feat(FN-004): merge fusion/fn-004

apps/api/tests/conftest.py

@@ -0,0 +1,84 @@
+from collections.abc import AsyncGenerator, Generator
+from typing import Any
+
+import pytest
+from httpx import ASGITransport, AsyncClient
+from sqlalchemy.ext.asyncio import (
+    AsyncEngine,
+    AsyncSession,
+    async_sessionmaker,
+    create_async_engine,
+)
+from sqlalchemy.pool import NullPool
+
+from app.config import settings
+from app.db import get_db_session
+from app.main import app
+from app.models import Base
+
+TEST_DATABASE_URL = settings.database_url.replace("/headquarter", "/headquarter_test")
+if TEST_DATABASE_URL.startswith("postgresql://"):
+    TEST_DATABASE_URL = TEST_DATABASE_URL.replace("postgresql://", "postgresql+asyncpg://", 1)
+
+
+@pytest.fixture(scope="session")
+def event_loop() -> Generator[Any, None, None]:
+    import asyncio
+    loop = asyncio.get_event_loop_policy().new_event_loop()
+    yield loop
+    loop.close()
+
+
+@pytest.fixture(scope="session")
+async def db_engine() -> AsyncGenerator[AsyncEngine, None]:
+    engine = create_async_engine(TEST_DATABASE_URL, echo=False, poolclass=NullPool)
+    async with engine.begin() as conn:
+        await conn.run_sync(Base.metadata.create_all)
+    yield engine
+    async with engine.begin() as conn:
+        await conn.run_sync(Base.metadata.drop_all)
+    await engine.dispose()
+
+
+@pytest.fixture
+async def db_session(
+    db_engine: AsyncEngine,
+) -> AsyncGenerator[async_sessionmaker[AsyncSession], None]:
+    async with db_engine.connect() as connection:
+        trans = await connection.begin_nested()
+        testing_session_local = async_sessionmaker(
+            connection, class_=AsyncSession, expire_on_commit=False
+        )
+
+        async def override_get_db() -> AsyncGenerator[AsyncSession, None]:
+            async with testing_session_local() as session:
+                yield session
+
+        app.dependency_overrides[get_db_session] = override_get_db
+        original_db_url = settings.database_url
+        settings.database_url = TEST_DATABASE_URL
+        yield testing_session_local
+        settings.database_url = original_db_url
+        app.dependency_overrides.pop(get_db_session, None)
+        await trans.rollback()
+
+
+@pytest.fixture
+async def client(
+    db_session: async_sessionmaker[AsyncSession],
+) -> AsyncGenerator[AsyncClient, None]:
+    async with AsyncClient(transport=ASGITransport(app=app), base_url="http://test") as ac:
+        yield ac
+
+
+@pytest.fixture
+async def auth_client(
+    client: AsyncClient,
+) -> AsyncGenerator[AsyncClient, None]:
+    original_debug = settings.debug
+    original_bypass = settings.auth_dev_bypass
+    settings.debug = True
+    settings.auth_dev_bypass = True
+    yield client
+    settings.debug = original_debug
+    settings.auth_dev_bypass = original_bypass

apps/api/tests/test_auth.py

@@ -0,0 +1,66 @@
+from typing import Any
+
+import pytest
+from httpx import AsyncClient
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import async_sessionmaker
+
+from app.config import settings
+from app.models.user import User
+
+
+@pytest.mark.asyncio
+async def test_dev_bypass_creates_user(auth_client: AsyncClient) -> None:
+    response = await auth_client.get("/api/v1/users/me")
+    assert response.status_code == 200
+    data = response.json()
+    assert data["authentik_sub"] == "dev-user"
+
+
+@pytest.mark.asyncio
+async def test_missing_token_raises_401_when_bypass_disabled(client: AsyncClient) -> None:
+    original_debug = settings.debug
+    original_bypass = settings.auth_dev_bypass
+    settings.debug = False
+    settings.auth_dev_bypass = False
+
+    response = await client.get("/api/v1/users/me")
+
+    settings.debug = original_debug
+    settings.auth_dev_bypass = original_bypass
+
+    assert response.status_code == 401
+
+
+@pytest.mark.asyncio
+async def test_inactive_user_raises_403(
+    auth_client: AsyncClient, db_session: async_sessionmaker[Any]
+) -> None:
+    async with db_session() as session:
+        result = await session.execute(select(User).where(User.authentik_sub == "dev-user"))
+        user = result.scalar_one_or_none()
+        if user is None:
+            user = User(
+                authentik_sub="dev-user",
+                email="dev@localhost",
+                display_name="Dev User",
+                is_active=True,
+            )
+            session.add(user)
+            await session.commit()
+
+    async with db_session() as session:
+        result = await session.execute(select(User).where(User.authentik_sub == "dev-user"))
+        user = result.scalar_one()
+        user.is_active = False
+        await session.commit()
+
+    response = await auth_client.get("/api/v1/users/me")
+
+    async with db_session() as session:
+        result = await session.execute(select(User).where(User.authentik_sub == "dev-user"))
+        user = result.scalar_one()
+        user.is_active = True
+        await session.commit()
+
+    assert response.status_code == 403

apps/api/tests/test_health.py

@@ -1,14 +1,14 @@
-from fastapi.testclient import TestClient
+import pytest
+from httpx import AsyncClient
 
 from app.config import settings
-from app.main import app
-
-client = TestClient(app)
 
 
-def test_health_returns_ok() -> None:
-    response = client.get("/health")
+@pytest.mark.asyncio
+async def test_health_returns_ok(client: AsyncClient) -> None:
+    response = await client.get("/health")
     assert response.status_code == 200
     data = response.json()
     assert data["status"] == "ok"
     assert data["service"] == settings.app_name
+    assert data["database"] == "connected"

apps/api/tests/test_routers/test_projects.py

@@ -0,0 +1,35 @@
+import pytest
+from httpx import AsyncClient
+
+
+@pytest.mark.asyncio
+async def test_project_crud(auth_client: AsyncClient) -> None:
+    # Create
+    resp = await auth_client.post("/api/v1/projects", json={"name": "Test", "slug": "test"})
+    assert resp.status_code == 201
+    data = resp.json()
+    assert data["name"] == "Test"
+    project_id = data["id"]
+
+    # List
+    resp = await auth_client.get("/api/v1/projects")
+    assert resp.status_code == 200
+    assert len(resp.json()) == 1
+
+    # Get
+    resp = await auth_client.get(f"/api/v1/projects/{project_id}")
+    assert resp.status_code == 200
+    assert resp.json()["slug"] == "test"
+
+    # Update
+    resp = await auth_client.put(f"/api/v1/projects/{project_id}", json={"name": "Updated"})
+    assert resp.status_code == 200
+    assert resp.json()["name"] == "Updated"
+
+    # Delete
+    resp = await auth_client.delete(f"/api/v1/projects/{project_id}")
+    assert resp.status_code == 204
+
+    # Verify deletion
+    resp = await auth_client.get(f"/api/v1/projects/{project_id}")
+    assert resp.status_code == 404

apps/api/tests/test_routers/test_repositories.py

@@ -0,0 +1,40 @@
+import pytest
+from httpx import AsyncClient
+
+
+@pytest.mark.asyncio
+async def test_repository_crud(auth_client: AsyncClient) -> None:
+    # Create project first
+    resp = await auth_client.post(
+        "/api/v1/projects", json={"name": "RepoTest", "slug": "repo-test"}
+    )
+    project_id = resp.json()["id"]
+
+    # Create repo
+    resp = await auth_client.post(
+        f"/api/v1/projects/{project_id}/repositories",
+        json={"name": "repo1", "git_url": "https://git.example.com/repo1.git"},
+    )
+    assert resp.status_code == 201
+    repo_id = resp.json()["id"]
+
+    # List
+    resp = await auth_client.get(f"/api/v1/projects/{project_id}/repositories")
+    assert resp.status_code == 200
+    assert len(resp.json()) == 1
+
+    # Get
+    resp = await auth_client.get(f"/api/v1/projects/{project_id}/repositories/{repo_id}")
+    assert resp.status_code == 200
+
+    # Update
+    resp = await auth_client.put(
+        f"/api/v1/projects/{project_id}/repositories/{repo_id}",
+        json={"name": "repo1-updated"},
+    )
+    assert resp.status_code == 200
+    assert resp.json()["name"] == "repo1-updated"
+
+    # Delete
+    resp = await auth_client.delete(f"/api/v1/projects/{project_id}/repositories/{repo_id}")
+    assert resp.status_code == 204

apps/api/tests/test_routers/test_secrets.py

@@ -0,0 +1,72 @@
+from typing import Any
+
+import pytest
+from httpx import AsyncClient
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import async_sessionmaker
+
+from app.models.secret import Secret
+
+
+@pytest.mark.asyncio
+async def test_secret_encrypt_decrypt(
+    auth_client: AsyncClient, db_session: async_sessionmaker[Any]
+) -> None:
+    resp = await auth_client.post(
+        "/api/v1/projects",
+        json={"name": "SecretTest", "slug": "secret-test"},
+    )
+    project_id = resp.json()["id"]
+
+    resp = await auth_client.post(
+        "/api/v1/secrets",
+        json={
+            "scope_type": "project",
+            "scope_id": str(project_id),
+            "key": "api_key",
+            "value": "super-secret",
+        },
+    )
+    assert resp.status_code == 201
+    data = resp.json()
+    assert data["value"] == "super-secret"
+    secret_id = data["id"]
+
+    resp = await auth_client.get(f"/api/v1/secrets/{secret_id}")
+    assert resp.status_code == 200
+    assert resp.json()["value"] == "super-secret"
+
+    async with db_session() as session:
+        result = await session.execute(select(Secret).where(Secret.id == secret_id))
+        secret = result.scalar_one()
+        assert secret.encrypted_value != "super-secret"
+
+    resp = await auth_client.put(
+        f"/api/v1/secrets/{secret_id}",
+        json={"value": "new-secret"},
+    )
+    assert resp.status_code == 200
+    assert resp.json()["value"] == "new-secret"
+
+    resp = await auth_client.delete(f"/api/v1/secrets/{secret_id}")
+    assert resp.status_code == 204
+
+
+@pytest.mark.asyncio
+async def test_secret_ownership_enforced(auth_client: AsyncClient) -> None:
+    resp = await auth_client.post("/api/v1/projects", json={"name": "P1", "slug": "p1"})
+    p1 = resp.json()["id"]
+
+    resp = await auth_client.post("/api/v1/projects", json={"name": "P2", "slug": "p2"})
+    p2 = resp.json()["id"]
+
+    resp = await auth_client.post(
+        "/api/v1/secrets",
+        json={"scope_type": "project", "scope_id": str(p1), "key": "k1", "value": "v1"},
+    )
+
+    resp = await auth_client.get("/api/v1/secrets", params={"scope_id": str(p2)})
+    assert resp.status_code == 200
+    secrets = resp.json()
+    for s in secrets:
+        assert s["scope_id"] != str(p1) or s["scope_type"] != "project"

apps/api/tests/test_routers/test_tool_definitions.py

@@ -0,0 +1,26 @@
+import pytest
+from httpx import AsyncClient
+
+
+@pytest.mark.asyncio
+async def test_tool_definition_crud(auth_client: AsyncClient) -> None:
+    resp = await auth_client.post(
+        "/api/v1/tool-definitions",
+        json={"key": "runfusion", "name": "RunFusion", "image": "runfusion:latest"},
+    )
+    assert resp.status_code == 201
+    td_id = resp.json()["id"]
+
+    resp = await auth_client.get("/api/v1/tool-definitions")
+    assert resp.status_code == 200
+    assert len(resp.json()) >= 1
+
+    resp = await auth_client.get(f"/api/v1/tool-definitions/{td_id}")
+    assert resp.status_code == 200
+
+    resp = await auth_client.put(f"/api/v1/tool-definitions/{td_id}", json={"name": "RunFusionV2"})
+    assert resp.status_code == 200
+    assert resp.json()["name"] == "RunFusionV2"
+
+    resp = await auth_client.delete(f"/api/v1/tool-definitions/{td_id}")
+    assert resp.status_code == 204