create-workframe 0.1.0

package/workframe-api/tests/test_credential_resolution.py

@@ -0,0 +1,206 @@
+import tempfile
+import unittest
+from pathlib import Path
+from unittest.mock import patch
+
+import server
+from db_setup import ensure_workframe_schemas
+
+
+class CredentialResolutionTests(unittest.TestCase):
+    def setUp(self) -> None:
+        self._tmp = tempfile.TemporaryDirectory()
+        self.addCleanup(self._tmp.cleanup)
+        self._old_data_dir = server.DATA_DIR
+        self._old_auth_db_path = server.AUTH_DB_PATH
+        server.DATA_DIR = Path(self._tmp.name)
+        server.AUTH_DB_PATH = Path(self._tmp.name) / "auth.db"
+        ensure_workframe_schemas()
+
+    def tearDown(self) -> None:
+        server.DATA_DIR = self._old_data_dir
+        server.AUTH_DB_PATH = self._old_auth_db_path
+
+    def _seed(self, *rows: tuple[object, ...]) -> None:
+        conn = server._workframe_db()
+        try:
+            conn.executemany(
+                """
+                INSERT INTO credential_bindings (
+                    id, workspace_id, user_id, agent_profile_id, provider,
+                    credential_type, credential_ref, label, is_active,
+                    expires_at, created_by, created_at, updated_at, deleted_at
+                ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+                """,
+                rows,
+            )
+            conn.commit()
+        finally:
+            conn.close()
+
+    def test_resolves_user_credential_before_workspace_credential(self) -> None:
+        self._seed(
+            (
+                "user-openai", None, "user-a", None, "openai",
+                "api_key", "user-ref", "User OpenAI", 1, None, "user-a",
+                "1", "1", None,
+            ),
+            (
+                "workspace-openai", "workspace-a", None, None, "openai",
+                "api_key", "workspace-ref", "Workspace OpenAI", 1, None, "user-a",
+                "1", "1", None,
+            ),
+        )
+
+        resolved = server._resolve_credential("user-a", "workspace-a", "openai")
+
+        self.assertEqual(resolved["credential_binding_id"], "user-openai")
+        self.assertEqual(resolved["scope"], "user")
+        self.assertEqual(resolved["credential_ref"], "user-ref")
+
+    def test_falls_back_to_workspace_when_user_has_no_matching_credential(self) -> None:
+        self._seed(
+            (
+                "workspace-openai", "workspace-a", None, None, "openai",
+                "api_key", "workspace-ref", "Workspace OpenAI", 1, None, "user-a",
+                "1", "1", None,
+            ),
+        )
+
+        resolved = server._resolve_credential("user-b", "workspace-a", "openai")
+
+        self.assertEqual(resolved["credential_binding_id"], "workspace-openai")
+        self.assertEqual(resolved["scope"], "workspace")
+        self.assertEqual(resolved["credential_ref"], "workspace-ref")
+
+    def test_user_only_denies_workspace_fallback_for_dev_providers(self) -> None:
+        self._seed(
+            (
+                "workspace-github", "workspace-a", None, None, "github",
+                "api_key", "env:GITHUB_TOKEN", "Workspace GitHub", 1, None, "user-a",
+                "1", "1", None,
+            ),
+        )
+
+        resolved = server._resolve_credential("user-b", "workspace-a", "github", user_only=True)
+
+        self.assertIsNone(resolved)
+
+    def test_resolves_user_env_without_db_binding(self) -> None:
+        old_hermes = server.HERMES_DATA
+        server.HERMES_DATA = Path(self._tmp.name) / "agents"
+        try:
+            user_id = "user-env-only"
+            user_home = server._user_hermes_home(user_id)
+            user_home.mkdir(parents=True, exist_ok=True)
+            server._upsert_env_secret(server._user_hermes_env_path(user_id), "OPENAI_API_KEY", "sk-user-env")
+
+            resolved = server._resolve_credential(user_id, "workspace-a", "openai")
+
+            self.assertIsNotNone(resolved)
+            assert resolved is not None
+            self.assertEqual(resolved["scope"], "user")
+            self.assertEqual(resolved["credential_ref"], "env:OPENAI_API_KEY")
+        finally:
+            server.HERMES_DATA = old_hermes
+
+    def test_ignores_inactive_and_deleted_credentials(self) -> None:
+        self._seed(
+            (
+                "inactive-user-openai", None, "user-a", None, "openai",
+                "api_key", "inactive-ref", "Inactive User OpenAI", 0, None, "user-a",
+                "1", "1", None,
+            ),
+            (
+                "deleted-workspace-openai", "workspace-a", None, None, "openai",
+                "api_key", "deleted-ref", "Deleted Workspace OpenAI", 1, None, "user-a",
+                "1", "1", "1",
+            ),
+        )
+
+        resolved = server._resolve_credential("user-a", "workspace-a", "openai")
+
+        self.assertIsNone(resolved)
+
+    def test_byok_blocks_workspace_llm_fallback(self) -> None:
+        conn = server._workframe_db()
+        try:
+            conn.execute(
+                """
+                INSERT INTO workspaces (
+                    id, slug, display_name, owner_id, status, settings_json, created_at, updated_at
+                ) VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+                """,
+                (
+                    "workspace-byok",
+                    "byok",
+                    "BYOK",
+                    "user-a",
+                    "active",
+                    '{"credential_mode":"byok"}',
+                    "1",
+                    "1",
+                ),
+            )
+            conn.commit()
+        finally:
+            conn.close()
+        self._seed(
+            (
+                "workspace-or", "workspace-byok", None, None, "openrouter",
+                "api_key", "env:OPENROUTER_API_KEY", "Workspace OR", 1, None, "user-a",
+                "1", "1", None,
+            ),
+        )
+        profile_dir = server._profile_dir("workframe-agent")
+        profile_dir.mkdir(parents=True, exist_ok=True)
+        server._upsert_env_secret(profile_dir / ".env", "OPENROUTER_API_KEY", "sk-workspace")
+
+        with self.assertRaises(ValueError) as ctx:
+            server._require_runtime_owner_provider("user-b", "workspace-byok", "openrouter")
+
+        self.assertIn("no_llm_provider_for_user", str(ctx.exception))
+
+    @patch.object(server, "_primary_profile", return_value="workframe-agent")
+    def test_workspace_mode_allows_llm_fallback(self, _primary) -> None:
+        conn = server._workframe_db()
+        try:
+            conn.execute(
+                """
+                INSERT INTO workspaces (
+                    id, slug, display_name, owner_id, status, settings_json, created_at, updated_at
+                ) VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+                """,
+                (
+                    "workspace-pays",
+                    "pays",
+                    "Company pays",
+                    "user-a",
+                    "active",
+                    '{"credential_mode":"workspace"}',
+                    "1",
+                    "1",
+                ),
+            )
+            conn.commit()
+        finally:
+            conn.close()
+        self._seed(
+            (
+                "workspace-or-pays", "workspace-pays", None, None, "openrouter",
+                "api_key", "env:OPENROUTER_API_KEY", "Workspace OR", 1, None, "user-a",
+                "1", "1", None,
+            ),
+        )
+        profile_dir = server._profile_dir("workframe-agent")
+        profile_dir.mkdir(parents=True, exist_ok=True)
+        server._upsert_env_secret(profile_dir / ".env", "OPENROUTER_API_KEY", "sk-workspace")
+
+        resolved = server._require_runtime_owner_provider("user-b", "workspace-pays", "openrouter")
+
+        self.assertEqual(resolved["scope"], "workspace")
+        self.assertEqual(resolved["credential_ref"], "env:OPENROUTER_API_KEY")
+
+
+if __name__ == "__main__":
+    unittest.main()

package/workframe-api/tests/test_device_oauth.py

@@ -0,0 +1,108 @@
+from __future__ import annotations
+
+import importlib.util
+import json
+from pathlib import Path
+
+import pytest
+
+SERVER_PATH = Path(__file__).resolve().parents[1] / "server.py"
+spec = importlib.util.spec_from_file_location("workframe_server", SERVER_PATH)
+server = importlib.util.module_from_spec(spec)
+assert spec.loader is not None
+spec.loader.exec_module(server)
+
+
+@pytest.fixture()
+def user_env(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> str:
+    monkeypatch.setattr(server, "HERMES_DATA", tmp_path)
+    user_id = "user-oauth-1"
+    return user_id
+
+
+def test_parse_device_oauth_log_extracts_uri_and_code() -> None:
+    sample = (
+        "To continue, follow these steps:\n\n"
+        "  1. Open this URL in your browser:\n"
+        "     \x1b[94mhttps://auth.openai.com/codex/device\x1b[0m\n\n"
+        "  2. Enter this code:\n"
+        "     \x1b[94mABCD-1234\x1b[0m\n\n"
+        "Waiting for sign-in...\n"
+    )
+    parsed = server._parse_device_oauth_log(sample)
+    assert parsed["verification_uri"] == "https://auth.openai.com/codex/device"
+    assert parsed["user_code"] == "ABCD-1234"
+
+
+def test_hermes_oauth_tokens_present_reads_providers_block(user_env: str) -> None:
+    auth_path = server._user_hermes_auth_path(user_env)
+    auth_path.parent.mkdir(parents=True, exist_ok=True)
+    auth_path.write_text(
+        json.dumps(
+            {
+                "providers": {
+                    "openai-codex": {
+                        "tokens": {"access_token": "tok", "refresh_token": "ref"},
+                    }
+                }
+            }
+        ),
+        encoding="utf-8",
+    )
+    assert server._hermes_oauth_tokens_present(user_env, "openai-codex") is True
+
+
+def test_list_user_providers_marks_codex_connected_from_auth_json(user_env: str) -> None:
+    auth_path = server._user_hermes_auth_path(user_env)
+    auth_path.parent.mkdir(parents=True, exist_ok=True)
+    auth_path.write_text(
+        json.dumps(
+            {
+                "providers": {
+                    "openai-codex": {
+                        "tokens": {"access_token": "tok"},
+                    }
+                }
+            }
+        ),
+        encoding="utf-8",
+    )
+    payload = server.list_user_providers(user_env)
+    codex = next(row for row in payload["providers"] if row["id"] == "codex")
+    assert codex["connected"] is True
+
+
+def test_load_user_hermes_auth_reads_gateway_fallback(user_env: str, monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr(server, "_read_gateway_data_file", lambda rel: json.dumps({
+        "providers": {"openai-codex": {"tokens": {"access_token": "tok"}}},
+    }))
+    loaded = server._load_user_hermes_auth(user_env)
+    assert isinstance(loaded, dict)
+    assert server._hermes_oauth_tokens_present(user_env, "openai-codex") is True
+
+
+def test_spawn_hermes_device_oauth_uses_detached_exec(user_env: str, monkeypatch: pytest.MonkeyPatch) -> None:
+    calls: list[list[str]] = []
+
+    def fake_detached(cmd: list[str]) -> tuple[int, str]:
+        calls.append(cmd)
+        return 0, ""
+
+    monkeypatch.setattr(server, "_gateway_container_exec_detached", fake_detached)
+    rc, _ = server._spawn_hermes_device_oauth(user_env, "openai-codex", "/opt/data/profiles/x/.oauth.log")
+    assert rc == 0
+    assert calls
+    joined = " ".join(calls[0])
+    assert "auth add openai-codex" in joined
+    assert "su -s /bin/sh hermes" in joined
+
+
+def test_list_user_providers_marks_deepseek_connected_from_env(user_env: str) -> None:
+    env_path = server._user_hermes_env_path(user_env)
+    env_path.parent.mkdir(parents=True, exist_ok=True)
+    env_path.write_text("DEEPSEEK_API_KEY=sk-deep\n", encoding="utf-8")
+
+    payload = server.list_user_providers(user_env)
+    deepseek = next(row for row in payload["providers"] if row["id"] == "deepseek")
+
+    assert deepseek["connected"] is True

package/workframe-api/tests/test_doctor_repair.py

@@ -0,0 +1,103 @@
+"""Explicit doctor repair — opt-in runtime provisioning for agent DM rooms."""
+import os
+import tempfile
+import unittest
+from pathlib import Path
+from unittest import mock
+
+import server
+from db_setup import ensure_workframe_schemas
+
+
+class DoctorRepairTests(unittest.TestCase):
+    def setUp(self) -> None:
+        self.tmp = tempfile.TemporaryDirectory()
+        self.addCleanup(self.tmp.cleanup)
+        data = Path(self.tmp.name) / "data"
+        data.mkdir()
+        self.patches = [
+            mock.patch.object(server, "DATA_DIR", data),
+            mock.patch.object(server, "AUTH_DB_PATH", data / "auth.db"),
+            mock.patch.object(server, "_workframe_db_path", return_value=data / "workframe.db"),
+            mock.patch.dict(os.environ, {"WORKFRAME_PROJECT": "Workframe"}, clear=False),
+        ]
+        for patch in self.patches:
+            patch.start()
+            self.addCleanup(patch.stop)
+        ensure_workframe_schemas()
+        self.workspace_id = "ws-1"
+        self.user_id = "user-1"
+        self.agent_id = "a0000000-0000-4000-8000-000000000001"
+        self.agent_slug = "workframe-agent"
+        self.room_id = "room-1"
+        conn = server._workframe_db()
+        try:
+            now = "1"
+            conn.execute(
+                "INSERT INTO workspaces (id, slug, display_name, owner_id, status, created_at, updated_at) VALUES (?,?,?,?,?,?,?)",
+                (self.workspace_id, "default", "Workframe", self.user_id, "active", now, now),
+            )
+            conn.execute(
+                """
+                INSERT INTO agent_profiles (id, workspace_id, slug, display_name, status, created_at, updated_at)
+                VALUES (?, ?, ?, ?, 'available', ?, ?)
+                """,
+                (self.agent_id, self.workspace_id, self.agent_slug, "Agent", now, now),
+            )
+            conn.execute(
+                """
+                INSERT INTO rooms (
+                    id, workspace_id, agent_profile_id, name, slug, room_type, status, created_at, updated_at
+                ) VALUES (?, ?, ?, 'Agent', 'dm-agent', 'direct', 'active', ?, ?)
+                """,
+                (self.room_id, self.workspace_id, self.agent_id, now, now),
+            )
+            conn.execute(
+                """
+                INSERT INTO room_memberships (id, room_id, user_id, role, status, joined_at, updated_at)
+                VALUES ('rm-1', ?, ?, 'member', 'active', ?, ?)
+                """,
+                (self.room_id, self.user_id, now, now),
+            )
+            conn.commit()
+        finally:
+            conn.close()
+
+    @mock.patch.object(server, "_runtime_profile_on_disk", return_value=False)
+    def test_audit_reports_missing(self, _on_disk) -> None:
+        out = server.doctor_audit_agent_dm_runtimes()
+        self.assertTrue(out["ok"])
+        self.assertEqual(out["total"], 1)
+        self.assertEqual(out["present"], 0)
+        self.assertEqual(len(out["missing"]), 1)
+        self.assertEqual(out["missing"][0]["runtime"], "u-user-1-workframe-agent")
+
+    def test_resolved_session_title_falls_back_to_room_sessions(self) -> None:
+        with mock.patch.object(server, "_session_info", return_value={"title": ""}):
+            title = server._resolved_session_title(
+                "u-user-1-workframe-agent",
+                "sid-1",
+                "Session with Workframe Agent (9)",
+            )
+        self.assertEqual(title, "Session with Workframe Agent (9)")
+
+    @mock.patch.object(server, "_runtime_profile_on_disk")
+    @mock.patch.object(server, "ensure_runtime_profile")
+    def test_repair_provisions_missing(self, ensure_runtime, on_disk) -> None:
+        on_disk.side_effect = [False, True, True]
+
+        out = server.doctor_repair_agent_dm_runtimes(repair=True)
+
+        self.assertTrue(out["ok"])
+        self.assertEqual(out["missing_before"], 1)
+        self.assertEqual(len(out["repaired"]), 1)
+        ensure_runtime.assert_called_once_with(
+            "u-user-1-workframe-agent",
+            self.agent_slug,
+            self.user_id,
+            self.workspace_id,
+        )
+
+
+if __name__ == "__main__":
+    unittest.main()

package/workframe-api/tests/test_ensure_profile_api.py

@@ -0,0 +1,77 @@
+import importlib.util
+import unittest
+from pathlib import Path
+from unittest.mock import patch
+
+ROOT = Path(__file__).resolve().parents[2]
+API = ROOT / "workframe-api" / "server.py"
+
+
+def _load_api():
+    spec = importlib.util.spec_from_file_location("workframe_api", API)
+    mod = importlib.util.module_from_spec(spec)
+    assert spec and spec.loader
+    spec.loader.exec_module(mod)
+    return mod
+
+
+class EnsureProfileApiTest(unittest.TestCase):
+    def test_healthy_profile_skips_gateway_reload(self) -> None:
+        api = _load_api()
+        with patch.object(api, "resolve_validated_profile", return_value="architect"), patch.object(
+            api, "_primary_profile", return_value="workframe-agent"
+        ), patch.object(api, "_bootstrap_profile_providers") as bootstrap, patch.object(
+            api, "_profile_api_healthy", return_value=True
+        ), patch.object(api, "_gateway_exec") as gateway_exec:
+            out = api.ensure_profile_api("architect", "user-1", "ws-1")
+            bootstrap.assert_not_called()
+            gateway_exec.assert_not_called()
+            self.assertFalse(out.get("started"))
+
+    def test_cold_start_waits_for_health(self) -> None:
+        api = _load_api()
+        with patch.object(api, "resolve_validated_profile", return_value="architect"), patch.object(
+            api, "_primary_profile", return_value="workframe-agent"
+        ), patch.object(api, "_bootstrap_profile_providers", return_value=False), patch.object(
+            api, "_profile_api_healthy", side_effect=[False, False, True]
+        ), patch.object(
+            api, "profile_gateway_lifecycle", return_value={"ok": True, "action": "start"}
+        ) as start, patch.object(api, "_wait_profile_api_healthy", return_value=True) as wait:
+            out = api.ensure_profile_api("architect", "user-1", "ws-1")
+            start.assert_called_once_with("architect", "start", bootstrap_providers=True)
+            wait.assert_called_once()
+            self.assertTrue(out.get("started"))
+
+    def test_cold_start_skips_bootstrap_when_already_seeded(self) -> None:
+        api = _load_api()
+        with patch.object(api, "resolve_validated_profile", return_value="architect"), patch.object(
+            api, "_primary_profile", return_value="workframe-agent"
+        ), patch.object(api, "_bootstrap_profile_providers") as bootstrap, patch.object(
+            api, "_profile_api_healthy", side_effect=[False, False, True]
+        ), patch.object(
+            api, "profile_gateway_lifecycle", return_value={"ok": True, "action": "start"}
+        ) as start, patch.object(api, "_wait_profile_api_healthy", return_value=True):
+            api.ensure_profile_api("architect", "user-1", "ws-1", bootstrap_providers=False)
+            bootstrap.assert_not_called()
+            start.assert_called_once_with("architect", "start", bootstrap_providers=False)
+
+    def test_primary_cold_start_configures_and_restarts_gateway(self) -> None:
+        api = _load_api()
+        with patch.object(api, "resolve_hermes_profile", return_value="workframe-agent"), patch.object(
+            api, "_primary_profile", return_value="workframe-agent"
+        ), patch.object(api, "_profile_api_port", return_value=8642), patch.object(
+            api, "_profile_api_healthy", return_value=False
+        ), patch.object(
+            api, "_configure_profile_api", return_value=(True, "ok", 8642)
+        ) as configure, patch.object(api, "_restart_stack_gateway", return_value={"ok": True}) as restart, patch.object(
+            api, "_wait_profile_api_healthy", return_value=True
+        ) as wait:
+            out = api.ensure_profile_api("workframe-agent", "user-1", "ws-1")
+            configure.assert_called_once_with("workframe-agent")
+            restart.assert_called_once()
+            wait.assert_called_once_with("workframe-agent")
+            self.assertTrue(out.get("started"))
+
+
+if __name__ == "__main__":
+    unittest.main()

package/workframe-api/tests/test_gateway_compose_security.py

@@ -0,0 +1,136 @@
+"""Compose and deployment-mode guards for gateway control-plane isolation."""
+
+from __future__ import annotations
+
+import re
+import unittest
+from pathlib import Path
+
+
+COMPOSE_PATH = (
+    Path(__file__).resolve().parents[3] / "infra" / "compose" / "workframe" / "docker-compose.yml"
+)
+PUBLIC_COMPOSE_PATH = COMPOSE_PATH.parent / "docker-compose.public.yml"
+
+# ponytail: substring match — catches ZK_AUTH_HMAC_KEY, WORKFRAME_SUPERVISOR_TOKEN, etc.
+FORBIDDEN_GATEWAY_ENV_MARKERS = (
+    "WORKFRAME_SUPERVISOR_TOKEN",
+    "WORKFRAME_API_TOKEN",
+    "ZK_AUTH_",
+    "SMTP_PASS",
+    "WORKFRAME_GITHUB_OAUTH_CLIENT_SECRET",
+)
+
+
+def _service_block(compose_text: str, service: str) -> str:
+    match = re.search(rf"^  {re.escape(service)}:\n", compose_text, re.MULTILINE)
+    if not match:
+        raise AssertionError(f"service {service!r} not found in compose")
+    start = match.start()
+    tail = compose_text[start + 1 :]
+    next_svc = re.search(r"^  [a-z0-9-]+:\n", tail, re.MULTILINE)
+    end = start + 1 + (next_svc.start() if next_svc else len(tail))
+    return compose_text[start:end]
+
+
+class GatewayComposeSecurityTests(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls) -> None:
+        cls.compose_text = COMPOSE_PATH.read_text(encoding="utf-8")
+        cls.gateway_block = _service_block(cls.compose_text, "gateway")
+        cls.api_block = _service_block(cls.compose_text, "workframe-api")
+        cls.supervisor_block = _service_block(cls.compose_text, "workframe-supervisor")
+
+    def test_gateway_has_no_env_file(self) -> None:
+        self.assertNotIn("env_file:", self.gateway_block)
+
+    def test_gateway_not_on_control_net(self) -> None:
+        self.assertIn("workframe-net", self.gateway_block)
+        self.assertNotIn("control-net", self.gateway_block)
+
+    def test_supervisor_only_on_control_net(self) -> None:
+        self.assertIn("control-net", self.supervisor_block)
+        self.assertNotIn("workframe-net", self.supervisor_block)
+
+    def test_api_on_both_networks(self) -> None:
+        self.assertIn("workframe-net", self.api_block)
+        self.assertIn("control-net", self.api_block)
+
+    def test_gateway_environment_has_no_control_secrets(self) -> None:
+        env_section = re.search(r"environment:\n((?:      - .+\n)+)", self.gateway_block)
+        self.assertIsNotNone(env_section, "gateway environment block missing")
+        env_lines = env_section.group(1) if env_section else ""
+        for marker in FORBIDDEN_GATEWAY_ENV_MARKERS:
+            self.assertNotIn(marker, env_lines, f"gateway env must not reference {marker}")
+
+    def test_gateway_mounts_proxy_token_volume_not_api_data(self) -> None:
+        self.assertIn("workframe-proxy-token:/run/workframe-proxy", self.gateway_block)
+        self.assertNotIn("workframe-api-data", self.gateway_block)
+
+    def test_public_overlay_api_has_no_docker_sock(self) -> None:
+        public_text = PUBLIC_COMPOSE_PATH.read_text(encoding="utf-8")
+        api_block = _service_block(public_text, "workframe-api")
+        self.assertNotIn("/var/run/docker.sock", api_block)
+        self.assertNotIn(":/project", api_block)
+
+
+class HermesDashboardGateTests(unittest.TestCase):
+    def test_public_mode_denies_member(self) -> None:
+        import server
+        from unittest.mock import patch
+
+        handler = type("H", (), {"auth_user": "u1", "auth_role": "member"})()
+        with patch.object(server, "DEPLOYMENT_MODE", "public_multi_user"), patch.object(
+            server, "DEV_LOCAL_UNSAFE", False
+        ):
+            self.assertEqual(server._hermes_dashboard_gate_status(handler), 403)
+
+    def test_public_mode_allows_admin(self) -> None:
+        import server
+        from unittest.mock import patch
+
+        handler = type("H", (), {"auth_user": "u1", "auth_role": "admin"})()
+        with patch.object(server, "DEPLOYMENT_MODE", "public_multi_user"), patch.object(
+            server, "DEV_LOCAL_UNSAFE", False
+        ):
+            self.assertEqual(server._hermes_dashboard_gate_status(handler), 204)
+
+    def test_single_user_local_allows_anonymous(self) -> None:
+        import server
+        from unittest.mock import patch
+
+        handler = type("H", (), {"auth_user": "", "auth_role": ""})()
+        with patch.object(server, "DEPLOYMENT_MODE", "single_user_local"):
+            self.assertEqual(server._hermes_dashboard_gate_status(handler), 204)
+
+
+class PublicDeploymentValidationTests(unittest.TestCase):
+    def test_public_mode_requires_https_and_smtp(self) -> None:
+        import server
+        from unittest.mock import patch
+
+        with patch.object(server, "DEPLOYMENT_MODE", "public_multi_user"), patch.object(
+            server, "DEV_LOCAL_UNSAFE", False
+        ), patch.object(server, "SECURE_MODE", True), patch.object(
+            server, "_supervisor_ready", return_value=True
+        ), patch.object(server, "_install_window_open", return_value=False), patch.object(
+            server, "APP_BASE_URL", "http://insecure.example"
+        ), patch.dict(
+            "os.environ",
+            {
+                "ZK_AUTH_HMAC_KEY": "a",
+                "ZK_AUTH_ENCRYPTION_KEY": "b",
+                "ZK_AUTH_SESSION_SECRET": "c",
+                "WORKFRAME_API_TOKEN": "d",
+                "SMTP_HOST": "",
+            },
+            clear=False,
+        ):
+            errors = server._deployment_security_errors()
+        self.assertTrue(any("APP_BASE_URL" in e for e in errors))
+        self.assertTrue(any("SMTP_HOST" in e for e in errors))
+        self.assertTrue(any("WORKFRAME_PROXY_TOKEN" in e for e in errors))
+
+
+if __name__ == "__main__":
+    unittest.main()

package/workframe-api/tests/test_install_secure_host.py

@@ -0,0 +1,39 @@
+"""Install-window host/origin gate — setup must not require ALLOWED_HOSTS to match yet."""
+
+from __future__ import annotations
+
+import unittest
+from unittest import mock
+
+import server
+
+
+class InstallSecureHostTests(unittest.TestCase):
+    def setUp(self) -> None:
+        self._old_hosts = server.ALLOWED_HOSTS
+        self._old_dev = server.DEV_LOCAL_UNSAFE
+        server.DEV_LOCAL_UNSAFE = False
+        server.ALLOWED_HOSTS = ["dev.example.com"]
+
+    def tearDown(self) -> None:
+        server.ALLOWED_HOSTS = self._old_hosts
+        server.DEV_LOCAL_UNSAFE = self._old_dev
+
+    def test_allowed_hosts_unions_loopback_when_configured(self) -> None:
+        hosts = server._allowed_hosts()
+        self.assertIn("dev.example.com", hosts)
+        self.assertIn("127.0.0.1", hosts)
+
+    def test_install_stack_patch_ok_during_install_window_via_tunnel(self) -> None:
+        headers = {"Host": "127.0.0.1:28644", "Origin": "http://127.0.0.1:28644"}
+        with mock.patch.object(server, "_install_window_open", return_value=True):
+            self.assertTrue(server._secure_host_origin_ok("PATCH", "/api/install/stack", headers))
+
+    def test_install_stack_patch_denied_after_install_window(self) -> None:
+        headers = {"Host": "evil.test", "Origin": "http://evil.test"}
+        with mock.patch.object(server, "_install_window_open", return_value=False):
+            self.assertFalse(server._secure_host_origin_ok("PATCH", "/api/install/stack", headers))
+
+
+if __name__ == "__main__":
+    unittest.main()