+        page = await client.list_pulls("o", "r")
+
+    assert page.has_more is False
+
+
+async def test_per_page_is_clamped_to_maximum():
+    seen: dict[str, str] = {}
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        seen.update(dict(request.url.params))
+        return httpx.Response(200, json=[])
+
+    async with make_client(handler) as client:
+        await client.list_pulls("o", "r", per_page=5000)
+
+    assert seen["per_page"] == "100"
+
+
+async def test_state_and_page_params_are_sent():
+    seen: dict[str, str] = {}
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        seen.update(dict(request.url.params))
+        return httpx.Response(200, json=[])
+
+    async with make_client(handler) as client:
+        await client.list_pulls("o", "r", state="merged", page=3, per_page=50)
+
+    assert seen == {"state": "merged", "page": "3", "per_page": "50"}
+
+
+async def test_iter_pulls_stops_on_last_page():
+    pages = {"n": 0}
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        pages["n"] += 1
+        return httpx.Response(
+            200,
+            json=load("pulls_page1.json"),
+            headers={"total_page": "2"},
+        )
+
+    async with make_client(handler) as client:
+        collected = [p async for p in client.iter_pulls("o", "r", per_page=5)]
+
+    assert len(collected) == 2
+    assert pages["n"] == 2
+
+
+# --- 解析错误可诊断 ---------------------------------------------------
+
+
+async def test_schema_mismatch_reports_model_and_field():
+    """上游字段变化时必须明确指出是哪个模型、哪个字段，而非静默丢弃。"""
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        return httpx.Response(200, json=[{"number": "not-a-number", "title": "x", "state": "open"}])
+
+    async with make_client(handler) as client:
+        with pytest.raises(AtomGitUpstreamError, match="AtomGitPullRequest"):
+            await client.list_pulls("o", "r")
+
+
+async def test_non_list_response_is_reported():
+    def handler(request: httpx.Request) -> httpx.Response:
+        return httpx.Response(200, json={"unexpected": "object"})
+
+    async with make_client(handler) as client:
+        with pytest.raises(AtomGitUpstreamError, match="期望返回列表"):
+            await client.list_pulls("o", "r")
+
+
+# --- 各资源端点 -------------------------------------------------------
+
+
+async def test_get_pull_files_parses_real_fixture():
+    def handler(request: httpx.Request) -> httpx.Response:
+        assert request.url.path.endswith("/pulls/27650/files")
+        return httpx.Response(200, json=load("pull_files.json"))
+
+    async with make_client(handler) as client:
+        files = await client.get_pull_files("openeuler", "kernel", 27650)
+
+    assert files and files[0].filename
+    assert files[0].diff_text
+
+
+async def test_get_pull_comments_uses_dedicated_endpoint():
+    def handler(request: httpx.Request) -> httpx.Response:
+        assert request.url.path.endswith("/pulls/27650/comments")
+        return httpx.Response(200, json=load("pull_comments.json"))
+
+    async with make_client(handler) as client:
+        comments = await client.get_pull_comments("openeuler", "kernel", 27650)
+
+    assert comments
+
+
+async def test_create_issue_comment_posts_body():
+    captured: dict = {}
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        assert "issues/123/comments" in str(request.url)
+        captured.update(json.loads(request.content))
+        return httpx.Response(201, json={"id": 1, "body": "hello", "user": {"login": "me"}})
+
+    async with make_client(handler) as client:
+        await client.create_issue_comment("o", "r", 123, "hello")
+
+    assert captured == {"body": "hello"}
+
+
+async def test_issue_number_accepts_string():
+    """Issue 编号可能是字符串，客户端需接受。"""
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        assert request.url.path.endswith("/issues/9980")
+        return httpx.Response(200, json=load("issue_detail.json"))
+
+    async with make_client(handler) as client:
+        issue = await client.get_issue("openeuler", "kernel", "9980")
+
+    assert issue.number == 9980
+
+
+async def test_stats_track_endpoint_usage():
+    def handler(request: httpx.Request) -> httpx.Response:
+        return httpx.Response(200, json=[])
+
+    async with make_client(handler) as client:
+        await client.list_pulls("o", "r")
+        await client.list_pulls("o", "r")
+        await client.list_issues("o", "r")
+
+    assert client.stats.requests == 3
+    assert client.stats.by_endpoint["/repos/o/r/pulls"] == 2
+    assert client.stats.by_endpoint["/repos/o/r/issues"] == 1
+
+
+async def test_base_url_is_configurable_for_gitcode():
+    """AtomGit 与 GitCode 为同一后端，token 通用，base_url 可切换。"""
+    seen: dict[str, str] = {}
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        seen["host"] = request.url.host
+        return httpx.Response(200, json=load("repo.json"))
+
+    async with AtomGitClient(
+        TOKEN,
+        base_url="https://api.gitcode.com/api/v5",
+        transport=httpx.MockTransport(handler),
+    ) as client:
+        await client.get_repository("openeuler", "kernel")
+
+    assert seen["host"] == "api.gitcode.com"