akif/arclet-boards

Arclet Boards — private Kanban workspaces with AppID, DataK3, shared web and MCP actions.

• dodil-challenge
• dodil-challenge-boards

A remix template · 1 remixes · Remix akif/arclet-boards

tests/test_configuration.py

from pathlib import Path
import re

import yaml

from app.infrastructure.dodil import COLUMNS, SqlTransaction

ROOT = Path(__file__).resolve().parents[1]


def test_schema_has_every_entity_column_and_explicit_primary_key():
    schema = (ROOT / "schema.sql").read_text(encoding="utf-8")
    tables = dict(re.findall(r"CREATE TABLE IF NOT EXISTS arclet_(\w+)\s*\((.*?)\);",schema,re.S))
    assert set(tables) == set(COLUMNS)
    for table, columns in COLUMNS.items():
        body = tables[table]
        assert re.search(r"\bid\s+TEXT\s+PRIMARY KEY",body)
        declared = {row.strip().split()[0] for row in body.split(',')}
        assert declared == columns
    assert not re.search(r"\bSERIAL\b",schema,re.I)


def test_remix_resource_names_and_secret_references_match_deployment():
    remix = yaml.safe_load((ROOT/".dodil/remix.yaml").read_text(encoding="utf-8"))
    deploy = yaml.safe_load((ROOT/".dodil/deploy.yaml").read_text(encoding="utf-8"))
    assert remix["version"] == deploy["version"] == 1
    bucket = remix["provision"]["buckets"][0]
    pool = remix["provision"]["user_pools"][0]
    app = deploy["apps"][0]
    assert bucket["on_conflict"] == pool["on_conflict"] == "fail"
    assert app["env"]["BUCKET"] == bucket["name"] and app["user_pool"] == pool["name"]
    assert app["public_invoke"] is True
    assert (ROOT / bucket["schema"]).is_file()
    assert len(bucket["name"].replace("${{ dodil.repo }}","arclet-boards-2")) <= 25
    for key in ("DODIL_SERVICE_ACCOUNT_ID","DODIL_SERVICE_ACCOUNT_SECRET"):
        assert app["env"][key] == "${{ secrets." + key + " }}"


class RecordingConnection:
    def __init__(self):
        self.calls = []

    def execute(self, statement, params=None):
        self.calls.append((statement.as_string(),params))
        return self

    def fetchall(self):
        return []


def test_sql_values_are_bound_and_internal_identifiers_are_allowlisted():
    connection = RecordingConnection()
    tx = SqlTransaction(connection)
    title = "'); DROP TABLE arclet_boards; --"
    tx.update("boards","board-id",{"title":title})
    statement,params = connection.calls[-1]
    assert title not in statement and params == [title,"board-id"]
    assert 'WHERE id = %s' in statement
    import pytest
    with pytest.raises(ValueError):
        tx.find("boards; DROP TABLE cards",id="id")
    with pytest.raises(ValueError):
        tx.find("boards")