save dev progress
This commit is contained in:
StellaOps Bot
@@ -0,0 +1,330 @@
|
||||
// -----------------------------------------------------------------------------
|
||||
// BundleExportDeterminismTests.cs
|
||||
// Sprint: SPRINT_8200_0014_0002_CONCEL_delta_bundle_export
|
||||
// Tasks: EXPORT-8200-013, EXPORT-8200-018, EXPORT-8200-027
|
||||
// Description: Tests for delta correctness, export determinism, and E2E export verification
|
||||
// -----------------------------------------------------------------------------
|
||||
|
||||
using FluentAssertions;
|
||||
using Microsoft.Extensions.Logging.Abstractions;
|
||||
using Microsoft.Extensions.Options;
|
||||
using Moq;
|
||||
using StellaOps.Concelier.Federation.Export;
|
||||
using StellaOps.Concelier.Federation.Models;
|
||||
using StellaOps.Concelier.Federation.Signing;
|
||||
|
||||
namespace StellaOps.Concelier.Federation.Tests.Export;
|
||||
|
||||
/// <summary>
|
||||
/// Tests for bundle export determinism - same inputs must produce same hash.
|
||||
/// </summary>
|
||||
public sealed class BundleExportDeterminismTests
|
||||
{
|
||||
private readonly Mock<IDeltaQueryService> _deltaQueryMock;
|
||||
private readonly Mock<IBundleSigner> _signerMock;
|
||||
private readonly BundleExportService _exportService;
|
||||
|
||||
public BundleExportDeterminismTests()
|
||||
{
|
||||
_deltaQueryMock = new Mock<IDeltaQueryService>();
|
||||
_signerMock = new Mock<IBundleSigner>();
|
||||
|
||||
var options = Options.Create(new FederationOptions
|
||||
{
|
||||
SiteId = "test-site",
|
||||
DefaultCompressionLevel = 3
|
||||
});
|
||||
|
||||
_exportService = new BundleExportService(
|
||||
_deltaQueryMock.Object,
|
||||
_signerMock.Object,
|
||||
options,
|
||||
NullLogger<BundleExportService>.Instance);
|
||||
}
|
||||
|
||||
#region Export Determinism Tests (Task 18)
|
||||
|
||||
[Fact]
|
||||
public async Task ExportAsync_SameInput_ProducesSameHash()
|
||||
{
|
||||
// Arrange
|
||||
var canonicals = CreateTestCanonicals(10);
|
||||
var edges = CreateTestEdges(canonicals);
|
||||
var deletions = Array.Empty<DeletionBundleLine>();
|
||||
|
||||
SetupDeltaQueryMock(canonicals, edges, deletions);
|
||||
|
||||
// Act - Export twice with same input
|
||||
using var stream1 = new MemoryStream();
|
||||
using var stream2 = new MemoryStream();
|
||||
|
||||
var result1 = await _exportService.ExportToStreamAsync(stream1, sinceCursor: null);
|
||||
|
||||
// Reset mock for second call
|
||||
SetupDeltaQueryMock(canonicals, edges, deletions);
|
||||
var result2 = await _exportService.ExportToStreamAsync(stream2, sinceCursor: null);
|
||||
|
||||
// Assert - Both exports should produce same counts
|
||||
result1.Counts.Canonicals.Should().Be(result2.Counts.Canonicals);
|
||||
result1.Counts.Edges.Should().Be(result2.Counts.Edges);
|
||||
result1.Counts.Deletions.Should().Be(result2.Counts.Deletions);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task ExportAsync_DifferentCursors_ProducesDifferentHashes()
|
||||
{
|
||||
// Arrange
|
||||
var canonicals1 = CreateTestCanonicals(5);
|
||||
var canonicals2 = CreateTestCanonicals(5); // Different GUIDs
|
||||
var edges1 = CreateTestEdges(canonicals1);
|
||||
var edges2 = CreateTestEdges(canonicals2);
|
||||
|
||||
// First export
|
||||
SetupDeltaQueryMock(canonicals1, edges1, []);
|
||||
using var stream1 = new MemoryStream();
|
||||
var result1 = await _exportService.ExportToStreamAsync(stream1, sinceCursor: "cursor-a");
|
||||
|
||||
// Second export with different data
|
||||
SetupDeltaQueryMock(canonicals2, edges2, []);
|
||||
using var stream2 = new MemoryStream();
|
||||
var result2 = await _exportService.ExportToStreamAsync(stream2, sinceCursor: "cursor-b");
|
||||
|
||||
// Assert - Different content should produce different hashes
|
||||
result1.BundleHash.Should().NotBe(result2.BundleHash);
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Delta Correctness Tests (Task 13)
|
||||
|
||||
[Fact]
|
||||
public async Task ExportAsync_EmptyDelta_ProducesEmptyBundle()
|
||||
{
|
||||
// Arrange
|
||||
SetupDeltaQueryMock([], [], []);
|
||||
|
||||
// Act
|
||||
using var stream = new MemoryStream();
|
||||
var result = await _exportService.ExportToStreamAsync(stream, sinceCursor: "current-cursor");
|
||||
|
||||
// Assert
|
||||
result.Counts.Canonicals.Should().Be(0);
|
||||
result.Counts.Edges.Should().Be(0);
|
||||
result.Counts.Deletions.Should().Be(0);
|
||||
result.CompressedSizeBytes.Should().BeGreaterThan(0); // Still has manifest
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task ExportAsync_OnlyCanonicals_IncludesOnlyCanonicals()
|
||||
{
|
||||
// Arrange
|
||||
var canonicals = CreateTestCanonicals(3);
|
||||
SetupDeltaQueryMock(canonicals, [], []);
|
||||
|
||||
// Act
|
||||
using var stream = new MemoryStream();
|
||||
var result = await _exportService.ExportToStreamAsync(stream, sinceCursor: null);
|
||||
|
||||
// Assert
|
||||
result.Counts.Canonicals.Should().Be(3);
|
||||
result.Counts.Edges.Should().Be(0);
|
||||
result.Counts.Deletions.Should().Be(0);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task ExportAsync_OnlyDeletions_IncludesOnlyDeletions()
|
||||
{
|
||||
// Arrange
|
||||
var deletions = CreateTestDeletions(2);
|
||||
SetupDeltaQueryMock([], [], deletions);
|
||||
|
||||
// Act
|
||||
using var stream = new MemoryStream();
|
||||
var result = await _exportService.ExportToStreamAsync(stream, sinceCursor: null);
|
||||
|
||||
// Assert
|
||||
result.Counts.Canonicals.Should().Be(0);
|
||||
result.Counts.Edges.Should().Be(0);
|
||||
result.Counts.Deletions.Should().Be(2);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task ExportAsync_MixedChanges_IncludesAllTypes()
|
||||
{
|
||||
// Arrange
|
||||
var canonicals = CreateTestCanonicals(5);
|
||||
var edges = CreateTestEdges(canonicals);
|
||||
var deletions = CreateTestDeletions(2);
|
||||
SetupDeltaQueryMock(canonicals, edges, deletions);
|
||||
|
||||
// Act
|
||||
using var stream = new MemoryStream();
|
||||
var result = await _exportService.ExportToStreamAsync(stream, sinceCursor: null);
|
||||
|
||||
// Assert
|
||||
result.Counts.Canonicals.Should().Be(5);
|
||||
result.Counts.Edges.Should().Be(5); // One edge per canonical
|
||||
result.Counts.Deletions.Should().Be(2);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task ExportAsync_LargeDelta_HandlesCorrectly()
|
||||
{
|
||||
// Arrange
|
||||
var canonicals = CreateTestCanonicals(100);
|
||||
var edges = CreateTestEdges(canonicals);
|
||||
SetupDeltaQueryMock(canonicals, edges, []);
|
||||
|
||||
// Act
|
||||
using var stream = new MemoryStream();
|
||||
var result = await _exportService.ExportToStreamAsync(stream, sinceCursor: null);
|
||||
|
||||
// Assert
|
||||
result.Counts.Canonicals.Should().Be(100);
|
||||
result.Counts.Edges.Should().Be(100);
|
||||
result.CompressedSizeBytes.Should().BeGreaterThan(0);
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region E2E Export Verification Tests (Task 27)
|
||||
|
||||
[Fact]
|
||||
public async Task ExportAsync_ProducesValidBundle_WithAllComponents()
|
||||
{
|
||||
// Arrange
|
||||
var canonicals = CreateTestCanonicals(3);
|
||||
var edges = CreateTestEdges(canonicals);
|
||||
var deletions = CreateTestDeletions(1);
|
||||
SetupDeltaQueryMock(canonicals, edges, deletions);
|
||||
|
||||
// Act
|
||||
using var stream = new MemoryStream();
|
||||
var result = await _exportService.ExportToStreamAsync(stream, sinceCursor: null);
|
||||
|
||||
// Assert - Result structure
|
||||
result.Should().NotBeNull();
|
||||
result.BundleHash.Should().StartWith("sha256:");
|
||||
result.ExportCursor.Should().NotBeNullOrEmpty();
|
||||
result.Counts.Should().NotBeNull();
|
||||
result.Duration.Should().BeGreaterThan(TimeSpan.Zero);
|
||||
|
||||
// Assert - Stream content
|
||||
stream.Position = 0;
|
||||
stream.Length.Should().BeGreaterThan(0);
|
||||
stream.Length.Should().Be(result.CompressedSizeBytes);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task ExportAsync_WithSigning_IncludesSignature()
|
||||
{
|
||||
// Arrange
|
||||
var canonicals = CreateTestCanonicals(2);
|
||||
SetupDeltaQueryMock(canonicals, [], []);
|
||||
|
||||
var signature = new BundleSignature
|
||||
{
|
||||
PayloadType = "application/stellaops.federation.bundle+json",
|
||||
Payload = "test-payload",
|
||||
Signatures = [new SignatureEntry { KeyId = "key-001", Algorithm = "ES256", Signature = "sig123" }]
|
||||
};
|
||||
|
||||
_signerMock
|
||||
.Setup(x => x.SignBundleAsync(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<CancellationToken>()))
|
||||
.ReturnsAsync(new BundleSigningResult { Success = true, Signature = signature });
|
||||
|
||||
// Act
|
||||
using var stream = new MemoryStream();
|
||||
var options = new BundleExportOptions { Sign = true };
|
||||
var result = await _exportService.ExportToStreamAsync(stream, sinceCursor: null, options: options);
|
||||
|
||||
// Assert
|
||||
result.Signature.Should().NotBeNull();
|
||||
var sig = result.Signature as BundleSignature;
|
||||
sig.Should().NotBeNull();
|
||||
sig!.Signatures.Should().HaveCount(1);
|
||||
sig.Signatures[0].KeyId.Should().Be("key-001");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task PreviewAsync_ReturnsAccurateEstimates()
|
||||
{
|
||||
// Arrange
|
||||
var counts = new DeltaCounts { Canonicals = 100, Edges = 200, Deletions = 5 };
|
||||
|
||||
_deltaQueryMock
|
||||
.Setup(x => x.CountChangedSinceAsync(It.IsAny<string?>(), It.IsAny<DeltaQueryOptions>(), It.IsAny<CancellationToken>()))
|
||||
.ReturnsAsync(counts);
|
||||
|
||||
// Act
|
||||
var preview = await _exportService.PreviewAsync(sinceCursor: null);
|
||||
|
||||
// Assert
|
||||
preview.EstimatedCanonicals.Should().Be(100);
|
||||
preview.EstimatedEdges.Should().Be(200);
|
||||
preview.EstimatedDeletions.Should().Be(5);
|
||||
preview.EstimatedSizeBytes.Should().BeGreaterThan(0);
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Helper Methods
|
||||
|
||||
private void SetupDeltaQueryMock(
|
||||
IReadOnlyList<CanonicalBundleLine> canonicals,
|
||||
IReadOnlyList<EdgeBundleLine> edges,
|
||||
IReadOnlyList<DeletionBundleLine> deletions)
|
||||
{
|
||||
var changes = new DeltaChangeSet
|
||||
{
|
||||
Canonicals = canonicals.ToAsyncEnumerable(),
|
||||
Edges = edges.ToAsyncEnumerable(),
|
||||
Deletions = deletions.ToAsyncEnumerable(),
|
||||
NewCursor = "test-cursor"
|
||||
};
|
||||
|
||||
_deltaQueryMock
|
||||
.Setup(x => x.GetChangedSinceAsync(It.IsAny<string?>(), It.IsAny<DeltaQueryOptions>(), It.IsAny<CancellationToken>()))
|
||||
.ReturnsAsync(changes);
|
||||
}
|
||||
|
||||
private static List<CanonicalBundleLine> CreateTestCanonicals(int count)
|
||||
{
|
||||
return Enumerable.Range(1, count).Select(i => new CanonicalBundleLine
|
||||
{
|
||||
Id = Guid.NewGuid(),
|
||||
Cve = $"CVE-2024-{i:D4}",
|
||||
AffectsKey = $"pkg:generic/test{i}@1.0",
|
||||
MergeHash = $"sha256:hash{i}",
|
||||
Status = "active",
|
||||
Title = $"Test Advisory {i}",
|
||||
Severity = i % 3 == 0 ? "critical" : i % 2 == 0 ? "high" : "medium",
|
||||
UpdatedAt = DateTimeOffset.UtcNow.AddMinutes(-i)
|
||||
}).ToList();
|
||||
}
|
||||
|
||||
private static List<EdgeBundleLine> CreateTestEdges(IReadOnlyList<CanonicalBundleLine> canonicals)
|
||||
{
|
||||
return canonicals.Select((c, i) => new EdgeBundleLine
|
||||
{
|
||||
Id = Guid.NewGuid(),
|
||||
CanonicalId = c.Id,
|
||||
Source = "nvd",
|
||||
SourceAdvisoryId = c.Cve ?? $"CVE-2024-{i:D4}",
|
||||
ContentHash = $"sha256:edge{i}",
|
||||
UpdatedAt = DateTimeOffset.UtcNow.AddMinutes(-i)
|
||||
}).ToList();
|
||||
}
|
||||
|
||||
private static List<DeletionBundleLine> CreateTestDeletions(int count)
|
||||
{
|
||||
return Enumerable.Range(1, count).Select(i => new DeletionBundleLine
|
||||
{
|
||||
CanonicalId = Guid.NewGuid(),
|
||||
Reason = "rejected",
|
||||
DeletedAt = DateTimeOffset.UtcNow.AddMinutes(-i)
|
||||
}).ToList();
|
||||
}
|
||||
|
||||
#endregion
|
||||
}
|
||||
@@ -0,0 +1,511 @@
|
||||
// -----------------------------------------------------------------------------
|
||||
// BundleMergeTests.cs
|
||||
// Sprint: SPRINT_8200_0014_0003_CONCEL_bundle_import_merge
|
||||
// Task: IMPORT-8200-018
|
||||
// Description: Tests for merge scenarios (new, update, conflict, deletion)
|
||||
// -----------------------------------------------------------------------------
|
||||
|
||||
using FluentAssertions;
|
||||
using StellaOps.Concelier.Federation.Import;
|
||||
using StellaOps.Concelier.Federation.Models;
|
||||
|
||||
namespace StellaOps.Concelier.Federation.Tests.Import;
|
||||
|
||||
/// <summary>
|
||||
/// Tests for bundle merge scenarios.
|
||||
/// </summary>
|
||||
public sealed class BundleMergeTests
|
||||
{
|
||||
#region MergeResult Tests
|
||||
|
||||
[Fact]
|
||||
public void MergeResult_Created_HasCorrectAction()
|
||||
{
|
||||
// Act
|
||||
var result = MergeResult.Created();
|
||||
|
||||
// Assert
|
||||
result.Action.Should().Be(MergeAction.Created);
|
||||
result.Conflict.Should().BeNull();
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void MergeResult_Updated_HasCorrectAction()
|
||||
{
|
||||
// Act
|
||||
var result = MergeResult.Updated();
|
||||
|
||||
// Assert
|
||||
result.Action.Should().Be(MergeAction.Updated);
|
||||
result.Conflict.Should().BeNull();
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void MergeResult_Skipped_HasCorrectAction()
|
||||
{
|
||||
// Act
|
||||
var result = MergeResult.Skipped();
|
||||
|
||||
// Assert
|
||||
result.Action.Should().Be(MergeAction.Skipped);
|
||||
result.Conflict.Should().BeNull();
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void MergeResult_UpdatedWithConflict_HasConflictDetails()
|
||||
{
|
||||
// Arrange
|
||||
var conflict = new ImportConflict
|
||||
{
|
||||
MergeHash = "sha256:test",
|
||||
Field = "severity",
|
||||
LocalValue = "high",
|
||||
RemoteValue = "critical",
|
||||
Resolution = ConflictResolution.PreferRemote
|
||||
};
|
||||
|
||||
// Act
|
||||
var result = MergeResult.UpdatedWithConflict(conflict);
|
||||
|
||||
// Assert
|
||||
result.Action.Should().Be(MergeAction.Updated);
|
||||
result.Conflict.Should().NotBeNull();
|
||||
result.Conflict!.Field.Should().Be("severity");
|
||||
result.Conflict.LocalValue.Should().Be("high");
|
||||
result.Conflict.RemoteValue.Should().Be("critical");
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region ConflictResolution Tests
|
||||
|
||||
[Fact]
|
||||
public void ConflictResolution_PreferRemote_IsDefault()
|
||||
{
|
||||
// Act
|
||||
var options = new BundleImportOptions();
|
||||
|
||||
// Assert
|
||||
options.OnConflict.Should().Be(ConflictResolution.PreferRemote);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void ConflictResolution_PreferLocal_CanBeSet()
|
||||
{
|
||||
// Act
|
||||
var options = new BundleImportOptions { OnConflict = ConflictResolution.PreferLocal };
|
||||
|
||||
// Assert
|
||||
options.OnConflict.Should().Be(ConflictResolution.PreferLocal);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void ConflictResolution_Fail_CanBeSet()
|
||||
{
|
||||
// Act
|
||||
var options = new BundleImportOptions { OnConflict = ConflictResolution.Fail };
|
||||
|
||||
// Assert
|
||||
options.OnConflict.Should().Be(ConflictResolution.Fail);
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region ImportConflict Tests
|
||||
|
||||
[Fact]
|
||||
public void ImportConflict_RecordsSeverityChange()
|
||||
{
|
||||
// Arrange & Act
|
||||
var conflict = new ImportConflict
|
||||
{
|
||||
MergeHash = "sha256:abc123",
|
||||
Field = "severity",
|
||||
LocalValue = "medium",
|
||||
RemoteValue = "critical",
|
||||
Resolution = ConflictResolution.PreferRemote
|
||||
};
|
||||
|
||||
// Assert
|
||||
conflict.MergeHash.Should().Be("sha256:abc123");
|
||||
conflict.Field.Should().Be("severity");
|
||||
conflict.LocalValue.Should().Be("medium");
|
||||
conflict.RemoteValue.Should().Be("critical");
|
||||
conflict.Resolution.Should().Be(ConflictResolution.PreferRemote);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void ImportConflict_RecordsStatusChange()
|
||||
{
|
||||
// Arrange & Act
|
||||
var conflict = new ImportConflict
|
||||
{
|
||||
MergeHash = "sha256:xyz789",
|
||||
Field = "status",
|
||||
LocalValue = "active",
|
||||
RemoteValue = "withdrawn",
|
||||
Resolution = ConflictResolution.PreferLocal
|
||||
};
|
||||
|
||||
// Assert
|
||||
conflict.Field.Should().Be("status");
|
||||
conflict.Resolution.Should().Be(ConflictResolution.PreferLocal);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void ImportConflict_HandlesNullValues()
|
||||
{
|
||||
// Arrange & Act
|
||||
var conflict = new ImportConflict
|
||||
{
|
||||
MergeHash = "sha256:new",
|
||||
Field = "cve",
|
||||
LocalValue = null,
|
||||
RemoteValue = "CVE-2024-1234",
|
||||
Resolution = ConflictResolution.PreferRemote
|
||||
};
|
||||
|
||||
// Assert
|
||||
conflict.LocalValue.Should().BeNull();
|
||||
conflict.RemoteValue.Should().Be("CVE-2024-1234");
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region ImportCounts Tests
|
||||
|
||||
[Fact]
|
||||
public void ImportCounts_CalculatesTotal()
|
||||
{
|
||||
// Arrange & Act
|
||||
var counts = new ImportCounts
|
||||
{
|
||||
CanonicalCreated = 10,
|
||||
CanonicalUpdated = 5,
|
||||
CanonicalSkipped = 3,
|
||||
EdgesAdded = 20,
|
||||
DeletionsProcessed = 2
|
||||
};
|
||||
|
||||
// Assert
|
||||
counts.Total.Should().Be(40);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void ImportCounts_DefaultsToZero()
|
||||
{
|
||||
// Act
|
||||
var counts = new ImportCounts();
|
||||
|
||||
// Assert
|
||||
counts.CanonicalCreated.Should().Be(0);
|
||||
counts.CanonicalUpdated.Should().Be(0);
|
||||
counts.CanonicalSkipped.Should().Be(0);
|
||||
counts.EdgesAdded.Should().Be(0);
|
||||
counts.DeletionsProcessed.Should().Be(0);
|
||||
counts.Total.Should().Be(0);
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region BundleImportResult Tests
|
||||
|
||||
[Fact]
|
||||
public void BundleImportResult_Succeeded_HasCorrectProperties()
|
||||
{
|
||||
// Arrange
|
||||
var counts = new ImportCounts
|
||||
{
|
||||
CanonicalCreated = 10,
|
||||
EdgesAdded = 25
|
||||
};
|
||||
|
||||
// Act
|
||||
var result = BundleImportResult.Succeeded(
|
||||
"sha256:bundle123",
|
||||
"2025-01-15T10:00:00Z#0001",
|
||||
counts,
|
||||
duration: TimeSpan.FromSeconds(5));
|
||||
|
||||
// Assert
|
||||
result.Success.Should().BeTrue();
|
||||
result.BundleHash.Should().Be("sha256:bundle123");
|
||||
result.ImportedCursor.Should().Be("2025-01-15T10:00:00Z#0001");
|
||||
result.Counts.CanonicalCreated.Should().Be(10);
|
||||
result.Duration.TotalSeconds.Should().Be(5);
|
||||
result.FailureReason.Should().BeNull();
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void BundleImportResult_Failed_HasErrorDetails()
|
||||
{
|
||||
// Act
|
||||
var result = BundleImportResult.Failed(
|
||||
"sha256:invalid",
|
||||
"Hash mismatch",
|
||||
TimeSpan.FromMilliseconds(100));
|
||||
|
||||
// Assert
|
||||
result.Success.Should().BeFalse();
|
||||
result.BundleHash.Should().Be("sha256:invalid");
|
||||
result.ImportedCursor.Should().BeEmpty();
|
||||
result.FailureReason.Should().Be("Hash mismatch");
|
||||
result.Duration.TotalMilliseconds.Should().Be(100);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void BundleImportResult_WithConflicts_RecordsConflicts()
|
||||
{
|
||||
// Arrange
|
||||
var conflicts = new List<ImportConflict>
|
||||
{
|
||||
new()
|
||||
{
|
||||
MergeHash = "sha256:a",
|
||||
Field = "severity",
|
||||
LocalValue = "high",
|
||||
RemoteValue = "critical",
|
||||
Resolution = ConflictResolution.PreferRemote
|
||||
},
|
||||
new()
|
||||
{
|
||||
MergeHash = "sha256:b",
|
||||
Field = "status",
|
||||
LocalValue = "active",
|
||||
RemoteValue = "withdrawn",
|
||||
Resolution = ConflictResolution.PreferRemote
|
||||
}
|
||||
};
|
||||
|
||||
// Act
|
||||
var result = BundleImportResult.Succeeded(
|
||||
"sha256:bundle",
|
||||
"cursor",
|
||||
new ImportCounts { CanonicalUpdated = 2 },
|
||||
conflicts);
|
||||
|
||||
// Assert
|
||||
result.Success.Should().BeTrue();
|
||||
result.Conflicts.Should().HaveCount(2);
|
||||
result.Conflicts[0].Field.Should().Be("severity");
|
||||
result.Conflicts[1].Field.Should().Be("status");
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region BundleImportOptions Tests
|
||||
|
||||
[Fact]
|
||||
public void BundleImportOptions_DefaultValues()
|
||||
{
|
||||
// Act
|
||||
var options = new BundleImportOptions();
|
||||
|
||||
// Assert
|
||||
options.SkipSignatureVerification.Should().BeFalse();
|
||||
options.DryRun.Should().BeFalse();
|
||||
options.OnConflict.Should().Be(ConflictResolution.PreferRemote);
|
||||
options.Force.Should().BeFalse();
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void BundleImportOptions_DryRun_CanBeEnabled()
|
||||
{
|
||||
// Act
|
||||
var options = new BundleImportOptions { DryRun = true };
|
||||
|
||||
// Assert
|
||||
options.DryRun.Should().BeTrue();
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void BundleImportOptions_SkipSignature_CanBeEnabled()
|
||||
{
|
||||
// Act
|
||||
var options = new BundleImportOptions { SkipSignatureVerification = true };
|
||||
|
||||
// Assert
|
||||
options.SkipSignatureVerification.Should().BeTrue();
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void BundleImportOptions_Force_CanBeEnabled()
|
||||
{
|
||||
// Act
|
||||
var options = new BundleImportOptions { Force = true };
|
||||
|
||||
// Assert
|
||||
options.Force.Should().BeTrue();
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region BundleImportPreview Tests
|
||||
|
||||
[Fact]
|
||||
public void BundleImportPreview_ValidBundle_HasManifestAndNoErrors()
|
||||
{
|
||||
// Arrange
|
||||
var manifest = new BundleManifest
|
||||
{
|
||||
Version = "feedser-bundle/1.0",
|
||||
SiteId = "test-site",
|
||||
ExportCursor = "cursor",
|
||||
BundleHash = "sha256:test",
|
||||
ExportedAt = DateTimeOffset.UtcNow,
|
||||
Counts = new BundleCounts { Canonicals = 10 }
|
||||
};
|
||||
|
||||
// Act
|
||||
var preview = new BundleImportPreview
|
||||
{
|
||||
Manifest = manifest,
|
||||
IsValid = true,
|
||||
CurrentCursor = "previous-cursor"
|
||||
};
|
||||
|
||||
// Assert
|
||||
preview.IsValid.Should().BeTrue();
|
||||
preview.Manifest.Should().NotBeNull();
|
||||
preview.Errors.Should().BeEmpty();
|
||||
preview.IsDuplicate.Should().BeFalse();
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void BundleImportPreview_Duplicate_MarkedAsDuplicate()
|
||||
{
|
||||
// Arrange
|
||||
var manifest = new BundleManifest
|
||||
{
|
||||
Version = "feedser-bundle/1.0",
|
||||
SiteId = "test-site",
|
||||
ExportCursor = "cursor",
|
||||
BundleHash = "sha256:already-imported",
|
||||
ExportedAt = DateTimeOffset.UtcNow,
|
||||
Counts = new BundleCounts { Canonicals = 10 }
|
||||
};
|
||||
|
||||
// Act
|
||||
var preview = new BundleImportPreview
|
||||
{
|
||||
Manifest = manifest,
|
||||
IsValid = true,
|
||||
IsDuplicate = true
|
||||
};
|
||||
|
||||
// Assert
|
||||
preview.IsDuplicate.Should().BeTrue();
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void BundleImportPreview_Invalid_HasErrors()
|
||||
{
|
||||
// Act
|
||||
var preview = new BundleImportPreview
|
||||
{
|
||||
Manifest = null!,
|
||||
IsValid = false,
|
||||
Errors = ["Hash mismatch", "Invalid signature"]
|
||||
};
|
||||
|
||||
// Assert
|
||||
preview.IsValid.Should().BeFalse();
|
||||
preview.Errors.Should().HaveCount(2);
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Merge Scenario Simulations
|
||||
|
||||
[Fact]
|
||||
public void MergeScenario_NewCanonical_CreatesRecord()
|
||||
{
|
||||
// This simulates the expected behavior when merging a new canonical
|
||||
// Arrange
|
||||
var canonical = new CanonicalBundleLine
|
||||
{
|
||||
Id = Guid.NewGuid(),
|
||||
Cve = "CVE-2024-NEW",
|
||||
AffectsKey = "pkg:npm/express@4.0.0",
|
||||
MergeHash = "sha256:brand-new",
|
||||
Status = "active",
|
||||
Severity = "high",
|
||||
UpdatedAt = DateTimeOffset.UtcNow
|
||||
};
|
||||
|
||||
// Act - Simulated merge for new record
|
||||
var localExists = false; // No existing record
|
||||
var result = !localExists ? MergeResult.Created() : MergeResult.Skipped();
|
||||
|
||||
// Assert
|
||||
result.Action.Should().Be(MergeAction.Created);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void MergeScenario_UpdatedCanonical_UpdatesRecord()
|
||||
{
|
||||
// Arrange
|
||||
var canonical = new CanonicalBundleLine
|
||||
{
|
||||
Id = Guid.NewGuid(),
|
||||
Cve = "CVE-2024-1234",
|
||||
AffectsKey = "pkg:npm/express@4.0.0",
|
||||
MergeHash = "sha256:existing",
|
||||
Status = "active",
|
||||
Severity = "critical", // Updated from high
|
||||
UpdatedAt = DateTimeOffset.UtcNow
|
||||
};
|
||||
|
||||
// Act - Simulated merge where local exists with different data
|
||||
var localExists = true;
|
||||
var localSeverity = "high";
|
||||
var hasChanges = localSeverity != canonical.Severity;
|
||||
var result = localExists && hasChanges ? MergeResult.Updated() : MergeResult.Skipped();
|
||||
|
||||
// Assert
|
||||
result.Action.Should().Be(MergeAction.Updated);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void MergeScenario_ConflictPreferRemote_RecordsConflict()
|
||||
{
|
||||
// Arrange
|
||||
var resolution = ConflictResolution.PreferRemote;
|
||||
var localValue = "medium";
|
||||
var remoteValue = "critical";
|
||||
|
||||
// Act - Simulated conflict detection
|
||||
var conflict = new ImportConflict
|
||||
{
|
||||
MergeHash = "sha256:conflict",
|
||||
Field = "severity",
|
||||
LocalValue = localValue,
|
||||
RemoteValue = remoteValue,
|
||||
Resolution = resolution
|
||||
};
|
||||
var result = MergeResult.UpdatedWithConflict(conflict);
|
||||
|
||||
// Assert
|
||||
result.Action.Should().Be(MergeAction.Updated);
|
||||
result.Conflict.Should().NotBeNull();
|
||||
result.Conflict!.Resolution.Should().Be(ConflictResolution.PreferRemote);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void MergeScenario_DeletionMarksWithdrawn()
|
||||
{
|
||||
// Arrange
|
||||
var deletion = new DeletionBundleLine
|
||||
{
|
||||
CanonicalId = Guid.NewGuid(),
|
||||
Reason = "duplicate",
|
||||
DeletedAt = DateTimeOffset.UtcNow
|
||||
};
|
||||
|
||||
// Act - Verify deletion has expected properties
|
||||
deletion.Reason.Should().Be("duplicate");
|
||||
deletion.DeletedAt.Should().BeCloseTo(DateTimeOffset.UtcNow, TimeSpan.FromSeconds(1));
|
||||
}
|
||||
|
||||
#endregion
|
||||
}
|
||||
@@ -0,0 +1,412 @@
|
||||
// -----------------------------------------------------------------------------
|
||||
// BundleReaderTests.cs
|
||||
// Sprint: SPRINT_8200_0014_0003_CONCEL_bundle_import_merge
|
||||
// Task: IMPORT-8200-005
|
||||
// Description: Unit tests for bundle parsing and reading
|
||||
// -----------------------------------------------------------------------------
|
||||
|
||||
using FluentAssertions;
|
||||
using StellaOps.Concelier.Federation.Compression;
|
||||
using StellaOps.Concelier.Federation.Import;
|
||||
using StellaOps.Concelier.Federation.Models;
|
||||
using StellaOps.Concelier.Federation.Serialization;
|
||||
using System.Formats.Tar;
|
||||
using System.Text;
|
||||
using System.Text.Json;
|
||||
|
||||
namespace StellaOps.Concelier.Federation.Tests.Import;
|
||||
|
||||
/// <summary>
|
||||
/// Tests for BundleReader parsing and validation.
|
||||
/// </summary>
|
||||
public sealed class BundleReaderTests : IDisposable
|
||||
{
|
||||
private readonly List<Stream> _disposableStreams = [];
|
||||
|
||||
public void Dispose()
|
||||
{
|
||||
foreach (var stream in _disposableStreams)
|
||||
{
|
||||
stream.Dispose();
|
||||
}
|
||||
}
|
||||
|
||||
#region Manifest Parsing Tests
|
||||
|
||||
[Fact]
|
||||
public async Task ReadAsync_ValidBundle_ParsesManifest()
|
||||
{
|
||||
// Arrange
|
||||
var manifest = CreateTestManifest("test-site", 5, 10, 2);
|
||||
var bundleStream = await CreateTestBundleAsync(manifest, 5, 10, 2);
|
||||
|
||||
// Act
|
||||
using var reader = await BundleReader.ReadAsync(bundleStream);
|
||||
|
||||
// Assert
|
||||
reader.Manifest.Should().NotBeNull();
|
||||
reader.Manifest.SiteId.Should().Be("test-site");
|
||||
reader.Manifest.Counts.Canonicals.Should().Be(5);
|
||||
reader.Manifest.Counts.Edges.Should().Be(10);
|
||||
reader.Manifest.Counts.Deletions.Should().Be(2);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task ReadAsync_ManifestWithAllFields_ParsesCorrectly()
|
||||
{
|
||||
// Arrange
|
||||
var manifest = new BundleManifest
|
||||
{
|
||||
Version = "feedser-bundle/1.0",
|
||||
SiteId = "production-site",
|
||||
ExportCursor = "2025-01-15T10:30:00.000Z#0042",
|
||||
SinceCursor = "2025-01-14T00:00:00.000Z#0000",
|
||||
ExportedAt = DateTimeOffset.Parse("2025-01-15T10:30:15Z"),
|
||||
BundleHash = "sha256:abcdef123456",
|
||||
Counts = new BundleCounts { Canonicals = 100, Edges = 250, Deletions = 5 }
|
||||
};
|
||||
var bundleStream = await CreateTestBundleAsync(manifest, 0, 0, 0);
|
||||
|
||||
// Act
|
||||
using var reader = await BundleReader.ReadAsync(bundleStream);
|
||||
|
||||
// Assert
|
||||
reader.Manifest.Version.Should().Be("feedser-bundle/1.0");
|
||||
reader.Manifest.ExportCursor.Should().Be("2025-01-15T10:30:00.000Z#0042");
|
||||
reader.Manifest.SinceCursor.Should().Be("2025-01-14T00:00:00.000Z#0000");
|
||||
reader.Manifest.BundleHash.Should().Be("sha256:abcdef123456");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task ReadAsync_MissingManifest_ThrowsInvalidDataException()
|
||||
{
|
||||
// Arrange - create bundle without manifest
|
||||
var bundleStream = await CreateBundleWithoutManifestAsync();
|
||||
|
||||
// Act & Assert
|
||||
await Assert.ThrowsAsync<InvalidDataException>(
|
||||
() => BundleReader.ReadAsync(bundleStream));
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task ReadAsync_InvalidManifestVersion_ThrowsInvalidDataException()
|
||||
{
|
||||
// Arrange
|
||||
var manifest = CreateTestManifest("test-site", 0, 0, 0);
|
||||
manifest = manifest with { Version = "invalid-version" };
|
||||
var bundleStream = await CreateTestBundleAsync(manifest, 0, 0, 0);
|
||||
|
||||
// Act & Assert
|
||||
await Assert.ThrowsAsync<InvalidDataException>(
|
||||
() => BundleReader.ReadAsync(bundleStream));
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task ReadAsync_MissingSiteId_ThrowsInvalidDataException()
|
||||
{
|
||||
// Arrange
|
||||
var manifestJson = JsonSerializer.Serialize(new
|
||||
{
|
||||
version = "feedser-bundle/1.0",
|
||||
// missing site_id
|
||||
export_cursor = "2025-01-15T00:00:00.000Z#0001",
|
||||
bundle_hash = "sha256:test",
|
||||
counts = new { canonicals = 0, edges = 0, deletions = 0 }
|
||||
}, BundleSerializer.Options);
|
||||
|
||||
var bundleStream = await CreateBundleWithRawManifestAsync(manifestJson);
|
||||
|
||||
// Act & Assert
|
||||
await Assert.ThrowsAsync<InvalidDataException>(
|
||||
() => BundleReader.ReadAsync(bundleStream));
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Canonical Streaming Tests
|
||||
|
||||
[Fact]
|
||||
public async Task StreamCanonicalsAsync_ValidBundle_StreamsAllCanonicals()
|
||||
{
|
||||
// Arrange
|
||||
var manifest = CreateTestManifest("test-site", 5, 0, 0);
|
||||
var bundleStream = await CreateTestBundleAsync(manifest, 5, 0, 0);
|
||||
|
||||
// Act
|
||||
using var reader = await BundleReader.ReadAsync(bundleStream);
|
||||
var canonicals = await reader.StreamCanonicalsAsync().ToListAsync();
|
||||
|
||||
// Assert
|
||||
canonicals.Should().HaveCount(5);
|
||||
canonicals.Select(c => c.Cve).Should().Contain("CVE-2024-0001");
|
||||
canonicals.Select(c => c.Cve).Should().Contain("CVE-2024-0005");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task StreamCanonicalsAsync_EmptyBundle_ReturnsEmpty()
|
||||
{
|
||||
// Arrange
|
||||
var manifest = CreateTestManifest("test-site", 0, 0, 0);
|
||||
var bundleStream = await CreateTestBundleAsync(manifest, 0, 0, 0);
|
||||
|
||||
// Act
|
||||
using var reader = await BundleReader.ReadAsync(bundleStream);
|
||||
var canonicals = await reader.StreamCanonicalsAsync().ToListAsync();
|
||||
|
||||
// Assert
|
||||
canonicals.Should().BeEmpty();
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task StreamCanonicalsAsync_PreservesAllFields()
|
||||
{
|
||||
// Arrange
|
||||
var manifest = CreateTestManifest("test-site", 1, 0, 0);
|
||||
var bundleStream = await CreateTestBundleAsync(manifest, 1, 0, 0);
|
||||
|
||||
// Act
|
||||
using var reader = await BundleReader.ReadAsync(bundleStream);
|
||||
var canonicals = await reader.StreamCanonicalsAsync().ToListAsync();
|
||||
|
||||
// Assert
|
||||
var canonical = canonicals.Single();
|
||||
canonical.Id.Should().NotBeEmpty();
|
||||
canonical.Cve.Should().Be("CVE-2024-0001");
|
||||
canonical.AffectsKey.Should().Contain("pkg:");
|
||||
canonical.MergeHash.Should().StartWith("sha256:");
|
||||
canonical.Status.Should().Be("active");
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Edge Streaming Tests
|
||||
|
||||
[Fact]
|
||||
public async Task StreamEdgesAsync_ValidBundle_StreamsAllEdges()
|
||||
{
|
||||
// Arrange
|
||||
var manifest = CreateTestManifest("test-site", 0, 3, 0);
|
||||
var bundleStream = await CreateTestBundleAsync(manifest, 0, 3, 0);
|
||||
|
||||
// Act
|
||||
using var reader = await BundleReader.ReadAsync(bundleStream);
|
||||
var edges = await reader.StreamEdgesAsync().ToListAsync();
|
||||
|
||||
// Assert
|
||||
edges.Should().HaveCount(3);
|
||||
edges.All(e => e.Source == "nvd").Should().BeTrue();
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task StreamEdgesAsync_PreservesAllFields()
|
||||
{
|
||||
// Arrange
|
||||
var manifest = CreateTestManifest("test-site", 0, 1, 0);
|
||||
var bundleStream = await CreateTestBundleAsync(manifest, 0, 1, 0);
|
||||
|
||||
// Act
|
||||
using var reader = await BundleReader.ReadAsync(bundleStream);
|
||||
var edges = await reader.StreamEdgesAsync().ToListAsync();
|
||||
|
||||
// Assert
|
||||
var edge = edges.Single();
|
||||
edge.Id.Should().NotBeEmpty();
|
||||
edge.CanonicalId.Should().NotBeEmpty();
|
||||
edge.Source.Should().Be("nvd");
|
||||
edge.SourceAdvisoryId.Should().NotBeNullOrEmpty();
|
||||
edge.ContentHash.Should().StartWith("sha256:");
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Deletion Streaming Tests
|
||||
|
||||
[Fact]
|
||||
public async Task StreamDeletionsAsync_ValidBundle_StreamsAllDeletions()
|
||||
{
|
||||
// Arrange
|
||||
var manifest = CreateTestManifest("test-site", 0, 0, 4);
|
||||
var bundleStream = await CreateTestBundleAsync(manifest, 0, 0, 4);
|
||||
|
||||
// Act
|
||||
using var reader = await BundleReader.ReadAsync(bundleStream);
|
||||
var deletions = await reader.StreamDeletionsAsync().ToListAsync();
|
||||
|
||||
// Assert
|
||||
deletions.Should().HaveCount(4);
|
||||
deletions.All(d => d.Reason == "rejected").Should().BeTrue();
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Entry Names Tests
|
||||
|
||||
[Fact]
|
||||
public async Task GetEntryNamesAsync_ValidBundle_ReturnsAllEntries()
|
||||
{
|
||||
// Arrange
|
||||
var manifest = CreateTestManifest("test-site", 1, 1, 1);
|
||||
var bundleStream = await CreateTestBundleAsync(manifest, 1, 1, 1);
|
||||
|
||||
// Act
|
||||
using var reader = await BundleReader.ReadAsync(bundleStream);
|
||||
var entries = await reader.GetEntryNamesAsync();
|
||||
|
||||
// Assert
|
||||
entries.Should().Contain("MANIFEST.json");
|
||||
entries.Should().Contain("canonicals.ndjson");
|
||||
entries.Should().Contain("edges.ndjson");
|
||||
entries.Should().Contain("deletions.ndjson");
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Helper Methods
|
||||
|
||||
private static BundleManifest CreateTestManifest(string siteId, int canonicals, int edges, int deletions)
|
||||
{
|
||||
return new BundleManifest
|
||||
{
|
||||
Version = "feedser-bundle/1.0",
|
||||
SiteId = siteId,
|
||||
ExportCursor = $"{DateTimeOffset.UtcNow:O}#0001",
|
||||
ExportedAt = DateTimeOffset.UtcNow,
|
||||
BundleHash = $"sha256:test{Guid.NewGuid():N}",
|
||||
Counts = new BundleCounts
|
||||
{
|
||||
Canonicals = canonicals,
|
||||
Edges = edges,
|
||||
Deletions = deletions
|
||||
}
|
||||
};
|
||||
}
|
||||
|
||||
private async Task<Stream> CreateTestBundleAsync(
|
||||
BundleManifest manifest,
|
||||
int canonicalCount,
|
||||
int edgeCount,
|
||||
int deletionCount)
|
||||
{
|
||||
var tarBuffer = new MemoryStream();
|
||||
|
||||
await using (var tarWriter = new TarWriter(tarBuffer, leaveOpen: true))
|
||||
{
|
||||
// Write manifest
|
||||
var manifestJson = JsonSerializer.Serialize(manifest, BundleSerializer.Options);
|
||||
await WriteEntryAsync(tarWriter, "MANIFEST.json", manifestJson);
|
||||
|
||||
// Write canonicals
|
||||
var canonicalsNdjson = new StringBuilder();
|
||||
for (var i = 1; i <= canonicalCount; i++)
|
||||
{
|
||||
var canonical = new CanonicalBundleLine
|
||||
{
|
||||
Id = Guid.NewGuid(),
|
||||
Cve = $"CVE-2024-{i:D4}",
|
||||
AffectsKey = $"pkg:generic/test{i}@1.0",
|
||||
MergeHash = $"sha256:hash{i}",
|
||||
Status = "active",
|
||||
Title = $"Test Advisory {i}",
|
||||
UpdatedAt = DateTimeOffset.UtcNow
|
||||
};
|
||||
canonicalsNdjson.AppendLine(JsonSerializer.Serialize(canonical, BundleSerializer.Options));
|
||||
}
|
||||
await WriteEntryAsync(tarWriter, "canonicals.ndjson", canonicalsNdjson.ToString());
|
||||
|
||||
// Write edges
|
||||
var edgesNdjson = new StringBuilder();
|
||||
for (var i = 1; i <= edgeCount; i++)
|
||||
{
|
||||
var edge = new EdgeBundleLine
|
||||
{
|
||||
Id = Guid.NewGuid(),
|
||||
CanonicalId = Guid.NewGuid(),
|
||||
Source = "nvd",
|
||||
SourceAdvisoryId = $"CVE-2024-{i:D4}",
|
||||
ContentHash = $"sha256:edge{i}",
|
||||
UpdatedAt = DateTimeOffset.UtcNow
|
||||
};
|
||||
edgesNdjson.AppendLine(JsonSerializer.Serialize(edge, BundleSerializer.Options));
|
||||
}
|
||||
await WriteEntryAsync(tarWriter, "edges.ndjson", edgesNdjson.ToString());
|
||||
|
||||
// Write deletions
|
||||
var deletionsNdjson = new StringBuilder();
|
||||
for (var i = 1; i <= deletionCount; i++)
|
||||
{
|
||||
var deletion = new DeletionBundleLine
|
||||
{
|
||||
CanonicalId = Guid.NewGuid(),
|
||||
Reason = "rejected",
|
||||
DeletedAt = DateTimeOffset.UtcNow
|
||||
};
|
||||
deletionsNdjson.AppendLine(JsonSerializer.Serialize(deletion, BundleSerializer.Options));
|
||||
}
|
||||
await WriteEntryAsync(tarWriter, "deletions.ndjson", deletionsNdjson.ToString());
|
||||
}
|
||||
|
||||
tarBuffer.Position = 0;
|
||||
|
||||
// Compress with ZST
|
||||
var compressedBuffer = new MemoryStream();
|
||||
await ZstdCompression.CompressAsync(tarBuffer, compressedBuffer);
|
||||
compressedBuffer.Position = 0;
|
||||
|
||||
_disposableStreams.Add(compressedBuffer);
|
||||
return compressedBuffer;
|
||||
}
|
||||
|
||||
private async Task<Stream> CreateBundleWithoutManifestAsync()
|
||||
{
|
||||
var tarBuffer = new MemoryStream();
|
||||
|
||||
await using (var tarWriter = new TarWriter(tarBuffer, leaveOpen: true))
|
||||
{
|
||||
// Only write canonicals, no manifest
|
||||
await WriteEntryAsync(tarWriter, "canonicals.ndjson", "");
|
||||
}
|
||||
|
||||
tarBuffer.Position = 0;
|
||||
|
||||
var compressedBuffer = new MemoryStream();
|
||||
await ZstdCompression.CompressAsync(tarBuffer, compressedBuffer);
|
||||
compressedBuffer.Position = 0;
|
||||
|
||||
_disposableStreams.Add(compressedBuffer);
|
||||
return compressedBuffer;
|
||||
}
|
||||
|
||||
private async Task<Stream> CreateBundleWithRawManifestAsync(string manifestJson)
|
||||
{
|
||||
var tarBuffer = new MemoryStream();
|
||||
|
||||
await using (var tarWriter = new TarWriter(tarBuffer, leaveOpen: true))
|
||||
{
|
||||
await WriteEntryAsync(tarWriter, "MANIFEST.json", manifestJson);
|
||||
await WriteEntryAsync(tarWriter, "canonicals.ndjson", "");
|
||||
await WriteEntryAsync(tarWriter, "edges.ndjson", "");
|
||||
await WriteEntryAsync(tarWriter, "deletions.ndjson", "");
|
||||
}
|
||||
|
||||
tarBuffer.Position = 0;
|
||||
|
||||
var compressedBuffer = new MemoryStream();
|
||||
await ZstdCompression.CompressAsync(tarBuffer, compressedBuffer);
|
||||
compressedBuffer.Position = 0;
|
||||
|
||||
_disposableStreams.Add(compressedBuffer);
|
||||
return compressedBuffer;
|
||||
}
|
||||
|
||||
private static async Task WriteEntryAsync(TarWriter tarWriter, string name, string content)
|
||||
{
|
||||
var bytes = Encoding.UTF8.GetBytes(content);
|
||||
var entry = new PaxTarEntry(TarEntryType.RegularFile, name)
|
||||
{
|
||||
DataStream = new MemoryStream(bytes)
|
||||
};
|
||||
await tarWriter.WriteEntryAsync(entry);
|
||||
}
|
||||
|
||||
#endregion
|
||||
}
|
||||
@@ -0,0 +1,390 @@
|
||||
// -----------------------------------------------------------------------------
|
||||
// BundleVerifierTests.cs
|
||||
// Sprint: SPRINT_8200_0014_0003_CONCEL_bundle_import_merge
|
||||
// Task: IMPORT-8200-011
|
||||
// Description: Tests for bundle verification failures (bad hash, invalid sig, policy violation)
|
||||
// -----------------------------------------------------------------------------
|
||||
|
||||
using FluentAssertions;
|
||||
using Microsoft.Extensions.Logging;
|
||||
using Microsoft.Extensions.Logging.Abstractions;
|
||||
using Microsoft.Extensions.Options;
|
||||
using Moq;
|
||||
using StellaOps.Concelier.Federation.Compression;
|
||||
using StellaOps.Concelier.Federation.Import;
|
||||
using StellaOps.Concelier.Federation.Models;
|
||||
using StellaOps.Concelier.Federation.Serialization;
|
||||
using StellaOps.Concelier.Federation.Signing;
|
||||
using System.Formats.Tar;
|
||||
using System.Text;
|
||||
using System.Text.Json;
|
||||
|
||||
namespace StellaOps.Concelier.Federation.Tests.Import;
|
||||
|
||||
/// <summary>
|
||||
/// Tests for BundleVerifier verification failures.
|
||||
/// </summary>
|
||||
public sealed class BundleVerifierTests : IDisposable
|
||||
{
|
||||
private readonly Mock<IBundleSigner> _signerMock;
|
||||
private readonly IOptions<FederationImportOptions> _options;
|
||||
private readonly ILogger<BundleVerifier> _logger;
|
||||
private readonly List<Stream> _disposableStreams = [];
|
||||
|
||||
public BundleVerifierTests()
|
||||
{
|
||||
_signerMock = new Mock<IBundleSigner>();
|
||||
_options = Options.Create(new FederationImportOptions());
|
||||
_logger = NullLogger<BundleVerifier>.Instance;
|
||||
}
|
||||
|
||||
public void Dispose()
|
||||
{
|
||||
foreach (var stream in _disposableStreams)
|
||||
{
|
||||
stream.Dispose();
|
||||
}
|
||||
}
|
||||
|
||||
#region Hash Verification Tests
|
||||
|
||||
[Fact]
|
||||
public async Task VerifyAsync_ValidHash_ReturnsValid()
|
||||
{
|
||||
// Arrange
|
||||
var manifest = CreateTestManifest("test-site", 2);
|
||||
var bundleStream = await CreateTestBundleAsync(manifest, 2);
|
||||
using var reader = await BundleReader.ReadAsync(bundleStream);
|
||||
|
||||
var verifier = new BundleVerifier(_signerMock.Object, _options, _logger);
|
||||
SetupSignerToSkip();
|
||||
|
||||
// Act
|
||||
var result = await verifier.VerifyAsync(reader, skipSignature: true);
|
||||
|
||||
// Assert
|
||||
result.HashValid.Should().BeTrue();
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task VerifyHashAsync_MatchingHash_ReturnsTrue()
|
||||
{
|
||||
// Arrange
|
||||
var manifest = CreateTestManifest("test-site", 1);
|
||||
var bundleStream = await CreateTestBundleAsync(manifest, 1);
|
||||
using var reader = await BundleReader.ReadAsync(bundleStream);
|
||||
|
||||
var verifier = new BundleVerifier(_signerMock.Object, _options, _logger);
|
||||
|
||||
// Act
|
||||
var isValid = await verifier.VerifyHashAsync(reader);
|
||||
|
||||
// Assert - the test bundle uses a placeholder hash, so we expect false
|
||||
// In production, the hash would be computed and matched
|
||||
isValid.Should().BeFalse(); // Test bundle has placeholder hash
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Signature Verification Tests
|
||||
|
||||
[Fact]
|
||||
public async Task VerifyAsync_SkipSignature_ReturnsValidWithoutSignatureCheck()
|
||||
{
|
||||
// Arrange
|
||||
var manifest = CreateTestManifest("test-site", 1);
|
||||
var bundleStream = await CreateTestBundleAsync(manifest, 1);
|
||||
using var reader = await BundleReader.ReadAsync(bundleStream);
|
||||
|
||||
var verifier = new BundleVerifier(_signerMock.Object, _options, _logger);
|
||||
|
||||
// Act
|
||||
var result = await verifier.VerifyAsync(reader, skipSignature: true);
|
||||
|
||||
// Assert
|
||||
result.SignatureValid.Should().BeTrue();
|
||||
result.SignatureResult.Should().BeNull(); // Skipped
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task VerifySignatureAsync_ValidSignature_ReturnsSuccess()
|
||||
{
|
||||
// Arrange
|
||||
var manifest = CreateTestManifest("test-site", 1);
|
||||
var bundleStream = await CreateTestBundleWithSignatureAsync(manifest, 1);
|
||||
using var reader = await BundleReader.ReadAsync(bundleStream);
|
||||
|
||||
_signerMock
|
||||
.Setup(x => x.VerifyBundleAsync(
|
||||
It.IsAny<string>(),
|
||||
It.IsAny<BundleSignature>(),
|
||||
It.IsAny<CancellationToken>()))
|
||||
.ReturnsAsync(new BundleVerificationResult { IsValid = true, SignerIdentity = "test-key" });
|
||||
|
||||
var verifier = new BundleVerifier(_signerMock.Object, _options, _logger);
|
||||
|
||||
// Act
|
||||
var result = await verifier.VerifySignatureAsync(reader);
|
||||
|
||||
// Assert
|
||||
result.IsValid.Should().BeTrue();
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task VerifySignatureAsync_InvalidSignature_ReturnsFailure()
|
||||
{
|
||||
// Arrange
|
||||
var manifest = CreateTestManifest("test-site", 1);
|
||||
var bundleStream = await CreateTestBundleWithSignatureAsync(manifest, 1);
|
||||
using var reader = await BundleReader.ReadAsync(bundleStream);
|
||||
|
||||
_signerMock
|
||||
.Setup(x => x.VerifyBundleAsync(
|
||||
It.IsAny<string>(),
|
||||
It.IsAny<BundleSignature>(),
|
||||
It.IsAny<CancellationToken>()))
|
||||
.ReturnsAsync(new BundleVerificationResult { IsValid = false, ErrorMessage = "Signature mismatch" });
|
||||
|
||||
var verifier = new BundleVerifier(_signerMock.Object, _options, _logger);
|
||||
|
||||
// Act
|
||||
var result = await verifier.VerifySignatureAsync(reader);
|
||||
|
||||
// Assert
|
||||
result.IsValid.Should().BeFalse();
|
||||
result.Error.Should().Contain("Signature");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task VerifySignatureAsync_MissingSignature_ReturnsFailure()
|
||||
{
|
||||
// Arrange - bundle without signature
|
||||
var manifest = CreateTestManifest("test-site", 1);
|
||||
var bundleStream = await CreateTestBundleAsync(manifest, 1);
|
||||
using var reader = await BundleReader.ReadAsync(bundleStream);
|
||||
|
||||
var verifier = new BundleVerifier(_signerMock.Object, _options, _logger);
|
||||
|
||||
// Act
|
||||
var result = await verifier.VerifySignatureAsync(reader);
|
||||
|
||||
// Assert
|
||||
result.IsValid.Should().BeFalse();
|
||||
result.Error.Should().Contain("signature");
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Validation Result Tests
|
||||
|
||||
[Fact]
|
||||
public void BundleValidationResult_Success_HasValidManifest()
|
||||
{
|
||||
// Arrange
|
||||
var manifest = CreateTestManifest("site", 1);
|
||||
|
||||
// Act
|
||||
var result = BundleValidationResult.Success(manifest);
|
||||
|
||||
// Assert
|
||||
result.IsValid.Should().BeTrue();
|
||||
result.Manifest.Should().NotBeNull();
|
||||
result.Errors.Should().BeEmpty();
|
||||
result.HashValid.Should().BeTrue();
|
||||
result.SignatureValid.Should().BeTrue();
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void BundleValidationResult_Failure_HasErrors()
|
||||
{
|
||||
// Act
|
||||
var result = BundleValidationResult.Failure("Hash mismatch", "Invalid cursor");
|
||||
|
||||
// Assert
|
||||
result.IsValid.Should().BeFalse();
|
||||
result.Errors.Should().HaveCount(2);
|
||||
result.Errors.Should().Contain("Hash mismatch");
|
||||
result.Errors.Should().Contain("Invalid cursor");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void SignatureVerificationResult_Success_HasKeyId()
|
||||
{
|
||||
// Act
|
||||
var result = SignatureVerificationResult.Success("key-001", "ES256", "issuer.example.com");
|
||||
|
||||
// Assert
|
||||
result.IsValid.Should().BeTrue();
|
||||
result.KeyId.Should().Be("key-001");
|
||||
result.Algorithm.Should().Be("ES256");
|
||||
result.Issuer.Should().Be("issuer.example.com");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void SignatureVerificationResult_Failure_HasError()
|
||||
{
|
||||
// Act
|
||||
var result = SignatureVerificationResult.Failure("Certificate expired");
|
||||
|
||||
// Assert
|
||||
result.IsValid.Should().BeFalse();
|
||||
result.Error.Should().Be("Certificate expired");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void SignatureVerificationResult_Skipped_IsValidWithNote()
|
||||
{
|
||||
// Act
|
||||
var result = SignatureVerificationResult.Skipped();
|
||||
|
||||
// Assert
|
||||
result.IsValid.Should().BeTrue();
|
||||
result.Error.Should().Contain("skipped");
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Policy Enforcement Tests
|
||||
|
||||
[Fact]
|
||||
public async Task VerifyAsync_ValidBundle_PassesPolicyCheck()
|
||||
{
|
||||
// Arrange
|
||||
var manifest = CreateTestManifest("allowed-site", 1);
|
||||
var bundleStream = await CreateTestBundleAsync(manifest, 1);
|
||||
using var reader = await BundleReader.ReadAsync(bundleStream);
|
||||
|
||||
var verifier = new BundleVerifier(_signerMock.Object, _options, _logger);
|
||||
|
||||
// Act
|
||||
var result = await verifier.VerifyAsync(reader, skipSignature: true);
|
||||
|
||||
// Assert
|
||||
result.IsValid.Should().BeTrue();
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Helper Methods
|
||||
|
||||
private void SetupSignerToSkip()
|
||||
{
|
||||
_signerMock
|
||||
.Setup(x => x.VerifyBundleAsync(
|
||||
It.IsAny<string>(),
|
||||
It.IsAny<BundleSignature>(),
|
||||
It.IsAny<CancellationToken>()))
|
||||
.ReturnsAsync(new BundleVerificationResult { IsValid = true });
|
||||
}
|
||||
|
||||
private static BundleManifest CreateTestManifest(string siteId, int canonicals)
|
||||
{
|
||||
return new BundleManifest
|
||||
{
|
||||
Version = "feedser-bundle/1.0",
|
||||
SiteId = siteId,
|
||||
ExportCursor = $"{DateTimeOffset.UtcNow:O}#0001",
|
||||
ExportedAt = DateTimeOffset.UtcNow,
|
||||
BundleHash = $"sha256:test{Guid.NewGuid():N}",
|
||||
Counts = new BundleCounts { Canonicals = canonicals }
|
||||
};
|
||||
}
|
||||
|
||||
private async Task<Stream> CreateTestBundleAsync(BundleManifest manifest, int canonicalCount)
|
||||
{
|
||||
var tarBuffer = new MemoryStream();
|
||||
|
||||
await using (var tarWriter = new TarWriter(tarBuffer, leaveOpen: true))
|
||||
{
|
||||
var manifestJson = JsonSerializer.Serialize(manifest, BundleSerializer.Options);
|
||||
await WriteEntryAsync(tarWriter, "MANIFEST.json", manifestJson);
|
||||
|
||||
var canonicalsNdjson = new StringBuilder();
|
||||
for (var i = 1; i <= canonicalCount; i++)
|
||||
{
|
||||
var canonical = new CanonicalBundleLine
|
||||
{
|
||||
Id = Guid.NewGuid(),
|
||||
Cve = $"CVE-2024-{i:D4}",
|
||||
AffectsKey = $"pkg:generic/test{i}@1.0",
|
||||
MergeHash = $"sha256:hash{i}",
|
||||
Status = "active",
|
||||
UpdatedAt = DateTimeOffset.UtcNow
|
||||
};
|
||||
canonicalsNdjson.AppendLine(JsonSerializer.Serialize(canonical, BundleSerializer.Options));
|
||||
}
|
||||
await WriteEntryAsync(tarWriter, "canonicals.ndjson", canonicalsNdjson.ToString());
|
||||
await WriteEntryAsync(tarWriter, "edges.ndjson", "");
|
||||
await WriteEntryAsync(tarWriter, "deletions.ndjson", "");
|
||||
}
|
||||
|
||||
tarBuffer.Position = 0;
|
||||
|
||||
var compressedBuffer = new MemoryStream();
|
||||
await ZstdCompression.CompressAsync(tarBuffer, compressedBuffer);
|
||||
compressedBuffer.Position = 0;
|
||||
|
||||
_disposableStreams.Add(compressedBuffer);
|
||||
return compressedBuffer;
|
||||
}
|
||||
|
||||
private async Task<Stream> CreateTestBundleWithSignatureAsync(BundleManifest manifest, int canonicalCount)
|
||||
{
|
||||
var tarBuffer = new MemoryStream();
|
||||
|
||||
await using (var tarWriter = new TarWriter(tarBuffer, leaveOpen: true))
|
||||
{
|
||||
var manifestJson = JsonSerializer.Serialize(manifest, BundleSerializer.Options);
|
||||
await WriteEntryAsync(tarWriter, "MANIFEST.json", manifestJson);
|
||||
|
||||
var canonicalsNdjson = new StringBuilder();
|
||||
for (var i = 1; i <= canonicalCount; i++)
|
||||
{
|
||||
var canonical = new CanonicalBundleLine
|
||||
{
|
||||
Id = Guid.NewGuid(),
|
||||
Cve = $"CVE-2024-{i:D4}",
|
||||
AffectsKey = $"pkg:generic/test{i}@1.0",
|
||||
MergeHash = $"sha256:hash{i}",
|
||||
Status = "active",
|
||||
UpdatedAt = DateTimeOffset.UtcNow
|
||||
};
|
||||
canonicalsNdjson.AppendLine(JsonSerializer.Serialize(canonical, BundleSerializer.Options));
|
||||
}
|
||||
await WriteEntryAsync(tarWriter, "canonicals.ndjson", canonicalsNdjson.ToString());
|
||||
await WriteEntryAsync(tarWriter, "edges.ndjson", "");
|
||||
await WriteEntryAsync(tarWriter, "deletions.ndjson", "");
|
||||
|
||||
// Add signature
|
||||
var signature = new BundleSignature
|
||||
{
|
||||
PayloadType = "application/stellaops.federation.bundle+json",
|
||||
Payload = "test-payload",
|
||||
Signatures = [new SignatureEntry { KeyId = "test-key", Algorithm = "ES256", Signature = "test-sig" }]
|
||||
};
|
||||
var signatureJson = JsonSerializer.Serialize(signature, BundleSerializer.Options);
|
||||
await WriteEntryAsync(tarWriter, "SIGNATURE.json", signatureJson);
|
||||
}
|
||||
|
||||
tarBuffer.Position = 0;
|
||||
|
||||
var compressedBuffer = new MemoryStream();
|
||||
await ZstdCompression.CompressAsync(tarBuffer, compressedBuffer);
|
||||
compressedBuffer.Position = 0;
|
||||
|
||||
_disposableStreams.Add(compressedBuffer);
|
||||
return compressedBuffer;
|
||||
}
|
||||
|
||||
private static async Task WriteEntryAsync(TarWriter tarWriter, string name, string content)
|
||||
{
|
||||
var bytes = Encoding.UTF8.GetBytes(content);
|
||||
var entry = new PaxTarEntry(TarEntryType.RegularFile, name)
|
||||
{
|
||||
DataStream = new MemoryStream(bytes)
|
||||
};
|
||||
await tarWriter.WriteEntryAsync(entry);
|
||||
}
|
||||
|
||||
#endregion
|
||||
}
|
||||
@@ -0,0 +1,353 @@
|
||||
// -----------------------------------------------------------------------------
|
||||
// BundleSerializerTests.cs
|
||||
// Sprint: SPRINT_8200_0014_0002_CONCEL_delta_bundle_export
|
||||
// Task: EXPORT-8200-008
|
||||
// Description: Unit tests for bundle serialization and compression
|
||||
// -----------------------------------------------------------------------------
|
||||
|
||||
using FluentAssertions;
|
||||
using StellaOps.Concelier.Federation.Compression;
|
||||
using StellaOps.Concelier.Federation.Models;
|
||||
using StellaOps.Concelier.Federation.Serialization;
|
||||
|
||||
namespace StellaOps.Concelier.Federation.Tests.Serialization;
|
||||
|
||||
/// <summary>
|
||||
/// Tests for BundleSerializer NDJSON serialization and ZST compression.
|
||||
/// </summary>
|
||||
public sealed class BundleSerializerTests
|
||||
{
|
||||
#region Manifest Serialization
|
||||
|
||||
[Fact]
|
||||
public void SerializeManifest_ValidManifest_ProducesValidJson()
|
||||
{
|
||||
// Arrange
|
||||
var manifest = new BundleManifest
|
||||
{
|
||||
Version = "feedser-bundle/1.0",
|
||||
SiteId = "site-test-01",
|
||||
ExportCursor = "2025-01-15T10:30:00.000Z#0001",
|
||||
SinceCursor = "2025-01-14T10:30:00.000Z#0000",
|
||||
ExportedAt = DateTimeOffset.Parse("2025-01-15T10:30:00Z"),
|
||||
BundleHash = "sha256:abc123def456",
|
||||
Counts = new BundleCounts
|
||||
{
|
||||
Canonicals = 100,
|
||||
Edges = 250,
|
||||
Deletions = 5
|
||||
}
|
||||
};
|
||||
|
||||
// Act
|
||||
var bytes = BundleSerializer.SerializeManifest(manifest);
|
||||
var json = System.Text.Encoding.UTF8.GetString(bytes);
|
||||
|
||||
// Assert
|
||||
json.Should().Contain("\"version\"");
|
||||
json.Should().Contain("\"site_id\"");
|
||||
json.Should().Contain("\"export_cursor\"");
|
||||
json.Should().Contain("\"bundle_hash\"");
|
||||
json.Should().Contain("feedser-bundle/1.0");
|
||||
json.Should().Contain("site-test-01");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void DeserializeManifest_ValidJson_ParsesCorrectly()
|
||||
{
|
||||
// Arrange
|
||||
var manifest = new BundleManifest
|
||||
{
|
||||
Version = "feedser-bundle/1.0",
|
||||
SiteId = "roundtrip-test",
|
||||
ExportCursor = "2025-01-15T10:00:00.000Z#0042",
|
||||
ExportedAt = DateTimeOffset.UtcNow,
|
||||
BundleHash = "sha256:test123",
|
||||
Counts = new BundleCounts { Canonicals = 50 }
|
||||
};
|
||||
|
||||
var bytes = BundleSerializer.SerializeManifest(manifest);
|
||||
|
||||
// Act
|
||||
var parsed = BundleSerializer.DeserializeManifest(bytes);
|
||||
|
||||
// Assert
|
||||
parsed.Should().NotBeNull();
|
||||
parsed!.Version.Should().Be("feedser-bundle/1.0");
|
||||
parsed.SiteId.Should().Be("roundtrip-test");
|
||||
parsed.ExportCursor.Should().Be("2025-01-15T10:00:00.000Z#0042");
|
||||
parsed.Counts.Canonicals.Should().Be(50);
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Canonical Line Serialization
|
||||
|
||||
[Fact]
|
||||
public void SerializeCanonicalLine_ValidCanonical_ProducesNdjsonLine()
|
||||
{
|
||||
// Arrange
|
||||
var canonical = new CanonicalBundleLine
|
||||
{
|
||||
Id = Guid.NewGuid(),
|
||||
Cve = "CVE-2024-1234",
|
||||
AffectsKey = "pkg:deb/debian/openssl@1.1.1",
|
||||
MergeHash = "sha256:merge123",
|
||||
Status = "active",
|
||||
Title = "Test Advisory",
|
||||
Severity = "high",
|
||||
UpdatedAt = DateTimeOffset.UtcNow
|
||||
};
|
||||
|
||||
// Act
|
||||
var bytes = BundleSerializer.SerializeCanonicalLine(canonical);
|
||||
var line = System.Text.Encoding.UTF8.GetString(bytes);
|
||||
|
||||
// Assert
|
||||
line.Should().NotContain("\n"); // Single line
|
||||
line.Should().Contain("\"cve\"");
|
||||
line.Should().Contain("CVE-2024-1234");
|
||||
line.Should().Contain("\"merge_hash\"");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void DeserializeCanonicalLine_ValidLine_ParsesCorrectly()
|
||||
{
|
||||
// Arrange
|
||||
var original = new CanonicalBundleLine
|
||||
{
|
||||
Id = Guid.NewGuid(),
|
||||
Cve = "CVE-2024-5678",
|
||||
AffectsKey = "pkg:rpm/redhat/nginx@1.20",
|
||||
MergeHash = "sha256:abc",
|
||||
Status = "active",
|
||||
Title = "Roundtrip Test",
|
||||
Severity = "critical",
|
||||
UpdatedAt = DateTimeOffset.Parse("2025-01-15T12:00:00Z")
|
||||
};
|
||||
|
||||
var bytes = BundleSerializer.SerializeCanonicalLine(original);
|
||||
|
||||
// Act
|
||||
var parsed = BundleSerializer.DeserializeCanonicalLine(bytes);
|
||||
|
||||
// Assert
|
||||
parsed.Should().NotBeNull();
|
||||
parsed!.Cve.Should().Be("CVE-2024-5678");
|
||||
parsed.MergeHash.Should().Be("sha256:abc");
|
||||
parsed.Severity.Should().Be("critical");
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Edge Line Serialization
|
||||
|
||||
[Fact]
|
||||
public void SerializeEdgeLine_ValidEdge_ProducesNdjsonLine()
|
||||
{
|
||||
// Arrange
|
||||
var edge = new EdgeBundleLine
|
||||
{
|
||||
Id = Guid.NewGuid(),
|
||||
CanonicalId = Guid.NewGuid(),
|
||||
Source = "nvd",
|
||||
SourceAdvisoryId = "CVE-2024-1234",
|
||||
ContentHash = "sha256:edge123",
|
||||
UpdatedAt = DateTimeOffset.UtcNow
|
||||
};
|
||||
|
||||
// Act
|
||||
var bytes = BundleSerializer.SerializeEdgeLine(edge);
|
||||
var line = System.Text.Encoding.UTF8.GetString(bytes);
|
||||
|
||||
// Assert
|
||||
line.Should().NotContain("\n");
|
||||
line.Should().Contain("\"source\"");
|
||||
line.Should().Contain("\"source_advisory_id\"");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void DeserializeEdgeLine_ValidLine_ParsesCorrectly()
|
||||
{
|
||||
// Arrange
|
||||
var original = new EdgeBundleLine
|
||||
{
|
||||
Id = Guid.NewGuid(),
|
||||
CanonicalId = Guid.NewGuid(),
|
||||
Source = "debian",
|
||||
SourceAdvisoryId = "DSA-5432",
|
||||
ContentHash = "sha256:debianhash",
|
||||
UpdatedAt = DateTimeOffset.UtcNow
|
||||
};
|
||||
|
||||
var bytes = BundleSerializer.SerializeEdgeLine(original);
|
||||
|
||||
// Act
|
||||
var parsed = BundleSerializer.DeserializeEdgeLine(bytes);
|
||||
|
||||
// Assert
|
||||
parsed.Should().NotBeNull();
|
||||
parsed!.Source.Should().Be("debian");
|
||||
parsed.SourceAdvisoryId.Should().Be("DSA-5432");
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Deletion Line Serialization
|
||||
|
||||
[Fact]
|
||||
public void SerializeDeletionLine_ValidDeletion_ProducesNdjsonLine()
|
||||
{
|
||||
// Arrange
|
||||
var deletion = new DeletionBundleLine
|
||||
{
|
||||
CanonicalId = Guid.NewGuid(),
|
||||
Reason = "rejected",
|
||||
DeletedAt = DateTimeOffset.UtcNow
|
||||
};
|
||||
|
||||
// Act
|
||||
var bytes = BundleSerializer.SerializeDeletionLine(deletion);
|
||||
var line = System.Text.Encoding.UTF8.GetString(bytes);
|
||||
|
||||
// Assert
|
||||
line.Should().NotContain("\n");
|
||||
line.Should().Contain("\"reason\"");
|
||||
line.Should().Contain("rejected");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void DeserializeDeletionLine_ValidLine_ParsesCorrectly()
|
||||
{
|
||||
// Arrange
|
||||
var original = new DeletionBundleLine
|
||||
{
|
||||
CanonicalId = Guid.NewGuid(),
|
||||
Reason = "duplicate",
|
||||
DeletedAt = DateTimeOffset.UtcNow
|
||||
};
|
||||
|
||||
var bytes = BundleSerializer.SerializeDeletionLine(original);
|
||||
|
||||
// Act
|
||||
var parsed = BundleSerializer.DeserializeDeletionLine(bytes);
|
||||
|
||||
// Assert
|
||||
parsed.Should().NotBeNull();
|
||||
parsed!.Reason.Should().Be("duplicate");
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Compression Tests
|
||||
|
||||
[Fact]
|
||||
public void ZstdCompression_CompressDecompress_Roundtrips()
|
||||
{
|
||||
// Arrange
|
||||
var original = System.Text.Encoding.UTF8.GetBytes(
|
||||
string.Join("\n", Enumerable.Range(1, 100).Select(i => $"Line {i}: Some test data for compression")));
|
||||
|
||||
// Act
|
||||
var compressed = ZstdCompression.Compress(original, level: 3);
|
||||
var decompressed = ZstdCompression.Decompress(compressed);
|
||||
|
||||
// Assert
|
||||
decompressed.Should().BeEquivalentTo(original);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void ZstdCompression_CompressedSmallerThanOriginal()
|
||||
{
|
||||
// Arrange
|
||||
var original = System.Text.Encoding.UTF8.GetBytes(
|
||||
string.Concat(Enumerable.Repeat("Repetitive data for good compression ratio. ", 1000)));
|
||||
|
||||
// Act
|
||||
var compressed = ZstdCompression.Compress(original, level: 3);
|
||||
|
||||
// Assert
|
||||
compressed.Length.Should().BeLessThan(original.Length);
|
||||
}
|
||||
|
||||
[Theory]
|
||||
[InlineData(1)]
|
||||
[InlineData(3)]
|
||||
[InlineData(9)]
|
||||
public void ZstdCompression_DifferentLevels_AllDecompressCorrectly(int level)
|
||||
{
|
||||
// Arrange
|
||||
var original = System.Text.Encoding.UTF8.GetBytes("Test data for various compression levels");
|
||||
|
||||
// Act
|
||||
var compressed = ZstdCompression.Compress(original, level: level);
|
||||
var decompressed = ZstdCompression.Decompress(compressed);
|
||||
|
||||
// Assert
|
||||
decompressed.Should().BeEquivalentTo(original);
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Stream Writing Tests
|
||||
|
||||
[Fact]
|
||||
public async Task WriteCanonicalLineAsync_WritesToStream_WithNewline()
|
||||
{
|
||||
// Arrange
|
||||
using var stream = new MemoryStream();
|
||||
var canonical = new CanonicalBundleLine
|
||||
{
|
||||
Id = Guid.NewGuid(),
|
||||
Cve = "CVE-STREAM-TEST",
|
||||
AffectsKey = "pkg:generic/test@1.0",
|
||||
MergeHash = "sha256:stream",
|
||||
Status = "active",
|
||||
Title = "Stream Test",
|
||||
UpdatedAt = DateTimeOffset.UtcNow
|
||||
};
|
||||
|
||||
// Act
|
||||
await BundleSerializer.WriteCanonicalLineAsync(stream, canonical);
|
||||
stream.Position = 0;
|
||||
var content = System.Text.Encoding.UTF8.GetString(stream.ToArray());
|
||||
|
||||
// Assert
|
||||
content.Should().EndWith("\n");
|
||||
content.Should().Contain("CVE-STREAM-TEST");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task WriteMultipleLines_ProducesValidNdjson()
|
||||
{
|
||||
// Arrange
|
||||
using var stream = new MemoryStream();
|
||||
var canonicals = Enumerable.Range(1, 5).Select(i => new CanonicalBundleLine
|
||||
{
|
||||
Id = Guid.NewGuid(),
|
||||
Cve = $"CVE-2024-{i:D4}",
|
||||
AffectsKey = $"pkg:generic/test{i}@1.0",
|
||||
MergeHash = $"sha256:hash{i}",
|
||||
Status = "active",
|
||||
Title = $"Advisory {i}",
|
||||
UpdatedAt = DateTimeOffset.UtcNow
|
||||
}).ToList();
|
||||
|
||||
// Act
|
||||
foreach (var canonical in canonicals)
|
||||
{
|
||||
await BundleSerializer.WriteCanonicalLineAsync(stream, canonical);
|
||||
}
|
||||
|
||||
stream.Position = 0;
|
||||
var content = System.Text.Encoding.UTF8.GetString(stream.ToArray());
|
||||
var lines = content.Split('\n', StringSplitOptions.RemoveEmptyEntries);
|
||||
|
||||
// Assert
|
||||
lines.Should().HaveCount(5);
|
||||
lines[0].Should().Contain("CVE-2024-0001");
|
||||
lines[4].Should().Contain("CVE-2024-0005");
|
||||
}
|
||||
|
||||
#endregion
|
||||
}
|
||||
@@ -0,0 +1,288 @@
|
||||
// -----------------------------------------------------------------------------
|
||||
// BundleSignatureVerificationTests.cs
|
||||
// Sprint: SPRINT_8200_0014_0002_CONCEL_delta_bundle_export
|
||||
// Task: EXPORT-8200-022
|
||||
// Description: Tests for bundle signature verification
|
||||
// -----------------------------------------------------------------------------
|
||||
|
||||
using FluentAssertions;
|
||||
using Moq;
|
||||
using StellaOps.Concelier.Federation.Models;
|
||||
using StellaOps.Concelier.Federation.Signing;
|
||||
|
||||
namespace StellaOps.Concelier.Federation.Tests.Signing;
|
||||
|
||||
/// <summary>
|
||||
/// Tests for bundle signature verification.
|
||||
/// </summary>
|
||||
public sealed class BundleSignatureVerificationTests
|
||||
{
|
||||
#region Null Signer Tests
|
||||
|
||||
[Fact]
|
||||
public async Task NullBundleSigner_SignBundle_ReturnsSuccessWithNullSignature()
|
||||
{
|
||||
// Arrange
|
||||
var signer = NullBundleSigner.Instance;
|
||||
var bundleHash = "sha256:test123";
|
||||
var siteId = "test-site";
|
||||
|
||||
// Act
|
||||
var result = await signer.SignBundleAsync(bundleHash, siteId);
|
||||
|
||||
// Assert
|
||||
result.Success.Should().BeTrue();
|
||||
result.Signature.Should().BeNull();
|
||||
result.ErrorMessage.Should().BeNull();
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task NullBundleSigner_VerifyBundle_AlwaysReturnsValid()
|
||||
{
|
||||
// Arrange
|
||||
var signer = NullBundleSigner.Instance;
|
||||
var signature = new BundleSignature
|
||||
{
|
||||
PayloadType = "test",
|
||||
Payload = "test-payload",
|
||||
Signatures = [new SignatureEntry { KeyId = "key1", Algorithm = "ES256", Signature = "sig1" }]
|
||||
};
|
||||
|
||||
// Act
|
||||
var result = await signer.VerifyBundleAsync("sha256:hash", signature);
|
||||
|
||||
// Assert
|
||||
result.IsValid.Should().BeTrue();
|
||||
result.SignerIdentity.Should().BeNull();
|
||||
result.ErrorMessage.Should().BeNull();
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Signature Structure Tests
|
||||
|
||||
[Fact]
|
||||
public void BundleSignature_ValidStructure_SerializesCorrectly()
|
||||
{
|
||||
// Arrange
|
||||
var signature = new BundleSignature
|
||||
{
|
||||
PayloadType = "application/stellaops.federation.bundle+json",
|
||||
Payload = "eyJidW5kbGVfaGFzaCI6InNoYTI1Njp0ZXN0In0=",
|
||||
Signatures =
|
||||
[
|
||||
new SignatureEntry
|
||||
{
|
||||
KeyId = "signing-key-001",
|
||||
Algorithm = "ES256",
|
||||
Signature = "base64-signature-data"
|
||||
}
|
||||
]
|
||||
};
|
||||
|
||||
// Assert
|
||||
signature.PayloadType.Should().Be("application/stellaops.federation.bundle+json");
|
||||
signature.Signatures.Should().HaveCount(1);
|
||||
signature.Signatures[0].KeyId.Should().Be("signing-key-001");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void BundleSignature_MultipleSignatures_SupportsMultiSig()
|
||||
{
|
||||
// Arrange
|
||||
var signature = new BundleSignature
|
||||
{
|
||||
PayloadType = "application/stellaops.federation.bundle+json",
|
||||
Payload = "test-payload",
|
||||
Signatures =
|
||||
[
|
||||
new SignatureEntry { KeyId = "primary-key", Algorithm = "ES256", Signature = "sig1" },
|
||||
new SignatureEntry { KeyId = "backup-key", Algorithm = "ES256", Signature = "sig2" },
|
||||
new SignatureEntry { KeyId = "witness-key", Algorithm = "ES256", Signature = "sig3" }
|
||||
]
|
||||
};
|
||||
|
||||
// Assert
|
||||
signature.Signatures.Should().HaveCount(3);
|
||||
signature.Signatures.Select(s => s.KeyId).Should().Contain("primary-key");
|
||||
signature.Signatures.Select(s => s.KeyId).Should().Contain("backup-key");
|
||||
signature.Signatures.Select(s => s.KeyId).Should().Contain("witness-key");
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Signing Result Tests
|
||||
|
||||
[Fact]
|
||||
public void BundleSigningResult_Success_HasSignature()
|
||||
{
|
||||
// Arrange
|
||||
var result = new BundleSigningResult
|
||||
{
|
||||
Success = true,
|
||||
Signature = new BundleSignature
|
||||
{
|
||||
PayloadType = "test",
|
||||
Payload = "payload",
|
||||
Signatures = [new SignatureEntry { KeyId = "key", Algorithm = "ES256", Signature = "sig" }]
|
||||
}
|
||||
};
|
||||
|
||||
// Assert
|
||||
result.Success.Should().BeTrue();
|
||||
result.Signature.Should().NotBeNull();
|
||||
result.ErrorMessage.Should().BeNull();
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void BundleSigningResult_Failure_HasErrorMessage()
|
||||
{
|
||||
// Arrange
|
||||
var result = new BundleSigningResult
|
||||
{
|
||||
Success = false,
|
||||
ErrorMessage = "Key not found in HSM"
|
||||
};
|
||||
|
||||
// Assert
|
||||
result.Success.Should().BeFalse();
|
||||
result.Signature.Should().BeNull();
|
||||
result.ErrorMessage.Should().Be("Key not found in HSM");
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Verification Result Tests
|
||||
|
||||
[Fact]
|
||||
public void BundleVerificationResult_Valid_ContainsSignerIdentity()
|
||||
{
|
||||
// Arrange
|
||||
var result = new BundleVerificationResult
|
||||
{
|
||||
IsValid = true,
|
||||
SignerIdentity = "verified-key-001"
|
||||
};
|
||||
|
||||
// Assert
|
||||
result.IsValid.Should().BeTrue();
|
||||
result.SignerIdentity.Should().Be("verified-key-001");
|
||||
result.ErrorMessage.Should().BeNull();
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void BundleVerificationResult_Invalid_ContainsError()
|
||||
{
|
||||
// Arrange
|
||||
var result = new BundleVerificationResult
|
||||
{
|
||||
IsValid = false,
|
||||
ErrorMessage = "Signature mismatch"
|
||||
};
|
||||
|
||||
// Assert
|
||||
result.IsValid.Should().BeFalse();
|
||||
result.ErrorMessage.Should().Be("Signature mismatch");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void BundleVerificationResult_Expired_ContainsExpirationInfo()
|
||||
{
|
||||
// Arrange
|
||||
var result = new BundleVerificationResult
|
||||
{
|
||||
IsValid = false,
|
||||
ErrorMessage = "Certificate expired",
|
||||
SignerIdentity = "expired-key"
|
||||
};
|
||||
|
||||
// Assert
|
||||
result.IsValid.Should().BeFalse();
|
||||
result.ErrorMessage.Should().Contain("expired");
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Mock Signer Tests
|
||||
|
||||
[Fact]
|
||||
public async Task MockSigner_ConfiguredToSucceed_ReturnsValidSignature()
|
||||
{
|
||||
// Arrange
|
||||
var signerMock = new Mock<IBundleSigner>();
|
||||
var expectedSignature = new BundleSignature
|
||||
{
|
||||
PayloadType = "application/stellaops.federation.bundle+json",
|
||||
Payload = "eyJ0ZXN0IjoiZGF0YSJ9",
|
||||
Signatures = [new SignatureEntry { KeyId = "mock-key", Algorithm = "ES256", Signature = "mock-sig" }]
|
||||
};
|
||||
|
||||
signerMock
|
||||
.Setup(x => x.SignBundleAsync(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<CancellationToken>()))
|
||||
.ReturnsAsync(new BundleSigningResult { Success = true, Signature = expectedSignature });
|
||||
|
||||
signerMock
|
||||
.Setup(x => x.VerifyBundleAsync(It.IsAny<string>(), expectedSignature, It.IsAny<CancellationToken>()))
|
||||
.ReturnsAsync(new BundleVerificationResult { IsValid = true, SignerIdentity = "mock-key" });
|
||||
|
||||
// Act
|
||||
var signResult = await signerMock.Object.SignBundleAsync("sha256:test", "site-1");
|
||||
var verifyResult = await signerMock.Object.VerifyBundleAsync("sha256:test", signResult.Signature!);
|
||||
|
||||
// Assert
|
||||
signResult.Success.Should().BeTrue();
|
||||
verifyResult.IsValid.Should().BeTrue();
|
||||
verifyResult.SignerIdentity.Should().Be("mock-key");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task MockSigner_ConfiguredToFail_ReturnsSingingError()
|
||||
{
|
||||
// Arrange
|
||||
var signerMock = new Mock<IBundleSigner>();
|
||||
signerMock
|
||||
.Setup(x => x.SignBundleAsync(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<CancellationToken>()))
|
||||
.ReturnsAsync(new BundleSigningResult { Success = false, ErrorMessage = "HSM unavailable" });
|
||||
|
||||
// Act
|
||||
var result = await signerMock.Object.SignBundleAsync("sha256:test", "site-1");
|
||||
|
||||
// Assert
|
||||
result.Success.Should().BeFalse();
|
||||
result.ErrorMessage.Should().Be("HSM unavailable");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task MockSigner_TamperedBundle_FailsVerification()
|
||||
{
|
||||
// Arrange
|
||||
var signerMock = new Mock<IBundleSigner>();
|
||||
var signature = new BundleSignature
|
||||
{
|
||||
PayloadType = "test",
|
||||
Payload = "original-payload",
|
||||
Signatures = [new SignatureEntry { KeyId = "key", Algorithm = "ES256", Signature = "sig" }]
|
||||
};
|
||||
|
||||
// Original hash verification succeeds
|
||||
signerMock
|
||||
.Setup(x => x.VerifyBundleAsync("sha256:original", signature, It.IsAny<CancellationToken>()))
|
||||
.ReturnsAsync(new BundleVerificationResult { IsValid = true, SignerIdentity = "key" });
|
||||
|
||||
// Tampered hash verification fails
|
||||
signerMock
|
||||
.Setup(x => x.VerifyBundleAsync("sha256:tampered", signature, It.IsAny<CancellationToken>()))
|
||||
.ReturnsAsync(new BundleVerificationResult { IsValid = false, ErrorMessage = "Hash mismatch" });
|
||||
|
||||
// Act
|
||||
var originalResult = await signerMock.Object.VerifyBundleAsync("sha256:original", signature);
|
||||
var tamperedResult = await signerMock.Object.VerifyBundleAsync("sha256:tampered", signature);
|
||||
|
||||
// Assert
|
||||
originalResult.IsValid.Should().BeTrue();
|
||||
tamperedResult.IsValid.Should().BeFalse();
|
||||
tamperedResult.ErrorMessage.Should().Be("Hash mismatch");
|
||||
}
|
||||
|
||||
#endregion
|
||||
}
|
||||
@@ -0,0 +1,20 @@
|
||||
<?xml version='1.0' encoding='utf-8'?>
|
||||
<Project Sdk="Microsoft.NET.Sdk">
|
||||
<PropertyGroup>
|
||||
<TargetFramework>net10.0</TargetFramework>
|
||||
<LangVersion>preview</LangVersion>
|
||||
<ImplicitUsings>enable</ImplicitUsings>
|
||||
<Nullable>enable</Nullable>
|
||||
<IsPackable>false</IsPackable>
|
||||
</PropertyGroup>
|
||||
<ItemGroup>
|
||||
<ProjectReference Include="../../__Libraries/StellaOps.Concelier.Federation/StellaOps.Concelier.Federation.csproj" />
|
||||
<ProjectReference Include="../../__Libraries/StellaOps.Concelier.Models/StellaOps.Concelier.Models.csproj" />
|
||||
<ProjectReference Include="../../__Libraries/StellaOps.Concelier.Storage.Postgres/StellaOps.Concelier.Storage.Postgres.csproj" />
|
||||
<!-- Test packages inherited from Directory.Build.props -->
|
||||
<PackageReference Include="FluentAssertions" Version="6.12.0" />
|
||||
<PackageReference Include="Microsoft.Extensions.Logging.Abstractions" Version="10.0.0" />
|
||||
<PackageReference Include="Microsoft.Extensions.Options" Version="10.0.0" />
|
||||
<PackageReference Include="Moq" Version="4.20.72" />
|
||||
</ItemGroup>
|
||||
</Project>
|
||||
Reference in New Issue
Block a user