| from __future__ import annotations |
|
|
| import unittest |
| from pathlib import Path |
|
|
|
|
| ROOT = Path(__file__).resolve().parent |
|
|
|
|
| class ImageAndEntrypointIntegrationTests(unittest.TestCase): |
| def test_image_contains_xai_proxy_enforcer(self) -> None: |
| dockerfile = (ROOT / "Dockerfile").read_text(encoding="utf-8") |
| self.assertIn("COPY xai_auth_proxy.py /opt/daili/xai_auth_proxy.py", dockerfile) |
| self.assertIn("COPY patches/xai_fail_closed.go /tmp/xai_fail_closed.go", dockerfile) |
| self.assertIn("go run /tmp/apply_xai_fail_closed.go", dockerfile) |
| self.assertIn("go test ./sdk/cliproxy/auth", dockerfile) |
|
|
| def test_startup_enforces_before_gateway_and_watches_after_management(self) -> None: |
| entrypoint = (ROOT / "entrypoint.sh").read_text(encoding="utf-8") |
| restore = entrypoint.rindex("restore_objectstore_state || true") |
| enforce = entrypoint.rindex("\nenforce_xai_auth_proxies_once\n") |
| gateway = entrypoint.rindex('"$GATEWAY_BIN" -config "$GATEWAY_CONFIG_PATH" &') |
| watcher = entrypoint.rindex("start_xai_proxy_watch") |
|
|
| self.assertLess(restore, enforce) |
| self.assertLess(enforce, gateway) |
| self.assertLess(gateway, watcher) |
| self.assertIn('PROXY_URL_VALUE="direct"', entrypoint) |
| self.assertNotIn('PROXY_URL_VALUE="socks5h://', entrypoint) |
| self.assertIn('XAI_PROXY_FAIL_CLOSED_URL="$XAI_PROXY_FAIL_CLOSED_URL"', entrypoint) |
|
|
| def test_objectstore_config_is_also_forced_direct(self) -> None: |
| source = (ROOT / "objectstore_sync.py").read_text(encoding="utf-8") |
| self.assertIn("from xai_auth_proxy import enforce_config_proxy_url", source) |
| self.assertIn("def enforce_config_without_mtime_change", source) |
| self.assertGreaterEqual(source.count("enforce_config_without_mtime_change(config_path)"), 2) |
|
|
| def test_secret_staging_directory_is_ignored(self) -> None: |
| gitignore = (ROOT / ".gitignore").read_text(encoding="utf-8").splitlines() |
| dockerignore = (ROOT / ".dockerignore").read_text(encoding="utf-8").splitlines() |
| self.assertIn(".codex-tmp/", gitignore) |
| self.assertIn(".codex-tmp", dockerignore) |
|
|
|
|
| if __name__ == "__main__": |
| unittest.main() |
|
|
