@kernel-sig/console 0.1.0

package/backend/tests/test_pull_schemas.py

@@ -0,0 +1,82 @@
+"""PR 详情 Schema 的序列化契约。
+
+两处最容易漂移的地方，各钉一个测试：
+
+1. ``labels`` 落库的是 AtomGit 原始 JSON（含 id / repository_id / 时间戳），
+   Schema 只取 name 与 color。上游加字段不应导致详情接口 500。
+2. ``is_bot`` 必须由服务端给出。前端不重复实现机器人识别 ——
+   两处各写一份规则必然漂移。
+"""
+
+import uuid
+
+from app.models.pull_request import PRState, PullRequest
+from app.schemas.pull_request import PRCommentRead, PullDetail
+
+
+def _make_pull(**overrides) -> PullRequest:
+    defaults = {
+        "id": uuid.uuid4(),
+        "repository_id": uuid.uuid4(),
+        "number": 19344,
+        "title": "arm64: mm: fix page table teardown",
+        "body": None,
+        "state": PRState.OPEN,
+        "draft": False,
+        "author_login": "alice",
+        "author_avatar_url": None,
+        "target_branch": "OLK-6.6",
+        "label_names": ["sig/Kernel"],
+        "added_lines": 12,
+        "removed_lines": 3,
+        "changed_files": 1,
+        "comments_count": 0,
+        "merge_conflict": False,
+        "gate_stage": "ready_to_merge",
+        "atomgit_created_at": None,
+        "atomgit_updated_at": None,
+        "merged_at": None,
+        "html_url": None,
+        "labels": [],
+    }
+    return PullRequest(**{**defaults, **overrides})
+
+
+def test_labels_keep_name_and_color_and_ignore_upstream_extras():
+    pull = _make_pull(
+        labels=[
+            {
+                "id": 18027,
+                "name": "sig/Kernel",
+                "color": "#2865E0",
+                "repository_id": 8744898,
+                "created_at": "2025-11-08T15:25:03+08:00",
+            },
+            {"name": "no-color-label", "color": None},
+        ]
+    )
+
+    detail = PullDetail.model_validate(pull)
+
+    assert [(label.name, label.color) for label in detail.labels] == [
+        ("sig/Kernel", "#2865E0"),
+        ("no-color-label", None),
+    ]
+
+
+def test_labels_absent_yields_empty_list_not_none():
+    """详情页直接迭代 labels，None 会让前端多一个分支。"""
+    assert PullDetail.model_validate(_make_pull(labels=None)).labels == []
+
+
+def test_comment_is_bot_defaults_to_false():
+    """未知作者一律按人处理：误折叠人写的评审意见，比多展开一条机器人评论代价大。"""
+    comment = PRCommentRead(
+        comment_id="12345",
+        comment_type="diff_comment",
+        author_login="someone",
+        author_avatar_url=None,
+        body="正文",
+        atomgit_created_at=None,
+    )
+    assert comment.is_bot is False

package/backend/tests/test_release_domain.py

@@ -0,0 +1,82 @@
+"""版本与分支归类。
+
+分支名是外部输入，规范化的每一条规则都对应实测数据里真实存在的一种写法。
+"""
+
+import pytest
+
+from app.domain.release import (
+    BranchKind,
+    classify_branch,
+    compare_tags,
+    normalize_branch_name,
+    parse_kernel_tag,
+)
+
+
+@pytest.mark.parametrize(
+    ("raw", "expected"),
+    [
+        # 实测同一个交付有四种写法混用，都要收敛成一个名字
+        ("openEuler-24.03-LTS_SP1", "openEuler-24.03-LTS-SP1"),
+        ("openEuler-24.03-LTS-SP1", "openEuler-24.03-LTS-SP1"),
+        ("openEuler-24.03-LTS-SP3", "openEuler-24.03-LTS-SP3"),
+        ("openEuler-24.03_LTS", "openEuler-24.03-LTS"),
+        ("openEuler-20.03-lts-SP1", "openEuler-20.03-LTS-SP1"),
+        # LTS / SP 以外的部分原样保留：分支名大小写敏感
+        ("topic/foo_bar", "topic/foo_bar"),
+        ("OLK-6.6", "OLK-6.6"),
+        ("", ""),
+    ],
+)
+def test_normalize_branch_name(raw, expected):
+    assert normalize_branch_name(raw) == expected
+
+
+@pytest.mark.parametrize(
+    ("raw", "kind", "series", "sp", "base"),
+    [
+        ("OLK-6.6", BranchKind.OLK, None, None, "6.6"),
+        ("OLK-5.10", BranchKind.OLK, None, None, "5.10"),
+        ("openEuler-24.03-LTS", BranchKind.LTS, "24.03-LTS", None, None),
+        ("openEuler-24.03-LTS-SP4", BranchKind.LTS, "24.03-LTS", 4, None),
+        ("openEuler-1.0-LTS", BranchKind.LTS, "1.0-LTS", None, None),
+        ("openEuler-26.09", BranchKind.INNOVATION, "26.09", None, None),
+        # 认不出来不报错：临时分支是常态
+        ("topic/foo-bar", BranchKind.OTHER, None, None, None),
+        ("master", BranchKind.OTHER, None, None, None),
+    ],
+)
+def test_classify_branch(raw, kind, series, sp, base):
+    spec = classify_branch(raw)
+    assert (spec.kind, spec.series, spec.sp, spec.upstream_base) == (kind, series, sp, base)
+
+
+def test_olk_base_is_derived_from_name_only():
+    """非 OLK 分支不猜上游基线。猜出来的基线会看起来权威但其实是编的。"""
+    assert classify_branch("openEuler-24.03-LTS").upstream_base is None
+
+
+def test_parse_kernel_tag():
+    tag = parse_kernel_tag("6.6.0-170.0.0")
+    assert tag is not None
+    assert (tag.base, tag.build) == ("6.6", 170)
+    assert parse_kernel_tag("v6.6") is None
+    assert parse_kernel_tag("") is None
+
+
+@pytest.mark.parametrize(
+    ("left", "right", "expected"),
+    [
+        ("6.6.0-170.0.0", "6.6.0-167.0.0", 1),
+        ("6.6.0-167.0.0", "6.6.0-170.0.0", -1),
+        ("6.6.0-170.0.0", "6.6.0-170.0.0", 0),
+        # 位数变化时字符串比较会翻车，构建号必须是整数比较
+        ("6.6.0-99.0.0", "6.6.0-170.0.0", -1),
+        # 跨基线不比
+        ("6.6.0-170.0.0", "5.10.0-331.0.0", None),
+        ("6.6.0-170.0.0", "not-a-tag", None),
+    ],
+)
+def test_compare_tags(left, right, expected):
+    assert compare_tags(left, right) == expected

package/backend/tests/test_review_parser.py

@@ -0,0 +1,301 @@
+"""评审解析与门禁判定。
+
+门禁链条与标签取值均来自对真实仓库的实测（含已合并 PR 的标签组合），
+不依赖官方文档描述。
+"""
+
+from datetime import UTC, datetime, timedelta
+
+import pytest
+
+from app.domain.review import (
+    EventType,
+    GateStage,
+    derive_gate,
+    is_bot,
+    parse_comment_command,
+    parse_events,
+    parse_label,
+    unrecognized_labels,
+)
+
+T0 = datetime(2026, 9, 1, 10, 0, tzinfo=UTC)
+
+# 实测：已合并 PR #27570 的标签组合
+MERGED_LABELS = ["openeuler-cla/yes", "sig/Kernel", "ci_successful", "lgtm", "approved"]
+
+
+# --- 标签解析 ---------------------------------------------------------
+
+
+def test_plain_lgtm_label():
+    event = parse_label("lgtm", "", T0)
+    assert event is not None
+    assert event.event_type is EventType.LGTM
+    assert event.actor_login == ""
+
+
+def test_cla_label():
+    event = parse_label("openeuler-cla/yes", "", T0)
+    assert event is not None
+    assert event.event_type is EventType.CLA_SIGNED
+
+
+def test_ci_labels():
+    assert parse_label("ci_successful", "", T0).event_type is EventType.CI_PASS
+    assert parse_label("ci_must_go_failed", "", T0).event_type is EventType.CI_FAIL
+    assert parse_label("ci_block_force_merge", "", T0).event_type is EventType.CI_FAIL
+
+
+def test_approved_label():
+    assert parse_label("approved", "", T0).event_type is EventType.APPROVE
+
+
+@pytest.mark.parametrize(
+    "name",
+    ["sig/Kernel", "kind/abandoned", "kind/lgtm-for-ci", "kind/kabi-need-review", "ai-suc"],
+)
+def test_irrelevant_labels_are_not_review_events(name):
+    """sig/、kind/、ai- 前缀是分类标签，与评审门禁无关。
+
+    注意 kind/lgtm-for-ci 虽然名字含 lgtm，但它是 kind/ 分类标签，
+    不代表评审通过，不能计入 LGTM。
+    """
+    assert parse_label(name, "", T0) is None
+
+
+# --- 评论指令 ---------------------------------------------------------
+
+
+def test_comment_command_lgtm():
+    event = parse_comment_command("/lgtm", "someuser", T0)
+    assert event is not None
+    assert event.event_type is EventType.LGTM
+    assert event.source == "comment"
+
+
+def test_comment_command_approve():
+    assert parse_comment_command("/approve", "u", T0).event_type is EventType.APPROVE
+
+
+def test_comment_command_tolerates_surrounding_whitespace():
+    assert parse_comment_command("   /lgtm   ", "u", T0) is not None
+
+
+def test_comment_command_inside_multiline_body():
+    body = "看起来没问题。\n\n/lgtm\n\n谢谢"
+    assert parse_comment_command(body, "u", T0) is not None
+
+
+def test_plain_comment_is_not_a_command():
+    assert parse_comment_command("这个改动我看了，没问题", "u", T0) is None
+
+
+def test_prose_mentioning_command_is_not_a_command():
+    """只有独占一行的指令才算数，避免误判讨论文本。"""
+    assert parse_comment_command("please run /lgtm later", "u", T0) is None
+
+
+# --- 机器人识别 -------------------------------------------------------
+
+
+@pytest.mark.parametrize(
+    "login",
+    [
+        "openeuler-ci-bot",
+        "some-bot",
+        "x_bot",
+        "ci-bot",
+        "kernel[bot]",
+        # 实测存在的命名：以 robot 而非 bot 结尾，仅匹配后缀会漏掉
+        "devstation-robot",
+        "ci-robot1",
+        "openeuler-infra-bot",
+        "bot.user",
+    ],
+)
+def test_bot_detection(login):
+    assert is_bot(login)
+
+
+def test_bot_comments_are_excluded_from_events():
+    """机器人复述用户指令（如 LGTM 回执），若计入会系统性高估评审工作量。"""
+    labels = [("lgtm", T0)]
+    comments = [
+        ("/lgtm", "openeuler-ci-bot", T0),
+        ("/lgtm", "real-reviewer", T0),
+    ]
+    events = parse_events(labels, comments)
+    actors = {e.actor_login for e in events}
+    assert "openeuler-ci-bot" not in actors
+    assert "real-reviewer" in actors
+
+
+def test_events_are_sorted_by_time():
+    labels = [("lgtm", T0 + timedelta(days=2))]
+    comments = [("/approve", "alice", T0)]
+    events = parse_events(labels, comments)
+    assert events[0].occurred_at < events[1].occurred_at
+
+
+# --- 门禁判定 ---------------------------------------------------------
+
+
+def test_merged_pr_labels_satisfy_gate():
+    gate = derive_gate(MERGED_LABELS, state="merged")
+    assert gate.cla_signed
+    assert gate.ci_passed
+    assert gate.has_lgtm
+    assert gate.approved
+    assert gate.stage is GateStage.MERGED
+
+
+def test_empty_labels_block_at_cla():
+    gate = derive_gate([])
+    assert gate.stage is GateStage.CLA_PENDING
+    assert "CLA 未签署" in gate.blocking_reasons
+
+
+def test_ci_failure_blocks_even_with_lgtm_and_approve():
+    """CI 失败必须阻塞 —— 即使评审已通过。"""
+    labels = ["openeuler-cla/yes", "ci_must_go_failed", "lgtm", "approved"]
+    gate = derive_gate(labels)
+    assert gate.ci_failed
+    assert not gate.ready_to_merge
+    assert gate.stage is GateStage.CI_FAILED
+    assert "CI 未通过" in gate.blocking_reasons
+
+
+def test_missing_lgtm_blocks_merge():
+    labels = ["openeuler-cla/yes", "ci_successful", "approved"]
+    gate = derive_gate(labels)
+    assert not gate.ready_to_merge
+    assert gate.stage is GateStage.REVIEW_PENDING
+    assert "缺少 LGTM" in gate.blocking_reasons
+
+
+def test_approved_label_is_not_a_precondition_for_merge():
+    """approved 是合入时补记的标记，不应作为"可合入"的前置条件。
+
+    实测：200 个 open PR 中 0 个带 approved，而 200 个已合并 PR 中 199 个带。
+    若把 approved 设为前置条件，"可合入"在 open PR 上永不可能出现，
+    维护者最需要的待办队列会直接失效。
+    """
+    labels = ["openeuler-cla/yes", "ci_successful", "lgtm"]
+    gate = derive_gate(labels)
+    assert not gate.is_approved
+    assert gate.ready_to_merge
+    assert gate.stage is GateStage.READY_TO_MERGE
+    assert "缺少 Approved" not in gate.blocking_reasons
+
+
+def test_approved_label_is_still_tracked():
+    """不作为前置条件，但仍然要记录，供界面展示。"""
+    gate = derive_gate(["approved"])
+    assert gate.is_approved
+
+
+def test_full_gate_ready_to_merge():
+    gate = derive_gate(MERGED_LABELS, state="open")
+    assert gate.ready_to_merge
+    assert gate.stage is GateStage.READY_TO_MERGE
+    assert gate.blocking_reasons == []
+
+
+def test_draft_blocks_merge():
+    gate = derive_gate(MERGED_LABELS, is_draft=True)
+    assert not gate.ready_to_merge
+    assert gate.stage is GateStage.DRAFT
+
+
+def test_closed_pr_has_no_blocking_reasons():
+    """已关闭的 PR 不需要"阻塞原因"，展示它只会造成困惑。"""
+    gate = derive_gate(["openeuler-cla/yes"], state="closed")
+    assert gate.blocking_reasons == []
+    assert gate.stage is GateStage.CLOSED
+
+
+def test_blocking_reasons_follow_gate_order():
+    """原因按门禁链条顺序排列，便于界面按序引导。"""
+    gate = derive_gate([])
+    reasons = gate.blocking_reasons
+    assert reasons.index("CLA 未签署") < reasons.index("CI 未完成")
+    assert reasons.index("CI 未完成") < reasons.index("缺少 LGTM")
+
+
+# --- 诊断 -------------------------------------------------------------
+
+
+def test_unrecognized_labels_surface_unknown_ones():
+    """社区新增标签时应能被发现，而不是让评审状态静默出错。"""
+    labels = ["openeuler-cla/yes", "lgtm", "sig/Kernel", "kind/abandoned", "brand-new-label"]
+    assert unrecognized_labels(labels) == ["brand-new-label"]
+
+
+def test_unrecognized_labels_empty_for_known_set():
+    assert unrecognized_labels(MERGED_LABELS) == []
+
+
+# --- 对真实仓库数据的验证 ---------------------------------------------
+
+
+def _load_fixture(name: str):
+    import json
+    from pathlib import Path
+
+    path = Path(__file__).parent / "fixtures" / "atomgit" / name
+    return json.loads(path.read_text(encoding="utf-8"))
+
+
+def test_every_label_actually_in_use_is_recognized():
+    """所有**实际在用**的标签都必须被识别或明确归入已知无关类别。
+
+    注意断言对象是「用过」的标签而非标签库全集：标签库中存在
+    创建后从未使用的残留项（实测 invi / need / res / ci 在 700 个 PR 上
+    零出现），把它们纳入规则只会造成误导。
+
+    若有未识别项，说明社区新增了标签而解析规则未跟上 ——
+    此时评审状态会静默出错，必须尽早发现。
+    """
+    usage = _load_fixture("observed_label_usage.json")
+    in_use = [name for name in usage["labels"] if not name.startswith("_")]
+    in_use += [name for name in usage["user_scoped"] if not name.startswith("_")]
+
+    unknown = unrecognized_labels(in_use)
+    assert unknown == [], f"存在未识别的在用标签：{unknown}"
+
+
+def test_unused_library_labels_are_surfaced_not_guessed():
+    """标签库中的未使用残留项应被报告为未知，而不是被赋予臆测的语义。"""
+    labels = _load_fixture("labels.json")
+    names = [entry["name"] for entry in labels]
+    unknown = set(unrecognized_labels(names))
+    # 这些标签实测在 700 个 PR 上零出现，描述为空，语义不明。
+    # 宁可报告为未知，也不猜测其含义。
+    assert {"invi", "need", "res", "ci"} <= unknown
+
+
+def test_real_open_pulls_derive_a_gate_stage():
+    """对真实 open PR 列表跑一遍门禁推导，确保任何标签组合都不抛异常。"""
+    pulls = _load_fixture("pulls_page1.json")
+    stages: dict[str, int] = {}
+    for pull in pulls:
+        names = [label["name"] for label in pull.get("labels") or []]
+        gate = derive_gate(names, is_draft=pull.get("draft", False), state=pull["state"])
+        stages[gate.stage.value] = stages.get(gate.stage.value, 0) + 1
+        # 未合并的 PR 必须能说清楚卡在哪里
+        if gate.stage not in (GateStage.MERGED, GateStage.CLOSED):
+            assert gate.blocking_reasons, f"PR #{pull['number']} 未给出阻塞原因"
+    assert stages, "应至少推导出一个阶段"
+
+
+def test_real_merged_pulls_satisfy_gate():
+    """真实已合并的 PR，其标签应能满足门禁 —— 否则说明规则与实际情况不符。"""
+    pulls = _load_fixture("pulls_merged.json")
+    for pull in pulls:
+        names = [label["name"] for label in pull.get("labels") or []]
+        gate = derive_gate(names, state=pull["state"])
+        if gate.stage is GateStage.MERGED:
+            assert gate.cla_signed, f"已合并 PR #{pull['number']} 缺少 CLA 标签"
+            assert gate.has_lgtm, f"已合并 PR #{pull['number']} 缺少 LGTM 标签"
+            assert gate.approved, f"已合并 PR #{pull['number']} 缺少 approved 标签"

package/backend/tests/test_schemas_user.py

@@ -0,0 +1,97 @@
+"""用户 Schema 的序列化契约。
+
+角色对外必须是**名称字符串**而非整数 —— 前端按名称做类型与权限门控，
+整数会随枚举顺序调整而破坏兼容性。
+"""
+
+import uuid
+from datetime import UTC, datetime
+
+import pytest
+from pydantic import ValidationError
+
+from app.core.permissions import Permission, Role
+from app.models.user import User
+from app.schemas.user import CurrentUser, UserCreate, UserRead, UserUpdate
+
+
+def _make_user(role: Role = Role.ADMIN) -> User:
+    return User(
+        id=uuid.uuid4(),
+        username="alice",
+        display_name="Alice",
+        email="alice@example.com",
+        password_hash="$argon2id$fake",
+        role=role,
+        is_active=True,
+        created_at=datetime.now(UTC),
+        last_login_at=None,
+    )
+
+
+def test_role_serializes_as_name_not_int():
+    payload = UserRead.model_validate(_make_user(Role.ADMIN)).model_dump()
+    assert payload["role"] == "ADMIN"
+    assert payload["role"] != 50
+
+
+def test_role_round_trips_through_name():
+    data = UserRead.model_validate(_make_user(Role.MAINTAINER)).model_dump()
+    again = UserRead.model_validate({**data, "id": uuid.uuid4()})
+    assert again.role is Role.MAINTAINER
+
+
+def test_current_user_carries_permissions_as_strings():
+    base = UserRead.model_validate(_make_user(Role.ADMIN)).model_dump()
+    current = CurrentUser(**base, permissions=sorted(Permission, key=lambda p: p.value))
+    dumped = current.model_dump()
+    assert "manage_users" in dumped["permissions"]
+    assert dumped["role"] == "ADMIN"
+
+
+def test_user_create_accepts_role_by_name():
+    payload = {
+        "username": "bob",
+        "display_name": "Bob",
+        "email": "bob@example.com",
+        "password": "long-enough-password",
+        "role": "COMMITTER",
+    }
+    assert UserCreate(**payload).role is Role.COMMITTER
+
+
+def test_user_create_accepts_role_by_numeric_value():
+    payload = {
+        "username": "bob",
+        "display_name": "Bob",
+        "email": "bob@example.com",
+        "password": "long-enough-password",
+        "role": 30,
+    }
+    assert UserCreate(**payload).role is Role.COMMITTER
+
+
+def test_user_create_rejects_unknown_role():
+    with pytest.raises(ValidationError, match="未知角色"):
+        UserCreate(
+            username="bob",
+            display_name="Bob",
+            email="bob@example.com",
+            password="long-enough-password",
+            role="SUPERUSER",
+        )
+
+
+def test_user_create_rejects_illegal_username():
+    with pytest.raises(ValidationError, match="用户名只能包含"):
+        UserCreate(
+            username="bob space",
+            display_name="Bob",
+            email="bob@example.com",
+            password="long-enough-password",
+        )
+
+
+def test_user_update_role_is_optional():
+    assert UserUpdate().role is None
+    assert UserUpdate(role="REVIEWER").role is Role.REVIEWER

package/backend/tests/test_security.py

@@ -0,0 +1,92 @@
+from datetime import UTC, datetime, timedelta
+
+import jwt
+import pytest
+
+from app.core.security import (
+    TokenType,
+    create_token,
+    decode_token,
+    hash_password,
+    needs_rehash,
+    verify_password,
+)
+
+SECRET = "0123456789abcdef0123456789abcdef"
+
+
+def test_password_hash_roundtrip():
+    hashed = hash_password("correct horse battery staple")
+    assert hashed != "correct horse battery staple"
+    assert verify_password("correct horse battery staple", hashed)
+
+
+def test_password_verify_rejects_wrong_password():
+    assert not verify_password("wrong", hash_password("right"))
+
+
+def test_password_hash_uses_argon2id():
+    assert hash_password("x").startswith("$argon2id$")
+
+
+def test_password_hash_is_salted():
+    assert hash_password("same") != hash_password("same")
+
+
+def test_verify_password_tolerates_malformed_hash():
+    assert not verify_password("anything", "not-a-valid-hash")
+
+
+def test_needs_rehash_is_false_for_current_params():
+    assert needs_rehash(hash_password("x")) is False
+
+
+def test_needs_rehash_is_true_for_garbage():
+    assert needs_rehash("garbage") is True
+
+
+def test_access_token_roundtrip():
+    token = create_token(subject="user-1", token_type=TokenType.ACCESS, secret=SECRET)
+    payload = decode_token(token, secret=SECRET, expected_type=TokenType.ACCESS)
+    assert payload["sub"] == "user-1"
+    assert payload["type"] == "access"
+
+
+def test_extra_claims_are_preserved():
+    token = create_token(
+        subject="u",
+        token_type=TokenType.ACCESS,
+        secret=SECRET,
+        extra_claims={"role": "ADMIN"},
+    )
+    payload = decode_token(token, secret=SECRET, expected_type=TokenType.ACCESS)
+    assert payload["role"] == "ADMIN"
+
+
+def test_decode_rejects_wrong_token_type():
+    token = create_token(subject="u", token_type=TokenType.ACCESS, secret=SECRET)
+    with pytest.raises(jwt.InvalidTokenError):
+        decode_token(token, secret=SECRET, expected_type=TokenType.REFRESH)
+
+
+def test_decode_rejects_wrong_secret():
+    token = create_token(subject="u", token_type=TokenType.ACCESS, secret=SECRET)
+    with pytest.raises(jwt.InvalidTokenError):
+        decode_token(token, secret="x" * 32, expected_type=TokenType.ACCESS)
+
+
+def test_decode_rejects_expired_token():
+    token = create_token(
+        subject="u",
+        token_type=TokenType.ACCESS,
+        secret=SECRET,
+        expires_delta=timedelta(seconds=-1),
+    )
+    with pytest.raises(jwt.ExpiredSignatureError):
+        decode_token(token, secret=SECRET, expected_type=TokenType.ACCESS)
+
+
+def test_token_carries_future_expiry():
+    token = create_token(subject="u", token_type=TokenType.ACCESS, secret=SECRET)
+    payload = jwt.decode(token, SECRET, algorithms=["HS256"])
+    assert datetime.fromtimestamp(payload["exp"], tz=UTC) > datetime.now(UTC)