import ast import hashlib import re import unittest from pathlib import Path import provenance from i2i_contract import CONTENT_MODERATION_ENABLED, PUBLIC_ERROR_MESSAGES ROOT = Path(__file__).resolve().parents[1] class SpaceStaticTests(unittest.TestCase): def test_remote_assets_are_pinned_and_candidate_count_is_stable(self): provenance.assert_pinned_provenance() self.assertEqual(len(provenance.CANDIDATE_ADAPTER_SPECS), 19) self.assertEqual(set(provenance.ENABLED_ADAPTER_SPECS), set(provenance.CANDIDATE_ADAPTER_SPECS)) for spec in provenance.CANDIDATE_ADAPTER_SPECS.values(): self.assertRegex(spec.revision, r"^[0-9a-f]{40}$") self.assertNotEqual(spec.revision, "main") def test_content_moderation_is_explicitly_disabled(self): self.assertIs(CONTENT_MODERATION_ENABLED, False) app_source = (ROOT / "app.py").read_text(encoding="utf-8") self.assertIn("content_moderation_enabled", app_source) forbidden = ["safety_checker", "nsfw_classifier", "prompt_blocklist"] for marker in forbidden: self.assertNotIn(marker, app_source.lower()) def test_public_error_codes_are_exact_and_low_cardinality(self): self.assertEqual( set(PUBLIC_ERROR_MESSAGES), { "I2I_BAD_REQUEST", "I2I_UNSUPPORTED_TYPE", "I2I_FILE_TOO_LARGE", "I2I_IMAGE_DECODE_FAILED", "I2I_IMAGE_DIMENSIONS_INVALID", "I2I_PROMPT_REQUIRED", "I2I_PROMPT_TOO_LONG", "I2I_LORA_NOT_ALLOWED", "I2I_PROVIDER_BUSY", "I2I_INFERENCE_FAILED", "I2I_INVALID_OUTPUT", }, ) source = (ROOT / "app.py").read_text(encoding="utf-8") self.assertIn("return message in {", source) self.assertNotIn('message.startswith(f"{code}:")', source) def test_edit_endpoint_has_seven_fields_and_serial_concurrency(self): tree = ast.parse((ROOT / "app.py").read_text(encoding="utf-8")) function = next(node for node in tree.body if isinstance(node, ast.FunctionDef) and node.name == "edit_image") self.assertEqual( [argument.arg for argument in function.args.args], [ "images_b64_json", "prompt", "lora_adapter", "seed", "randomize_seed", "guidance_scale", "steps", ], ) decorator = ast.unparse(function.decorator_list[0]) self.assertIn("name='edit_image'", decorator) self.assertIn("concurrency_limit=1", decorator) self.assertIn("concurrency_id='i2i-pipeline'", decorator) def test_gpu_is_internal_and_mcp_and_raw_errors_are_disabled(self): source = (ROOT / "app.py").read_text(encoding="utf-8") self.assertIn('@spaces.GPU(size="xlarge")', source) self.assertNotIn("@app.mcp.tool", source) self.assertIn("show_error=False", source) self.assertIn("mcp_server=False", source) self.assertNotRegex(source, r"\{\s*(?:e|exc)\s*\}") self.assertNotIn("str(exc)", source) self.assertNotIn("traceback", source) self.assertIn("load_lora_weights", source) self.assertIn("revision=spec.revision", source) self.assertIn("set_adapters", source) self.assertIn("unload_lora_weights", source) self.assertIn("SingleResidentAdapterManager", source) def test_public_runtime_has_general_default_and_19_opt_in_loras(self): source = (ROOT / "app.py").read_text(encoding="utf-8") self.assertIn('"edit_mode": "general-and-lora"', source) self.assertIn('"uses_lora": True', source) self.assertIn('"supports_general_mode": True', source) self.assertIn('"default_edit_mode": BASE_EDIT_MODE_ID', source) self.assertIn("allowed_edit_modes={BASE_EDIT_MODE_ID, *ENABLED_ADAPTER_SPECS}", source) def test_homepage_is_a_hardened_full_feature_editor(self): html = (ROOT / "index.html").read_text(encoding="utf-8") script = (ROOT / "assets" / "app-ui.js").read_text(encoding="utf-8") self.assertIn('src="/hy3d-assets/app-ui.js"', html) self.assertIn('accept="image/png,image/jpeg,image/webp"', html) self.assertIn(" multiple", html) self.assertIn("Style / LoRA", html) self.assertIn('id="tab-examples"', html) self.assertIn('id="examples-scroll"', html) self.assertNotRegex(html, r'<(?:script|link)[^>]+(?:src|href)=["\']https?://') self.assertNotIn("googleapis", html.lower()) self.assertNotIn("jsdelivr", html.lower()) self.assertIn('const GENERAL_MODE_ID = "__base__"', script) self.assertIn('const EXPECTED_API_VERSION = "2026-08-12.3"', script) self.assertIn("images_b64_json: JSON.stringify(inputSnapshot)", script) self.assertIn("lora_adapter: editMode", script) self.assertIn('events: ["data", "status"]', script) self.assertIn("await currentJob.wait_for_id()", script) self.assertIn("await job.return()", script) self.assertIn("config.uses_lora !== true", script) self.assertIn("config.loras.length !== EXPECTED_LORA_IDS.length", script) self.assertIn("nextLimits.input_images !== 2", script) self.assertIn("nextLimits.min_input_images !== 1", script) self.assertIn("nextLimits.max_input_images !== 2", script) self.assertIn('client.predict("/load_example", { idx: index })', script) self.assertIn("Stopped waiting for this job. The backend may still finish it.", script) self.assertNotIn("Queued job cancelled", script) self.assertNotIn('hideLoader("Cancelled")', script) self.assertIn('"Anime-V2"', script) self.assertIn('"Photo-to-Anime"', script) self.assertIn('"General / No LoRA"', script) lora_block = re.search(r"const EXPECTED_LORA_IDS = Object\.freeze\(\[(.*?)\]\);", script, re.DOTALL) self.assertIsNotNone(lora_block) ui_loras = re.findall(r'^\s*"([^"]+)",?$', lora_block.group(1), re.MULTILINE) self.assertEqual(ui_loras, list(provenance.CANDIDATE_ADAPTER_SPECS)) suggestion_block = re.search(r"const SUGGESTIONS = Object\.freeze\(\[(.*?)\]\);", script, re.DOTALL) self.assertIsNotNone(suggestion_block) self.assertEqual(len(re.findall(r'^\s*\["', suggestion_block.group(1), re.MULTILINE)), 16) suggestion_handler = re.search(r"SUGGESTIONS\.forEach\(.*?\n\}\);", script, re.DOTALL) self.assertIsNotNone(suggestion_handler) self.assertNotIn("loraSelect", suggestion_handler.group(0)) self.assertIn('["Upscale / Enhance", "Enhance clarity and fine detail while preserving the original composition."]', script) self.assertNotIn("Upscale 4K", script) self.assertNotIn("4K resolution", script) self.assertNotIn("card.innerHTML", script) self.assertIn("card.append(thumbnails, meta, promptText)", script) self.assertIn('class="dot pending"', html) self.assertIn("4 STEPS DEFAULT", html) self.assertNotIn(".gh-btn", html) self.assertIn(".site-btn{padding:6px 10px}", html) self.assertLess(html.index('class="inspector"'), html.index('class="workspace"')) self.assertIn('id="sb-status" role="status" aria-live="polite"', html) self.assertIn('toast.setAttribute("aria-live"', script) self.assertIn("studio.inert = true", script) self.assertIn("function isLightboxOpen()", script) self.assertGreaterEqual(script.count("if (isLightboxOpen()) return;"), 3) input_strip = re.search(r"function renderInputStrip\(\) \{(.*?)\n\}", script, re.DOTALL) self.assertIsNotNone(input_strip) self.assertIn('const select = document.createElement("button")', input_strip.group(1)) self.assertIn('select.type = "button"', input_strip.group(1)) self.assertIn('select.className = "fs-thumb-select"', input_strip.group(1)) self.assertIn('select.setAttribute("aria-label", `Select input image ${index + 1}`)', input_strip.group(1)) self.assertIn('select.setAttribute("aria-pressed", String(index === selectedImageIndex))', input_strip.group(1)) self.assertIn("select.append(image, badge)", input_strip.group(1)) self.assertIn("thumb.append(select, remove)", input_strip.group(1)) self.assertNotIn('thumb.addEventListener("click"', input_strip.group(1)) self.assertIn(".fs-thumb-select:focus-visible", html) def test_browser_client_is_exactly_vendored(self): client_path = ROOT / "assets" / "gradio-client-2.3.1.js" self.assertTrue(client_path.is_file()) digest = hashlib.sha256(client_path.read_bytes()).hexdigest() self.assertEqual(digest, "a3d50dc5f3590c5723695abcd85e2009c42a8af08bfc9fa47a7baecc1040c0be") def test_interactive_script_only_references_unique_existing_dom_ids(self): html = (ROOT / "index.html").read_text(encoding="utf-8") script = (ROOT / "assets" / "app-ui.js").read_text(encoding="utf-8") element_ids = re.findall(r'\bid=["\']([^"\']+)["\']', html) script_refs = set(re.findall(r'getElementById\(["\']([^"\']+)["\']\)', script)) script_created_ids = set(re.findall(r'\.id\s*=\s*["\']([^"\']+)["\']', script)) self.assertEqual(len(element_ids), len(set(element_ids))) self.assertEqual(script_refs - set(element_ids) - script_created_ids, set()) def test_ui_assets_and_homepage_are_no_store_and_allowlisted(self): source = (ROOT / "app.py").read_text(encoding="utf-8") self.assertIn('"Cache-Control": "no-store, max-age=0, must-revalidate"', source) self.assertIn('@app.get("/hy3d-assets/{asset_name}"', source) self.assertIn('{"app-ui.js", "gradio-client-2.3.1.js"}', source) def test_direct_python_dependencies_are_exact(self): requirements = (ROOT / "requirements.txt").read_text(encoding="utf-8").splitlines() packages = [line for line in requirements if line and not line.startswith("--")] self.assertTrue(packages) for package in packages: self.assertRegex(package, r"^[A-Za-z0-9_.-]+==[^=<>~]+$") self.assertEqual((ROOT / "pre-requirements.txt").read_text(encoding="utf-8").strip(), "pip==26.1.2") def test_examples_are_fixed_non_gpu_api_assets(self): source = (ROOT / "app.py").read_text(encoding="utf-8") self.assertIn('@app.api(name="load_example", queue=False)', source) self.assertIn("def load_example(idx: float) -> dict", source) self.assertIn("parse_example_index", source) self.assertIn("EXAMPLES_CONFIG", source) self.assertIn("blocked_paths=[examples_path]", source) def test_kernel_revision_is_pinned(self): source = (ROOT / "qwenimage" / "qwen_fa3_processor.py").read_text(encoding="utf-8") self.assertIn("from provenance import KERNEL_MODEL_REVISION", source) self.assertIn("revision=KERNEL_MODEL_REVISION", source) self.assertIsNone(re.search(r'get_kernel\([^)]*revision\s*=\s*["\']main["\']', source, re.DOTALL)) if __name__ == "__main__": unittest.main()