@smilintux/skcapstone 0.1.0 → 0.2.3

package/tests/test_identity_capauth.py

@@ -0,0 +1,307 @@
+"""Tests for CapAuth identity integration.
+
+Covers both paths: real CapAuth profile present vs placeholder fallback.
+"""
+
+from __future__ import annotations
+
+import json
+from datetime import datetime, timezone
+from pathlib import Path
+from types import SimpleNamespace
+from unittest.mock import MagicMock, patch
+
+import pytest
+
+from skcapstone.discovery import (
+    _sync_identity_json,
+    _try_load_capauth_profile,
+    discover_identity,
+)
+from skcapstone.models import IdentityState, PillarStatus
+from skcapstone.pillars.identity import (
+    _generate_placeholder_fingerprint,
+    _try_init_capauth,
+    generate_identity,
+)
+
+
+def _fake_profile(
+    fingerprint: str = "A" * 40,
+    name: str = "Opus",
+    email: str = "opus@capauth.local",
+) -> SimpleNamespace:
+    """Build a fake SovereignProfile-like object for testing."""
+    return SimpleNamespace(
+        key_info=SimpleNamespace(
+            fingerprint=fingerprint,
+            public_key_path="/tmp/public.asc",
+            created=datetime(2026, 1, 1, tzinfo=timezone.utc),
+        ),
+        entity=SimpleNamespace(name=name, email=email),
+    )
+
+
+# ---------------------------------------------------------------------------
+# discover_identity: real CapAuth path
+# ---------------------------------------------------------------------------
+
+
+class TestDiscoverWithCapAuth:
+    """Tests for discover_identity when a real CapAuth profile exists."""
+
+    def test_uses_capauth_fingerprint(self, tmp_agent_home: Path):
+        """discover_identity returns the real CapAuth fingerprint."""
+        fake = _fake_profile(fingerprint="B" * 40, name="Jarvis")
+
+        with patch(
+            "skcapstone.discovery._try_load_capauth_profile",
+            return_value=IdentityState(
+                fingerprint=fake.key_info.fingerprint,
+                name=fake.entity.name,
+                email=fake.entity.email,
+                key_path=Path(fake.key_info.public_key_path),
+                created_at=fake.key_info.created,
+                status=PillarStatus.ACTIVE,
+            ),
+        ):
+            state = discover_identity(tmp_agent_home)
+
+        assert state.fingerprint == "B" * 40
+        assert state.name == "Jarvis"
+        assert state.status == PillarStatus.ACTIVE
+
+    def test_syncs_identity_json(self, tmp_agent_home: Path):
+        """discover_identity writes identity.json with capauth_managed=True."""
+        identity_dir = tmp_agent_home / "identity"
+        identity_dir.mkdir(parents=True, exist_ok=True)
+
+        fake = _fake_profile(fingerprint="C" * 40)
+        with patch(
+            "skcapstone.discovery._try_load_capauth_profile",
+            return_value=IdentityState(
+                fingerprint="C" * 40,
+                name="Opus",
+                email="opus@capauth.local",
+                key_path=Path("/tmp/public.asc"),
+                status=PillarStatus.ACTIVE,
+            ),
+        ):
+            discover_identity(tmp_agent_home)
+
+        manifest = json.loads((identity_dir / "identity.json").read_text())
+        assert manifest["fingerprint"] == "C" * 40
+        assert manifest["capauth_managed"] is True
+
+    def test_replaces_placeholder_fingerprint(self, tmp_agent_home: Path):
+        """When upgrading from placeholder to real keys, identity.json updates."""
+        identity_dir = tmp_agent_home / "identity"
+        identity_dir.mkdir(parents=True, exist_ok=True)
+
+        old_manifest = {
+            "name": "test",
+            "email": "test@skcapstone.local",
+            "fingerprint": _generate_placeholder_fingerprint("test"),
+            "capauth_managed": False,
+        }
+        (identity_dir / "identity.json").write_text(json.dumps(old_manifest))
+
+        with patch(
+            "skcapstone.discovery._try_load_capauth_profile",
+            return_value=IdentityState(
+                fingerprint="D" * 40,
+                name="test",
+                email="test@capauth.local",
+                status=PillarStatus.ACTIVE,
+            ),
+        ):
+            state = discover_identity(tmp_agent_home)
+
+        assert state.fingerprint == "D" * 40
+        updated = json.loads((identity_dir / "identity.json").read_text())
+        assert updated["fingerprint"] == "D" * 40
+        assert updated["capauth_managed"] is True
+
+
+# ---------------------------------------------------------------------------
+# discover_identity: placeholder fallback
+# ---------------------------------------------------------------------------
+
+
+class TestDiscoverWithoutCapAuth:
+    """Tests for discover_identity when CapAuth is not available."""
+
+    def test_reads_existing_identity_json(self, tmp_agent_home: Path):
+        """Falls back to reading identity.json when no CapAuth profile."""
+        identity_dir = tmp_agent_home / "identity"
+        identity_dir.mkdir(parents=True, exist_ok=True)
+
+        manifest = {
+            "name": "fallback-agent",
+            "email": "fallback@skcapstone.local",
+            "fingerprint": "F" * 40,
+            "capauth_managed": False,
+            "created_at": "2026-01-01T00:00:00+00:00",
+        }
+        (identity_dir / "identity.json").write_text(json.dumps(manifest))
+
+        with patch("skcapstone.discovery._try_load_capauth_profile", return_value=None):
+            state = discover_identity(tmp_agent_home)
+
+        assert state.fingerprint == "F" * 40
+        assert state.name == "fallback-agent"
+        assert state.status == PillarStatus.DEGRADED
+
+    def test_no_identity_at_all(self, tmp_agent_home: Path):
+        """No identity.json and no CapAuth returns MISSING."""
+        with patch("skcapstone.discovery._try_load_capauth_profile", return_value=None):
+            state = discover_identity(tmp_agent_home)
+
+        assert state.status == PillarStatus.MISSING
+
+    def test_capauth_managed_true_is_active(self, tmp_agent_home: Path):
+        """identity.json with capauth_managed=True is ACTIVE even without profile load."""
+        identity_dir = tmp_agent_home / "identity"
+        identity_dir.mkdir(parents=True, exist_ok=True)
+
+        manifest = {
+            "name": "real-agent",
+            "email": "real@capauth.local",
+            "fingerprint": "E" * 40,
+            "capauth_managed": True,
+        }
+        (identity_dir / "identity.json").write_text(json.dumps(manifest))
+
+        with patch("skcapstone.discovery._try_load_capauth_profile", return_value=None):
+            state = discover_identity(tmp_agent_home)
+
+        assert state.status == PillarStatus.ACTIVE
+
+
+# ---------------------------------------------------------------------------
+# generate_identity: init path
+# ---------------------------------------------------------------------------
+
+
+class TestGenerateIdentity:
+    """Tests for generate_identity (the skcapstone init path)."""
+
+    def test_placeholder_when_no_capauth(self, tmp_agent_home: Path):
+        """Without CapAuth, generates a placeholder fingerprint."""
+        with patch(
+            "skcapstone.pillars.identity._try_init_capauth", return_value=None
+        ):
+            state = generate_identity(tmp_agent_home, "test-agent")
+
+        assert state.status == PillarStatus.DEGRADED
+        assert state.fingerprint == _generate_placeholder_fingerprint("test-agent")
+        assert len(state.fingerprint) == 40
+
+    def test_active_when_capauth_works(self, tmp_agent_home: Path):
+        """With CapAuth, uses real keys and sets ACTIVE."""
+        fake_state = IdentityState(
+            fingerprint="A" * 40,
+            key_path=Path("/tmp/pub.asc"),
+            name="test",
+            email="test@capauth.local",
+            status=PillarStatus.ACTIVE,
+        )
+        with patch(
+            "skcapstone.pillars.identity._try_init_capauth", return_value=fake_state
+        ):
+            state = generate_identity(tmp_agent_home, "test")
+
+        assert state.fingerprint == "A" * 40
+        assert state.status == PillarStatus.ACTIVE
+
+    def test_identity_json_written(self, tmp_agent_home: Path):
+        """identity.json is always written, even with placeholders."""
+        with patch(
+            "skcapstone.pillars.identity._try_init_capauth", return_value=None
+        ):
+            generate_identity(tmp_agent_home, "writer-test")
+
+        assert (tmp_agent_home / "identity" / "identity.json").exists()
+        data = json.loads(
+            (tmp_agent_home / "identity" / "identity.json").read_text()
+        )
+        assert data["name"] == "writer-test"
+        assert data["capauth_managed"] is False
+
+    def test_placeholder_deterministic(self):
+        """Placeholder fingerprints are deterministic for the same name."""
+        fp1 = _generate_placeholder_fingerprint("agent-x")
+        fp2 = _generate_placeholder_fingerprint("agent-x")
+        fp3 = _generate_placeholder_fingerprint("agent-y")
+        assert fp1 == fp2
+        assert fp1 != fp3
+
+
+# ---------------------------------------------------------------------------
+# _sync_identity_json
+# ---------------------------------------------------------------------------
+
+
+class TestSyncIdentityJson:
+    """Tests for the identity.json sync helper."""
+
+    def test_creates_file_if_missing(self, tmp_path: Path):
+        """Creates identity.json from scratch when it doesn't exist."""
+        identity_dir = tmp_path / "identity"
+        state = IdentityState(
+            fingerprint="X" * 40,
+            name="new-agent",
+            email="new@capauth.local",
+            status=PillarStatus.ACTIVE,
+        )
+        _sync_identity_json(identity_dir, state)
+
+        assert (identity_dir / "identity.json").exists()
+        data = json.loads((identity_dir / "identity.json").read_text())
+        assert data["fingerprint"] == "X" * 40
+        assert data["capauth_managed"] is True
+
+    def test_skips_write_when_unchanged(self, tmp_path: Path):
+        """Does not rewrite identity.json when fingerprint matches."""
+        identity_dir = tmp_path / "identity"
+        identity_dir.mkdir(parents=True)
+
+        existing = {
+            "name": "same",
+            "email": "same@capauth.local",
+            "fingerprint": "Y" * 40,
+            "capauth_managed": True,
+            "created_at": None,
+        }
+        path = identity_dir / "identity.json"
+        path.write_text(json.dumps(existing))
+        mtime_before = path.stat().st_mtime
+
+        state = IdentityState(
+            fingerprint="Y" * 40,
+            name="same",
+            email="same@capauth.local",
+            status=PillarStatus.ACTIVE,
+        )
+        _sync_identity_json(identity_dir, state)
+
+        assert path.stat().st_mtime == mtime_before
+
+    def test_updates_when_fingerprint_changes(self, tmp_path: Path):
+        """Rewrites identity.json when the fingerprint is different."""
+        identity_dir = tmp_path / "identity"
+        identity_dir.mkdir(parents=True)
+
+        old = {"fingerprint": "OLD" + "0" * 37, "capauth_managed": False}
+        (identity_dir / "identity.json").write_text(json.dumps(old))
+
+        state = IdentityState(
+            fingerprint="NEW" + "1" * 37,
+            name="upgraded",
+            status=PillarStatus.ACTIVE,
+        )
+        _sync_identity_json(identity_dir, state)
+
+        data = json.loads((identity_dir / "identity.json").read_text())
+        assert data["fingerprint"] == "NEW" + "1" * 37
+        assert data["capauth_managed"] is True

package/tests/test_identity_pillar.py

@@ -0,0 +1,117 @@
+"""Unit tests for the identity pillar module."""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+from unittest.mock import MagicMock, patch
+
+import pytest
+
+from skcapstone.models import PillarStatus
+from skcapstone.pillars.identity import (
+    _generate_placeholder_fingerprint,
+    generate_identity,
+)
+
+
+class TestGenerateIdentity:
+    """Tests for generate_identity()."""
+
+    def test_creates_identity_directory(self, tmp_agent_home: Path):
+        generate_identity(tmp_agent_home, "test-agent")
+        assert (tmp_agent_home / "identity").is_dir()
+
+    def test_writes_identity_json(self, tmp_agent_home: Path):
+        generate_identity(tmp_agent_home, "test-agent")
+        assert (tmp_agent_home / "identity" / "identity.json").exists()
+
+    def test_state_name_matches(self, tmp_agent_home: Path):
+        state = generate_identity(tmp_agent_home, "my-agent")
+        assert state.name == "my-agent"
+
+    def test_explicit_email_used(self, tmp_agent_home: Path):
+        state = generate_identity(tmp_agent_home, "opus", email="opus@skworld.io")
+        assert state.email == "opus@skworld.io"
+
+    def test_email_auto_generated_from_name(self, tmp_agent_home: Path):
+        state = generate_identity(tmp_agent_home, "My Agent")
+        assert state.email == "my-agent@skcapstone.local"
+
+    def test_fingerprint_always_set(self, tmp_agent_home: Path):
+        state = generate_identity(tmp_agent_home, "test")
+        assert state.fingerprint is not None
+        assert len(state.fingerprint) == 40
+
+    def test_identity_json_has_required_fields(self, tmp_agent_home: Path):
+        generate_identity(tmp_agent_home, "agent-x")
+        data = json.loads(
+            (tmp_agent_home / "identity" / "identity.json").read_text()
+        )
+        for field in ("name", "email", "fingerprint", "created_at"):
+            assert field in data, f"missing field: {field}"
+
+    def test_identity_json_name_matches(self, tmp_agent_home: Path):
+        generate_identity(tmp_agent_home, "lumina")
+        data = json.loads(
+            (tmp_agent_home / "identity" / "identity.json").read_text()
+        )
+        assert data["name"] == "lumina"
+
+    def test_idempotent_second_call_succeeds(self, tmp_agent_home: Path):
+        generate_identity(tmp_agent_home, "agent-a")
+        state2 = generate_identity(tmp_agent_home, "agent-a")
+        assert state2.name == "agent-a"
+
+    def test_degraded_status_without_capauth(self, tmp_agent_home: Path):
+        """Without capauth installed the status should be DEGRADED."""
+        with patch.dict("sys.modules", {"capauth": None, "capauth.profile": None, "capauth.keys": None}):
+            state = generate_identity(tmp_agent_home, "test-agent")
+        assert state.status == PillarStatus.DEGRADED
+
+    def test_capauth_managed_false_without_capauth(self, tmp_agent_home: Path):
+        with patch.dict("sys.modules", {"capauth": None, "capauth.profile": None, "capauth.keys": None}):
+            generate_identity(tmp_agent_home, "no-capauth")
+        data = json.loads(
+            (tmp_agent_home / "identity" / "identity.json").read_text()
+        )
+        assert data["capauth_managed"] is False
+
+    def test_active_status_with_capauth_profile(self, tmp_agent_home: Path):
+        """When capauth.profile.load_profile succeeds, status is ACTIVE."""
+        mock_profile = MagicMock()
+        mock_profile.key_info.fingerprint = "A" * 40
+        mock_profile.key_info.public_key_path = str(tmp_agent_home / "agent.pub")
+        mock_profile.entity.name = "opus"
+        mock_profile.entity.email = "opus@test"
+
+        mock_capauth_profile = MagicMock()
+        mock_capauth_profile.load_profile.return_value = mock_profile
+
+        with patch.dict("sys.modules", {"capauth": MagicMock(), "capauth.profile": mock_capauth_profile}):
+            state = generate_identity(tmp_agent_home, "opus")
+
+        assert state.status == PillarStatus.ACTIVE
+        assert state.fingerprint == "A" * 40
+
+
+class TestPlaceholderFingerprint:
+    """Tests for _generate_placeholder_fingerprint()."""
+
+    def test_length_is_40(self):
+        fp = _generate_placeholder_fingerprint("test-agent")
+        assert len(fp) == 40
+
+    def test_is_uppercase_hex(self):
+        fp = _generate_placeholder_fingerprint("agent")
+        assert all(c in "0123456789ABCDEF" for c in fp)
+
+    def test_deterministic(self):
+        fp1 = _generate_placeholder_fingerprint("opus")
+        fp2 = _generate_placeholder_fingerprint("opus")
+        assert fp1 == fp2
+
+    def test_different_names_different_fingerprints(self):
+        fp1 = _generate_placeholder_fingerprint("opus")
+        fp2 = _generate_placeholder_fingerprint("lumina")
+        assert fp1 != fp2

package/tests/test_install_wizard.py

@@ -0,0 +1,68 @@
+"""Tests for the install wizard — path selection, confirmation, routing."""
+
+from __future__ import annotations
+
+from pathlib import Path
+from unittest.mock import MagicMock, patch
+
+import pytest
+
+from skcapstone.install_wizard import (
+    PATH_LABELS,
+    _wait_for_sync,
+)
+
+
+class TestPathLabels:
+    """Tests for path label definitions."""
+
+    def test_all_three_paths_exist(self) -> None:
+        """All three install paths have labels."""
+        assert 1 in PATH_LABELS
+        assert 2 in PATH_LABELS
+        assert 3 in PATH_LABELS
+
+    def test_labels_are_human_readable(self) -> None:
+        """Labels contain no jargon."""
+        for label in PATH_LABELS.values():
+            assert len(label) > 10
+            assert "sovereign singularity" not in label.lower()
+
+
+class TestWaitForSync:
+    """Tests for _wait_for_sync helper."""
+
+    def test_returns_true_when_identity_exists(self, tmp_path: Path) -> None:
+        """Returns True immediately if identity.json exists."""
+        (tmp_path / "identity.json").write_text("{}")
+        assert _wait_for_sync(tmp_path, timeout_seconds=1) is True
+
+    def test_returns_true_when_registry_exists(self, tmp_path: Path) -> None:
+        """Returns True if vault-registry.json exists."""
+        (tmp_path / "vault-registry.json").write_text("{}")
+        assert _wait_for_sync(tmp_path, timeout_seconds=1) is True
+
+    def test_returns_true_when_auth_key_exists(self, tmp_path: Path) -> None:
+        """Returns True if tailscale.key.gpg exists."""
+        (tmp_path / "tailscale.key.gpg").write_bytes(b"encrypted")
+        assert _wait_for_sync(tmp_path, timeout_seconds=1) is True
+
+    def test_returns_false_when_empty(self, tmp_path: Path) -> None:
+        """Returns False after timeout when no files exist."""
+        assert _wait_for_sync(tmp_path, timeout_seconds=1) is False
+
+
+class TestPathUpdateExisting:
+    """Tests for path 3 — update existing node."""
+
+    def test_exits_if_no_home(self, tmp_path: Path) -> None:
+        """Path 3 exits if agent home doesn't exist."""
+        from skcapstone.install_wizard import _path_update_existing
+
+        fake_home = str(tmp_path / "nonexistent")
+        with pytest.raises(SystemExit):
+            _path_update_existing(
+                home=fake_home,
+                skip_deps=True,
+                skip_ritual=True,
+            )