Jess Hallsworth
6a557bcdd9
The application the design describes: Flask + SQLite, Plex for library data, Tautulli for watch history, report-only. Structure follows the design's seams. providers/ splits MediaProvider from HistoryProvider, because on this network library data and watch data live on different machines and Jellyfin later will have no Tautulli equivalent. scoring.py implements the reclaim score twice - as a SQL expression for the live grid (weights change on every slider drag, so storing it would mean rewriting thousands of rows per drag) and in Python for CSV export and tests, with a property test over 500 generated rows asserting the two agree. rules.py compiles saved views to parameterized SQL through a field/operator whitelist; nothing user-supplied is ever interpolated. Three properties are enforced by test rather than asserted in prose: - Ingest is idempotent. Three consecutive full scans leave every count and every byte total unchanged. A scanner that double-counts produces a report that looks plausible and is wrong. - Keep marks survive Plex reassigning every rating key in the library. They are keyed on content GUID, scoped per library so the Movies and 4K Movies copies of the same film mark independently. - Every config variable the app reads is declared in docker-compose.yml, so a variable set in Portainer can never silently do nothing. Also found and fixed while verifying against a fake Plex+Tautulli pair: executescript() commits the pending transaction, so migrations needed their BEGIN/COMMIT inside the script; replaceChildren() renders null as the literal text "null"; a hash-only URL change does not reload the document, so deep links needed a hashchange listener; and SQLite ROUND rounds half away from zero where Python rounds half to even. 73 tests, no live server required. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GVbG48GAXfCZatcmX123Ra
77 lines
2.9 KiB
Python
77 lines
2.9 KiB
Python
"""Deployment-shape checks.
|
|
|
|
A variable set in Portainer's UI but missing from the compose file's
|
|
`environment:` block silently does nothing. That cost real debugging time on the
|
|
Mythica stack; this test makes it impossible to reintroduce here.
|
|
"""
|
|
|
|
import re
|
|
from pathlib import Path
|
|
|
|
import pytest
|
|
|
|
ROOT = Path(__file__).resolve().parent.parent
|
|
|
|
yaml = pytest.importorskip("yaml")
|
|
|
|
|
|
def declared_in_compose() -> set[str]:
|
|
spec = yaml.safe_load((ROOT / "docker-compose.yml").read_text())
|
|
env = spec["services"]["mediashelf"]["environment"]
|
|
return {e.split("=", 1)[0] for e in env}
|
|
|
|
|
|
def read_by_config() -> set[str]:
|
|
src = (ROOT / "mediashelf" / "config.py").read_text()
|
|
return (set(re.findall(r'_[bisf]\("([A-Z_][A-Z0-9_]*)"', src))
|
|
| set(re.findall(r'_csv\("([A-Z_][A-Z0-9_]*)"\)', src)))
|
|
|
|
|
|
def test_every_config_var_is_declared_in_the_stack():
|
|
missing = read_by_config() - declared_in_compose()
|
|
assert not missing, (
|
|
"these are read by config.py but absent from docker-compose.yml's "
|
|
"environment block, so setting them in Portainer would silently do "
|
|
f"nothing: {sorted(missing)}")
|
|
|
|
|
|
def test_compose_declares_nothing_the_app_ignores():
|
|
extra = declared_in_compose() - read_by_config()
|
|
assert not extra, f"compose declares unused variables: {sorted(extra)}"
|
|
|
|
|
|
def test_keep_all_libraries_defaults_to_empty():
|
|
"""Nothing ships kept (§6.6)."""
|
|
spec = yaml.safe_load((ROOT / "docker-compose.yml").read_text())
|
|
env = spec["services"]["mediashelf"]["environment"]
|
|
line = next(e for e in env if e.startswith("KEEP_ALL_LIBRARIES="))
|
|
assert line.endswith(":-}") or line.endswith("="), \
|
|
f"a library is pre-kept in the shipped stack: {line}"
|
|
|
|
example = (ROOT / ".env.example").read_text()
|
|
assert re.search(r"^KEEP_ALL_LIBRARIES=\s*$", example, re.M), \
|
|
".env.example must not name a library"
|
|
|
|
|
|
def test_image_is_not_pinned_to_bare_latest():
|
|
spec = yaml.safe_load((ROOT / "docker-compose.yml").read_text())
|
|
image = spec["services"]["mediashelf"]["image"]
|
|
assert "latest" not in image, (
|
|
"a bare :latest tag is what forced the Mythica stack to be recreated "
|
|
"when a PUT update kept serving old code (§11.2)")
|
|
|
|
|
|
def test_dockerfile_runs_as_non_root():
|
|
df = (ROOT / "Dockerfile").read_text()
|
|
user_lines = [l for l in df.splitlines() if l.startswith("USER ")]
|
|
assert user_lines and not user_lines[-1].strip().endswith("root")
|
|
|
|
|
|
def test_no_credentials_committed():
|
|
"""Cheap guard against the SOAP-password-in-git-history problem."""
|
|
suspicious = re.compile(
|
|
r"(PLEX_TOKEN|TAUTULLI_API_KEY|MEDIASHELF_SECRET_KEY)\s*=\s*['\"]?[A-Za-z0-9]{16,}")
|
|
for path in list(ROOT.glob("*.yml")) + list(ROOT.glob("*.py")) + \
|
|
list((ROOT / "mediashelf").rglob("*.py")) + [ROOT / ".env.example"]:
|
|
text = path.read_text()
|
|
assert not suspicious.search(text), f"possible credential in {path.name}"
|