Add enterprise appliance experience Phase 1 foundation

tests/backend/__init__.py

@@ -0,0 +1 @@
+"""Backend contract tests."""

tests/backend/_source.py

@@ -0,0 +1,21 @@
+import ast
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[2]
+MAIN = ROOT / "ansible/roles/cezen-backend/files/main.py"
+
+
+def load_symbols(*names, globals_dict=None):
+    tree = ast.parse(MAIN.read_text())
+    wanted = []
+    for node in tree.body:
+        if isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef)) and node.name in names:
+            wanted.append(node)
+        elif isinstance(node, ast.Assign):
+            assigned = {target.id for target in node.targets if isinstance(target, ast.Name)}
+            if assigned.intersection(names):
+                wanted.append(node)
+    namespace = dict(globals_dict or {})
+    exec(compile(ast.Module(body=wanted, type_ignores=[]), str(MAIN), "exec"), namespace)
+    return namespace

tests/backend/test_audit_redaction.py

@@ -0,0 +1,18 @@
+from ._source import load_symbols
+
+
+def _namespace():
+    return load_symbols("_AUDIT_SENSITIVE_KEYS", "_redact_audit_value", "safe_audit_detail", globals_dict={"json": __import__("json")})
+
+
+def test_structured_audit_detail_redacts_secret_categories():
+    safe = _namespace()["safe_audit_detail"]({"license_key": "abc", "result": "valid", "nested": {"token": "xyz"}})
+    assert "abc" not in safe and "xyz" not in safe
+    assert safe.count("[REDACTED]") == 2
+    assert "valid" in safe
+
+
+def test_text_audit_detail_redacts_key_value_pairs():
+    safe = _namespace()["safe_audit_detail"]("license_key=abc token:xyz outcome=valid")
+    assert "abc" not in safe and "xyz" not in safe
+    assert "outcome=valid" in safe

tests/backend/test_experience_contracts.py

@@ -0,0 +1,24 @@
+from datetime import datetime, timezone
+
+from ._source import load_symbols
+
+
+def test_customer_state_normalizes_unknown_values():
+    ns = load_symbols("CUSTOMER_STATES", "customer_state", globals_dict={"utcnow": lambda: datetime.now(timezone.utc).isoformat()})
+    payload = ns["customer_state"]("mystery", "Status cannot be observed")
+    assert payload["schema"] == "cezen.customer_state.v1"
+    assert payload["state"] == "unavailable"
+    assert payload["summary"] == "Status cannot be observed"
+
+
+def test_error_envelope_has_customer_safe_fields():
+    ns = load_symbols("error_envelope")
+    payload = ns["error_envelope"]("service_unavailable", "Model service is unavailable", "Retry after checking health.", affected_scope="local inference", correlation_id="corr-1")
+    assert set(payload) == {"schema", "code", "message", "remediation", "affected_scope", "correlation_id"}
+    assert payload["correlation_id"] == "corr-1"
+
+
+def test_new_operation_interfaces_require_admin_in_source():
+    source = (__import__("pathlib").Path(__file__).resolve().parents[2] / "ansible/roles/cezen-backend/files/main.py").read_text()
+    assert 'actor.get("role") != "admin"' in source
+    assert '"admin_required"' in source

tests/backend/test_license_parity.py

@@ -0,0 +1,17 @@
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[2]
+
+
+def test_canonical_and_deployed_license_helpers_are_identical():
+    canonical = ROOT / "scripts/cezen_license.py"
+    deployed = ROOT / "ansible/roles/cezen-backend/files/cezen_license.py"
+    assert canonical.read_bytes() == deployed.read_bytes()
+
+
+def test_customer_labels_preserve_compatibility_slugs():
+    source = (ROOT / "scripts/cezen_license.py").read_text()
+    for slug in ("starter", "basic", "pro", "max"):
+        assert slug in source
+    assert 'WORKSTATION_TIER = "workstation"' in source

tests/backend/test_migrations.py

@@ -0,0 +1,31 @@
+import sqlite3
+
+from ._source import load_symbols
+
+
+def _migration_namespace():
+    return load_symbols("SCHEMA_VERSION", "_column_names", "run_migrations")
+
+
+def test_migration_is_idempotent_and_creates_operation_contract():
+    db = sqlite3.connect(":memory:")
+    db.execute("CREATE TABLE audit_log (id INTEGER PRIMARY KEY, detail TEXT)")
+    ns = _migration_namespace()
+    assert ns["run_migrations"](db) == 1
+    assert ns["run_migrations"](db) == 1
+    columns = {row[1] for row in db.execute("PRAGMA table_info(operations)")}
+    assert {"id", "correlation_id", "kind", "state", "idempotency_key", "recovery_actions"} <= columns
+    assert "correlation_id" in {row[1] for row in db.execute("PRAGMA table_info(audit_log)")}
+
+
+def test_newer_schema_is_rejected_without_mutation():
+    db = sqlite3.connect(":memory:")
+    db.execute("CREATE TABLE schema_metadata (key TEXT PRIMARY KEY, value TEXT NOT NULL)")
+    db.execute("INSERT INTO schema_metadata VALUES ('schema_version','999')")
+    ns = _migration_namespace()
+    try:
+        ns["run_migrations"](db)
+    except RuntimeError as exc:
+        assert "newer than supported" in str(exc)
+    else:
+        raise AssertionError("newer schema was accepted")

tests/backend/test_operations.py

@@ -0,0 +1,25 @@
+import sqlite3
+
+from ._source import load_symbols
+
+
+def test_operation_states_include_recovery_and_terminal_states():
+    ns = load_symbols("OPERATION_STATES", "TERMINAL_OPERATION_STATES")
+    assert {"requested", "running", "awaiting_reboot", "recovery_required"} <= ns["OPERATION_STATES"]
+    assert ns["TERMINAL_OPERATION_STATES"] <= ns["OPERATION_STATES"]
+
+
+def test_operation_schema_prevents_duplicate_kind_and_idempotency_key():
+    ns = load_symbols("SCHEMA_VERSION", "_column_names", "run_migrations")
+    db = sqlite3.connect(":memory:")
+    db.execute("CREATE TABLE audit_log (id INTEGER PRIMARY KEY, detail TEXT)")
+    ns["run_migrations"](db)
+    values = ("1", "c1", "install", "requested", "now", "now", "same")
+    sql = "INSERT INTO operations (id,correlation_id,kind,state,requested_at,updated_at,idempotency_key) VALUES (?,?,?,?,?,?,?)"
+    db.execute(sql, values)
+    try:
+        db.execute(sql, ("2", "c2", "install", "requested", "now", "now", "same"))
+    except sqlite3.IntegrityError:
+        pass
+    else:
+        raise AssertionError("duplicate idempotent operation accepted")

tests/backend/test_readiness.py

@@ -0,0 +1,23 @@
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[2]
+MAIN = ROOT / "ansible/roles/cezen-backend/files/main.py"
+
+
+def test_readiness_contract_has_state_freshness_impact_and_actions():
+    source = MAIN.read_text()
+    assert '"cezen.readiness_report.v2"' in source
+    for field in ("observed_at", "freshness_seconds", "affected_capabilities", "next_actions"):
+        assert field in source
+
+
+def test_readiness_contract_preserves_entitlement_reasons():
+    source = MAIN.read_text()
+    for reason in ("not_licensed", "not_provisioned", "unsupported_hardware", "degraded", "unavailable"):
+        assert reason in source
+
+
+def test_readiness_display_target_is_ten_seconds():
+    spec = " ".join((ROOT / "specs/001-enterprise-experience/spec.md").read_text().split())
+    assert "within 10 seconds" in spec