@ngocsangairvds/vsaf 3.2.15 → 4.0.0

package/tools/vds-scripts/telegram_bridge/tests/unit/test_preflight.py

@@ -1,188 +0,0 @@
-"""Unit tests for the bot-permission preflight (TSK-1.11)."""
-
-from __future__ import annotations
-
-from unittest.mock import AsyncMock, MagicMock
-
-import pytest
-
-from telegram_bridge.daemon.preflight import (
-    PreflightError,
-    _missing_permissions,
-    check_bot_admin_permissions,
-)
-
-
-def _fake_member(**perms: bool) -> MagicMock:
-    m = MagicMock()
-    for k in (
-        "can_manage_topics",
-        "can_post_messages",
-        "can_edit_messages",
-        "can_delete_messages",
-        "can_change_info",
-    ):
-        setattr(m, k, perms.get(k, False))
-    return m
-
-
-def test_all_permissions_present_returns_empty_list() -> None:
-    m = _fake_member(
-        can_manage_topics=True,
-        can_post_messages=True,
-        can_edit_messages=True,
-        can_delete_messages=True,
-        can_change_info=True,
-    )
-    assert _missing_permissions(m) == []
-
-
-def test_missing_can_manage_topics_is_hard_required() -> None:
-    m = _fake_member(
-        can_post_messages=True,
-        can_edit_messages=True,
-        can_delete_messages=True,
-        can_change_info=True,
-        # can_manage_topics missing
-    )
-    missing = _missing_permissions(m)
-    assert len(missing) == 1
-    assert missing[0].name == "can_manage_topics"
-    assert missing[0].category.value == "hard_required"
-
-
-def test_missing_ux_perm_categorised_correctly() -> None:
-    m = _fake_member(
-        can_manage_topics=True,
-        can_post_messages=True,
-        can_edit_messages=True,
-        can_delete_messages=True,
-        # can_change_info missing
-    )
-    missing = _missing_permissions(m)
-    assert len(missing) == 1
-    assert missing[0].name == "can_change_info"
-    assert missing[0].category.value == "ux_required"
-
-
-def test_multiple_missing_perms_all_reported() -> None:
-    m = _fake_member()  # nothing
-    missing = _missing_permissions(m)
-    assert len(missing) == 5  # all five
-
-
-def test_preflight_error_message_lists_each_missing_with_reason() -> None:
-    """Demonstrate that the error message format is operator-friendly."""
-    err = PreflightError(
-        "Bot is missing required permissions in supergroup -1001:\n"
-        "  [hard_required]\n"
-        "    - can_manage_topics (createForumTopic ...)\n"
-        "Promote the bot to admin and restart."
-    )
-    s = str(err)
-    assert "supergroup -1001" in s
-    assert "can_manage_topics" in s
-    assert "Promote the bot" in s
-
-
-@pytest.mark.parametrize(
-    "perm_name",
-    [
-        "can_manage_topics",
-        "can_post_messages",
-        "can_edit_messages",
-        "can_delete_messages",
-        "can_change_info",
-    ],
-)
-def test_each_individual_perm_is_independently_detectable(perm_name: str) -> None:
-    """Operators get the SPECIFIC missing permission, not a generic 'wrong'."""
-    perms = dict.fromkeys(("can_manage_topics", "can_post_messages", "can_edit_messages", "can_delete_messages", "can_change_info"), True)
-    perms[perm_name] = False
-    m = _fake_member(**perms)
-    missing = _missing_permissions(m)
-    assert len(missing) == 1
-    assert missing[0].name == perm_name
-
-
-# ---------------------------------------------------------------------------
-# check_bot_admin_permissions — full async path (FR-2.4)
-# ---------------------------------------------------------------------------
-
-
-def _fake_bot_with_member(member: MagicMock, *, bot_id: int = 42) -> MagicMock:
-    """Build a fake aiogram Bot whose `get_me()` and `get_chat_member()` are
-    AsyncMock-driven and return the given ChatMember."""
-    me = MagicMock()
-    me.id = bot_id
-    bot = MagicMock()
-    bot.get_me = AsyncMock(return_value=me)
-    bot.get_chat_member = AsyncMock(return_value=member)
-    return bot
-
-
-@pytest.mark.asyncio
-async def test_check_passes_silently_when_all_perms_present() -> None:
-    """The success path must NOT raise, must NOT print, must consume exactly
-    one getChatMember call (cheap on the Bot API rate budget)."""
-    member = _fake_member(
-        can_manage_topics=True,
-        can_post_messages=True,
-        can_edit_messages=True,
-        can_delete_messages=True,
-        can_change_info=True,
-    )
-    bot = _fake_bot_with_member(member)
-    await check_bot_admin_permissions(bot, supergroup_id=-1001)
-    bot.get_chat_member.assert_awaited_once_with(chat_id=-1001, user_id=42)
-
-
-@pytest.mark.asyncio
-async def test_check_raises_with_supergroup_id_and_perm_name_in_message() -> None:
-    """The error message MUST contain the specific supergroup id + the
-    missing perm name so operators can fix the right setting in the right
-    chat without further log-spelunking."""
-    member = _fake_member(
-        # All UX perms present, but hard-required is missing.
-        can_post_messages=True,
-        can_edit_messages=True,
-        can_delete_messages=True,
-        can_change_info=True,
-    )
-    bot = _fake_bot_with_member(member)
-    with pytest.raises(PreflightError) as ei:
-        await check_bot_admin_permissions(bot, supergroup_id=-1009999)
-    s = str(ei.value)
-    assert "-1009999" in s
-    assert "can_manage_topics" in s
-    assert "hard_required" in s
-
-
-@pytest.mark.asyncio
-async def test_check_groups_missing_perms_by_category() -> None:
-    """When both hard-required AND ux-required perms are missing, the error
-    message groups them under their category headers — operators see
-    severity at a glance."""
-    member = _fake_member()  # nothing
-    bot = _fake_bot_with_member(member)
-    with pytest.raises(PreflightError) as ei:
-        await check_bot_admin_permissions(bot, supergroup_id=-1001)
-    s = str(ei.value)
-    assert "[hard_required]" in s
-    assert "[ux_required]" in s
-    # Reminder line must point operators at the fix.
-    assert "Promote the bot to admin" in s
-
-
-@pytest.mark.asyncio
-async def test_check_propagates_get_chat_member_exceptions() -> None:
-    """If the Bot API itself fails (network, 401, supergroup unknown), the
-    exception SHOULD propagate so the operator sees a real Telegram error
-    and not a misleading 'permissions missing' wrap."""
-    bot = MagicMock()
-    me = MagicMock()
-    me.id = 42
-    bot.get_me = AsyncMock(return_value=me)
-    bot.get_chat_member = AsyncMock(side_effect=RuntimeError("Bad Request: chat not found"))
-    with pytest.raises(RuntimeError, match="chat not found"):
-        await check_bot_admin_permissions(bot, supergroup_id=-1001)

package/tools/vds-scripts/telegram_bridge/tests/unit/test_redaction.py

@@ -1,193 +0,0 @@
-"""Unit tests for PatternRedactionInterceptor (TSK-7.3 / NFR-5.4)."""
-
-from __future__ import annotations
-
-import re
-
-import pytest
-
-from telegram_bridge.daemon.audit import PatternRedactionInterceptor
-from telegram_bridge.runners._base.secret_patterns import (
-    DEFAULT_PATTERNS,
-    parse_extra_patterns,
-)
-
-# ---- DEFAULT_PATTERNS coverage ------------------------------------------
-
-
-@pytest.mark.asyncio
-async def test_redacts_anthropic_api_key() -> None:
-    interceptor = PatternRedactionInterceptor()
-    blob = b"my key is sk-ant-" + (b"A" * 80) + b" thanks"
-    out = await interceptor.on_write(blob, "application/json")
-    assert b"sk-ant-" not in out
-    assert b"<REDACTED:ANTHROPIC_API_KEY:" in out
-
-
-@pytest.mark.asyncio
-async def test_redacts_openai_api_key() -> None:
-    interceptor = PatternRedactionInterceptor()
-    blob = b'{"key": "sk-proj-' + (b"X" * 50) + b'"}'
-    out = await interceptor.on_write(blob, "application/json")
-    assert b"sk-proj-" not in out
-    assert b"<REDACTED:OPENAI_API_KEY:" in out
-
-
-@pytest.mark.asyncio
-async def test_redacts_github_token() -> None:
-    interceptor = PatternRedactionInterceptor()
-    blob = b"token=ghp_" + (b"A" * 36)
-    out = await interceptor.on_write(blob, None)
-    assert b"ghp_" not in out
-    assert b"<REDACTED:GITHUB_TOKEN:" in out
-
-
-@pytest.mark.asyncio
-async def test_redacts_aws_access_key_id() -> None:
-    interceptor = PatternRedactionInterceptor()
-    blob = b"AKIAIOSFODNN7EXAMPLE inside payload"
-    out = await interceptor.on_write(blob, None)
-    assert b"AKIAIOSFODNN7EXAMPLE" not in out
-    assert b"<REDACTED:AWS_ACCESS_KEY_ID:" in out
-
-
-@pytest.mark.asyncio
-async def test_redacts_telegram_bot_token() -> None:
-    interceptor = PatternRedactionInterceptor()
-    blob = b"BOT 123456789:" + b"a" * 35
-    out = await interceptor.on_write(blob, None)
-    assert b":aaaa" not in out
-    assert b"<REDACTED:TELEGRAM_BOT_TOKEN:" in out
-
-
-@pytest.mark.asyncio
-async def test_redacts_bearer_in_header() -> None:
-    interceptor = PatternRedactionInterceptor()
-    blob = b"Authorization: Bearer abcdefghij_ABCDEFGHIJ_1234567890"
-    out = await interceptor.on_write(blob, None)
-    assert b"Bearer abcd" not in out
-    assert b"<REDACTED:BEARER:" in out
-
-
-# ---- Determinism + dedup correlation hash -------------------------------
-
-
-@pytest.mark.asyncio
-async def test_same_secret_produces_same_marker() -> None:
-    interceptor = PatternRedactionInterceptor()
-    blob1 = b"prefix sk-ant-" + (b"K" * 60) + b" suffix"
-    blob2 = b"different sk-ant-" + (b"K" * 60) + b" wrap"
-    out1 = await interceptor.on_write(blob1, None)
-    out2 = await interceptor.on_write(blob2, None)
-    # Both contain the same `<REDACTED:ANTHROPIC_API_KEY:<sha8>>` marker because
-    # the secret bytes were identical.
-    m1 = re.search(rb"<REDACTED:ANTHROPIC_API_KEY:([a-f0-9]{8})>", out1)
-    m2 = re.search(rb"<REDACTED:ANTHROPIC_API_KEY:([a-f0-9]{8})>", out2)
-    assert m1 and m2
-    assert m1.group(1) == m2.group(1)
-
-
-@pytest.mark.asyncio
-async def test_different_secrets_produce_different_markers() -> None:
-    interceptor = PatternRedactionInterceptor()
-    blob1 = b"sk-ant-" + (b"A" * 60)
-    blob2 = b"sk-ant-" + (b"B" * 60)
-    out1 = await interceptor.on_write(blob1, None)
-    out2 = await interceptor.on_write(blob2, None)
-    m1 = re.search(rb"<REDACTED:ANTHROPIC_API_KEY:([a-f0-9]{8})>", out1)
-    m2 = re.search(rb"<REDACTED:ANTHROPIC_API_KEY:([a-f0-9]{8})>", out2)
-    assert m1 and m2
-    assert m1.group(1) != m2.group(1)
-
-
-# ---- Binary mime types skipped -----------------------------------------
-
-
-@pytest.mark.asyncio
-async def test_binary_mime_passes_through_unchanged() -> None:
-    interceptor = PatternRedactionInterceptor()
-    blob = b"not really binary but pretend: sk-ant-" + (b"K" * 60)
-    out = await interceptor.on_write(blob, "image/png")
-    # Binary blob — never scanned.
-    assert out == blob
-
-
-@pytest.mark.asyncio
-async def test_octet_stream_passes_through_unchanged() -> None:
-    interceptor = PatternRedactionInterceptor()
-    blob = b"AKIAIOSFODNN7EXAMPLE-binary-payload"
-    out = await interceptor.on_write(blob, "application/octet-stream")
-    assert out == blob
-
-
-@pytest.mark.asyncio
-async def test_clean_blob_unchanged() -> None:
-    interceptor = PatternRedactionInterceptor()
-    blob = b'{"event": "user_input", "text": "what does this code do?"}'
-    out = await interceptor.on_write(blob, "application/json")
-    assert out == blob
-
-
-# ---- VDS_TELEGRAM_AUDIT_REDACT_PATTERNS extension -----------------------
-
-
-def test_parse_extra_patterns_empty_string() -> None:
-    assert parse_extra_patterns("") == ()
-    assert parse_extra_patterns("   ") == ()
-
-
-def test_parse_extra_patterns_single_entry() -> None:
-    out = parse_extra_patterns("CUSTOM=secret_[a-z]{10}")
-    assert len(out) == 1
-    assert out[0].kind == "CUSTOM"
-    assert out[0].regex.match(b"secret_abcdefghij")
-
-
-def test_parse_extra_patterns_multi_entry() -> None:
-    out = parse_extra_patterns("FOO=foo_\\d+, BAR=bar_[A-Z]{4}")
-    assert len(out) == 2
-    assert {p.kind for p in out} == {"FOO", "BAR"}
-
-
-def test_parse_extra_patterns_invalid_regex_raises() -> None:
-    with pytest.raises(ValueError):
-        parse_extra_patterns("BAD=[unclosed")
-
-
-def test_parse_extra_patterns_missing_equals_raises() -> None:
-    with pytest.raises(ValueError):
-        parse_extra_patterns("no_equals_sign")
-
-
-def test_default_patterns_are_non_empty() -> None:
-    assert len(DEFAULT_PATTERNS) >= 5
-    kinds = {p.kind for p in DEFAULT_PATTERNS}
-    assert "ANTHROPIC_API_KEY" in kinds
-    assert "OPENAI_API_KEY" in kinds
-    assert "GITHUB_TOKEN" in kinds
-    assert "TELEGRAM_BOT_TOKEN" in kinds
-
-
-# ---- Multi-pattern: two distinct secret types in the same blob ---------
-
-
-@pytest.mark.asyncio
-async def test_redacts_multiple_pattern_types_in_same_blob() -> None:
-    """A blob containing both an Anthropic API key AND a GitHub token must have
-    BOTH patterns redacted — not just the first match.
-
-    Catches any early-return or regex-alternation bug in the pattern loop that
-    would leave the second secret type un-redacted.
-    """
-    interceptor = PatternRedactionInterceptor()
-    # Two distinct secret shapes in the same payload:
-    anthropic_key = b"sk-ant-" + b"A" * 60  # 67 chars — matches ANTHROPIC_API_KEY
-    github_token = b"ghp_" + b"B" * 36  # 40 chars — matches GITHUB_TOKEN
-    blob = b'{"api_key": "' + anthropic_key + b'", "gh": "' + github_token + b'"}'
-
-    out = await interceptor.on_write(blob, "application/json")
-
-    assert anthropic_key not in out, "ANTHROPIC_API_KEY pattern must be redacted even when GITHUB_TOKEN is also present"
-    assert github_token not in out, "GITHUB_TOKEN pattern must be redacted even when ANTHROPIC_API_KEY is also present"
-    assert b"<REDACTED:ANTHROPIC_API_KEY:" in out
-    assert b"<REDACTED:GITHUB_TOKEN:" in out

package/tools/vds-scripts/telegram_bridge/tests/unit/test_registry.py

@@ -1,71 +0,0 @@
-"""Unit tests for registry.yaml (TSK-2.5 / FR-3.5).
-
-Validates schema shape and support_level invariants before the daemon's
-boot-time loader is implemented.
-"""
-
-from __future__ import annotations
-
-from pathlib import Path
-
-import pytest
-import yaml
-
-REGISTRY_PATH = Path(__file__).resolve().parents[2] / "registry.yaml"
-VALID_SUPPORT_LEVELS = frozenset({"stable", "experimental", "planned"})
-VALID_RUNNERS = frozenset({"claude-sdk-runner", "codex-runner", "acp-runner"})
-
-
-@pytest.fixture(scope="module")
-def registry() -> dict:
-    return yaml.safe_load(REGISTRY_PATH.read_text())
-
-
-def test_registry_loads(registry: dict) -> None:
-    assert "agents" in registry
-    assert "defaults" in registry
-
-
-def test_every_agent_has_required_fields(registry: dict) -> None:
-    for name, entry in registry["agents"].items():
-        assert "runner" in entry, f"{name}: missing runner"
-        assert "support_level" in entry, f"{name}: missing support_level"
-        assert "icon" in entry, f"{name}: missing icon"
-
-
-def test_runner_values_are_valid(registry: dict) -> None:
-    for name, entry in registry["agents"].items():
-        assert entry["runner"] in VALID_RUNNERS, f"{name}: unknown runner {entry['runner']}"
-
-
-def test_support_level_values_are_valid(registry: dict) -> None:
-    for name, entry in registry["agents"].items():
-        assert entry["support_level"] in VALID_SUPPORT_LEVELS, f"{name}: unknown support_level {entry['support_level']}"
-
-
-def test_acp_runners_have_command(registry: dict) -> None:
-    """acp-runner entries MUST carry a `command` invocation array."""
-    for name, entry in registry["agents"].items():
-        if entry["runner"] == "acp-runner":
-            assert "command" in entry, f"{name} (acp-runner): missing command"
-            assert isinstance(entry["command"], list), f"{name}: command must be a list"
-
-
-def test_claude_sdk_runner_has_sdk_options(registry: dict) -> None:
-    """claude-sdk-runner entries MUST carry sdk_options (hooks etc.)."""
-    for name, entry in registry["agents"].items():
-        if entry["runner"] == "claude-sdk-runner":
-            assert "sdk_options" in entry, f"{name}: missing sdk_options"
-
-
-def test_default_support_level_is_planned(registry: dict) -> None:
-    """Per spec: any entry without explicit support_level inherits 'planned'."""
-    assert registry["defaults"]["support_level"] == "planned"
-
-
-def test_stable_agents_are_only_claude_and_codex(registry: dict) -> None:
-    """Round-5 graduation rule — only Claude (Wave 1) and Codex (Wave 0 TSK-0.7) start as stable."""
-    stable = {n for n, e in registry["agents"].items() if e["support_level"] == "stable"}
-    assert stable == {"claude", "codex"}, (
-        f"Unexpected stable agents: {stable}. Others must pass Wave-0 conformance first."
-    )

package/tools/vds-scripts/telegram_bridge/tests/unit/test_registry_loader.py

@@ -1,133 +0,0 @@
-"""Unit tests for the registry-loader (TSK-2.5)."""
-
-from __future__ import annotations
-
-import textwrap
-from pathlib import Path
-
-import pytest
-
-from telegram_bridge.daemon.registry_loader import (
-    RegistryError,
-    SupportLevel,
-    find_runner_module,
-    load_registry,
-)
-
-
-def _write(tmp_path: Path, body: str) -> Path:
-    p = tmp_path / "registry.yaml"
-    p.write_text(textwrap.dedent(body))
-    return p
-
-
-def test_load_minimal_valid(tmp_path: Path) -> None:
-    p = _write(
-        tmp_path,
-        """
-        agents:
-          claude:
-            runner: claude-sdk-runner
-            icon: purple
-            support_level: stable
-            requires_env: [ANTHROPIC_API_KEY]
-        defaults:
-          runner: acp-runner
-          support_level: planned
-        """,
-    )
-    agents = load_registry(p)
-    assert "claude" in agents
-    assert agents["claude"].support_level == SupportLevel.STABLE
-    assert agents["claude"].requires_env == ("ANTHROPIC_API_KEY",)
-
-
-def test_acp_runner_requires_command(tmp_path: Path) -> None:
-    p = _write(
-        tmp_path,
-        """
-        agents:
-          cursor:
-            runner: acp-runner
-            icon: blue
-            support_level: experimental
-            # missing `command`
-        """,
-    )
-    with pytest.raises(RegistryError, match="missing `command`"):
-        load_registry(p)
-
-
-def test_unknown_runner_rejected(tmp_path: Path) -> None:
-    p = _write(
-        tmp_path,
-        """
-        agents:
-          mystery:
-            runner: not-a-real-runner
-            icon: gray
-            support_level: stable
-        """,
-    )
-    with pytest.raises(RegistryError, match="unknown runner"):
-        load_registry(p)
-
-
-def test_invalid_support_level_rejected(tmp_path: Path) -> None:
-    p = _write(
-        tmp_path,
-        """
-        agents:
-          claude:
-            runner: claude-sdk-runner
-            icon: purple
-            support_level: bogus
-        """,
-    )
-    with pytest.raises(RegistryError, match="invalid support_level"):
-        load_registry(p)
-
-
-def test_default_support_level_applied_when_missing(tmp_path: Path) -> None:
-    p = _write(
-        tmp_path,
-        """
-        agents:
-          codex:
-            runner: codex-runner
-            command: [codex, --output-format, acp]
-            icon: green
-            # no support_level — inherit default
-        defaults:
-          support_level: experimental
-        """,
-    )
-    agents = load_registry(p)
-    assert agents["codex"].support_level == SupportLevel.EXPERIMENTAL
-
-
-def test_find_runner_module_maps_each_kind(tmp_path: Path) -> None:
-    p = _write(
-        tmp_path,
-        """
-        agents:
-          claude:
-            runner: claude-sdk-runner
-            icon: purple
-            support_level: stable
-          codex:
-            runner: codex-runner
-            command: [codex, --output-format, acp]
-            icon: green
-            support_level: stable
-          cursor:
-            runner: acp-runner
-            command: [cursor-agent, acp]
-            icon: blue
-            support_level: experimental
-        """,
-    )
-    agents = load_registry(p)
-    assert find_runner_module(agents["claude"]) == "telegram_bridge.runners.claude"
-    assert find_runner_module(agents["codex"]) == "telegram_bridge.runners.codex"
-    assert find_runner_module(agents["cursor"]) == "telegram_bridge.runners.acp"