Shannon Sands
4822156923
Since the managed-cron redesign (#84339, v2026.8.13) the dashboard fire webhook forwards fires to the gateway process and returns 503 when it is unreachable so NAS/QStash retries. Correct for transient windows — but an operator-STOPPED gateway can never be fixed by retrying: every fire on every job burns the full scheduler retry budget, NAS converts each 503 to a retryable 502, and the resulting storms page on-call for a non-incident (OOF-266 and its five duplicate tickets; +93% relay callback failures as the fleet adopted v2026.8.13). Split the unreachable path by durable operator intent: - desired_state == "stopped" (written only by the s6 lifecycle commands; the same intent signal container-boot reconciliation trusts) -> drop the fire with 200 + a structured log line, mirroring NAS's own instance_stopped drop. Jobs are not lost: the Chronos provider reconciles and re-arms every job on the next gateway start. - Anything else (crash loop, scale-to-zero wake, restart, legacy state file without desired_state) -> keep the retryable 503, now stamped with Retry-After: 60 so a scheduler that honors it spaces retries past the wake/restart window instead of exhausting them inside it. The gateway's own pass-through 503s (draining) get the same hint. The intent check fails open (any parse/resolution error -> retryable path) and is only consulted when the gateway is actually unreachable, so a stale state file can never shadow a live gateway.
441 lines
18 KiB
Python
441 lines
18 KiB
Python
"""Tests for the Chronos cron-fire webhook ON THE DASHBOARD APP (web_server).
|
|
|
|
Regression guard for the relocation bug: the fire webhook MUST live on the
|
|
dashboard FastAPI app (`hermes_cli.web_server.app`) — the agent's public HTTP
|
|
surface on hosted deployments — not only on the aiohttp APIServerAdapter (which
|
|
hosted agents don't expose). It must:
|
|
- be a registered route on the dashboard app,
|
|
- be in PUBLIC_API_PATHS so the dashboard cookie gate doesn't 401 it before
|
|
the JWT verifier runs,
|
|
- reject a bad/missing NAS-JWT with 401 (the JWT is the real gate),
|
|
- 400 on missing job_id,
|
|
- on a valid token, FORWARD the fire to the gateway api_server (which owns
|
|
cron execution and the live delivery adapters) and pass its response
|
|
through — 503 when the gateway is unreachable so NAS retries.
|
|
"""
|
|
|
|
import pytest
|
|
from starlette.testclient import TestClient
|
|
|
|
from hermes_cli import web_server
|
|
from hermes_cli.dashboard_auth.public_paths import PUBLIC_API_PATHS
|
|
|
|
|
|
def _client(auth_required: bool):
|
|
prev_auth = getattr(web_server.app.state, "auth_required", None)
|
|
prev_host = getattr(web_server.app.state, "bound_host", None)
|
|
web_server.app.state.auth_required = auth_required
|
|
web_server.app.state.bound_host = None
|
|
client = TestClient(web_server.app)
|
|
return client, prev_auth, prev_host
|
|
|
|
|
|
def _restore(prev_auth, prev_host):
|
|
if prev_auth is None:
|
|
if hasattr(web_server.app.state, "auth_required"):
|
|
delattr(web_server.app.state, "auth_required")
|
|
else:
|
|
web_server.app.state.auth_required = prev_auth
|
|
if prev_host is None:
|
|
if hasattr(web_server.app.state, "bound_host"):
|
|
delattr(web_server.app.state, "bound_host")
|
|
else:
|
|
web_server.app.state.bound_host = prev_host
|
|
|
|
|
|
|
|
|
|
def test_fire_path_is_public():
|
|
"""Must bypass the dashboard cookie gate so the NAS bearer-JWT callback
|
|
reaches the verifier (the JWT is the real auth)."""
|
|
assert "/api/cron/fire" in PUBLIC_API_PATHS
|
|
|
|
|
|
def test_bad_token_401(monkeypatch):
|
|
"""Invalid NAS-JWT -> 401, even with the dashboard auth gate ENGAGED
|
|
(proves the route is reachable past the cookie gate and the verifier is the
|
|
gate). fire_due must NOT run."""
|
|
fired = []
|
|
monkeypatch.setattr(
|
|
"plugins.cron_providers.chronos.verify.get_fire_verifier",
|
|
lambda: (lambda **kw: None), # verification fails
|
|
)
|
|
monkeypatch.setattr(web_server, "_find_cron_job_profile", lambda jid: "default")
|
|
monkeypatch.setattr(web_server, "_fire_cron_job_for_profile",
|
|
lambda p, j: fired.append((p, j)))
|
|
|
|
client, pa, ph = _client(auth_required=True)
|
|
try:
|
|
resp = client.post("/api/cron/fire",
|
|
headers={"Authorization": "Bearer forged"},
|
|
json={"job_id": "abc"})
|
|
assert resp.status_code == 401
|
|
assert fired == []
|
|
finally:
|
|
_restore(pa, ph)
|
|
client.close()
|
|
|
|
|
|
def test_missing_job_id_400(monkeypatch):
|
|
monkeypatch.setattr(
|
|
"plugins.cron_providers.chronos.verify.get_fire_verifier",
|
|
lambda: (lambda **kw: {"purpose": "cron_fire"}),
|
|
)
|
|
client, pa, ph = _client(auth_required=False)
|
|
try:
|
|
resp = client.post("/api/cron/fire",
|
|
headers={"Authorization": "Bearer good"},
|
|
json={})
|
|
assert resp.status_code == 400
|
|
finally:
|
|
_restore(pa, ph)
|
|
client.close()
|
|
|
|
|
|
def test_unknown_job_200_gone(monkeypatch):
|
|
"""Valid token but the job isn't found in any profile -> 200 'gone'
|
|
(NAS shouldn't retry a fire for a cancelled/completed job)."""
|
|
monkeypatch.setattr(
|
|
"plugins.cron_providers.chronos.verify.get_fire_verifier",
|
|
lambda: (lambda **kw: {"purpose": "cron_fire"}),
|
|
)
|
|
monkeypatch.setattr(web_server, "_find_cron_job_profile", lambda jid: None)
|
|
client, pa, ph = _client(auth_required=False)
|
|
try:
|
|
resp = client.post("/api/cron/fire",
|
|
headers={"Authorization": "Bearer good"},
|
|
json={"job_id": "ghost"})
|
|
assert resp.status_code == 200
|
|
assert resp.json().get("status") == "gone"
|
|
finally:
|
|
_restore(pa, ph)
|
|
client.close()
|
|
|
|
|
|
def test_valid_fire_forwards_to_gateway(monkeypatch):
|
|
"""The dashboard is the public door only: a verified fire is FORWARDED to
|
|
the gateway api_server (which owns the live adapters — relay/E2EE
|
|
delivery), with the NAS bearer preserved, and the gateway's response is
|
|
passed through. The deprecated in-dashboard execution must NOT run."""
|
|
forwarded = []
|
|
executed = []
|
|
|
|
async def fake_forward(profile, job_id, authorization):
|
|
forwarded.append((profile, job_id, authorization))
|
|
return 202, {"status": "accepted", "job_id": job_id}
|
|
|
|
monkeypatch.setattr(
|
|
"plugins.cron_providers.chronos.verify.get_fire_verifier",
|
|
lambda: (lambda **kw: {"purpose": "cron_fire"}),
|
|
)
|
|
monkeypatch.setattr(web_server, "_find_cron_job_profile", lambda jid: "default")
|
|
monkeypatch.setattr(web_server, "_forward_cron_fire_to_gateway", fake_forward)
|
|
monkeypatch.setattr(web_server, "_fire_cron_job_for_profile",
|
|
lambda p, j: executed.append((p, j)))
|
|
|
|
client, pa, ph = _client(auth_required=False)
|
|
try:
|
|
resp = client.post("/api/cron/fire",
|
|
headers={"Authorization": "Bearer nas-jwt"},
|
|
json={"job_id": "j1"})
|
|
assert resp.status_code == 202
|
|
assert resp.json().get("status") == "accepted"
|
|
assert forwarded == [("default", "j1", "Bearer nas-jwt")]
|
|
assert executed == [] # no local execution — gateway owns cron
|
|
finally:
|
|
_restore(pa, ph)
|
|
client.close()
|
|
|
|
|
|
def test_gateway_unreachable_503_for_nas_retry(monkeypatch):
|
|
"""Gateway down (scale-to-zero wake window / restart) -> 503 so NAS
|
|
retries per the Chronos contract. Deliberately NO local-execution
|
|
fallback — delivering from the dashboard process cannot serve
|
|
relay-fronted or E2EE targets."""
|
|
executed = []
|
|
|
|
async def fake_forward(profile, job_id, authorization):
|
|
return None # unreachable
|
|
|
|
monkeypatch.setattr(
|
|
"plugins.cron_providers.chronos.verify.get_fire_verifier",
|
|
lambda: (lambda **kw: {"purpose": "cron_fire"}),
|
|
)
|
|
monkeypatch.setattr(web_server, "_find_cron_job_profile", lambda jid: "default")
|
|
monkeypatch.setattr(web_server, "_forward_cron_fire_to_gateway", fake_forward)
|
|
monkeypatch.setattr(web_server, "_fire_cron_job_for_profile",
|
|
lambda p, j: executed.append((p, j)))
|
|
|
|
client, pa, ph = _client(auth_required=False)
|
|
try:
|
|
resp = client.post("/api/cron/fire",
|
|
headers={"Authorization": "Bearer nas-jwt"},
|
|
json={"job_id": "j2"})
|
|
assert resp.status_code == 503
|
|
assert executed == []
|
|
finally:
|
|
_restore(pa, ph)
|
|
client.close()
|
|
|
|
|
|
def test_gateway_error_status_passes_through(monkeypatch):
|
|
"""A non-2xx gateway response (e.g. its own 401 on a replayed JWT) passes
|
|
through unchanged — the dashboard adds no interpretation of its own."""
|
|
|
|
async def fake_forward(profile, job_id, authorization):
|
|
return 401, {"error": "invalid fire token"}
|
|
|
|
monkeypatch.setattr(
|
|
"plugins.cron_providers.chronos.verify.get_fire_verifier",
|
|
lambda: (lambda **kw: {"purpose": "cron_fire"}),
|
|
)
|
|
monkeypatch.setattr(web_server, "_find_cron_job_profile", lambda jid: "default")
|
|
monkeypatch.setattr(web_server, "_forward_cron_fire_to_gateway", fake_forward)
|
|
|
|
client, pa, ph = _client(auth_required=False)
|
|
try:
|
|
resp = client.post("/api/cron/fire",
|
|
headers={"Authorization": "Bearer nas-jwt"},
|
|
json={"job_id": "j3"})
|
|
assert resp.status_code == 401
|
|
finally:
|
|
_restore(pa, ph)
|
|
client.close()
|
|
|
|
|
|
# ── _gateway_fire_endpoint URL resolution ────────────────────────────────
|
|
|
|
|
|
def test_fire_endpoint_default_port(tmp_path, monkeypatch):
|
|
monkeypatch.delenv("API_SERVER_PORT", raising=False)
|
|
monkeypatch.delenv("GATEWAY_MULTIPLEX_PROFILES", raising=False)
|
|
monkeypatch.setattr(web_server, "load_config", lambda: {})
|
|
url = web_server._gateway_fire_endpoint("default", tmp_path)
|
|
assert url == "http://127.0.0.1:8642/api/cron/fire"
|
|
|
|
|
|
def test_fire_endpoint_config_yaml_port_wins(tmp_path, monkeypatch):
|
|
"""The profile config.yaml port (read via the CANONICAL load_config, per
|
|
the config-read guard) wins over the process env API_SERVER_PORT."""
|
|
monkeypatch.setenv("API_SERVER_PORT", "9999")
|
|
monkeypatch.delenv("GATEWAY_MULTIPLEX_PROFILES", raising=False)
|
|
monkeypatch.setattr(
|
|
web_server,
|
|
"load_config",
|
|
lambda: {"platforms": {"api_server": {"extra": {"port": 8700}}}},
|
|
)
|
|
url = web_server._gateway_fire_endpoint("default", tmp_path)
|
|
assert url == "http://127.0.0.1:8700/api/cron/fire"
|
|
|
|
|
|
def test_fire_endpoint_profile_env_port(tmp_path, monkeypatch):
|
|
"""A non-default profile reads API_SERVER_PORT from its own .env, not the
|
|
dashboard process env (per-profile-gateway topology)."""
|
|
monkeypatch.setenv("API_SERVER_PORT", "9999") # dashboard process env
|
|
monkeypatch.delenv("GATEWAY_MULTIPLEX_PROFILES", raising=False)
|
|
monkeypatch.setattr(web_server, "load_config", lambda: {})
|
|
monkeypatch.setattr(web_server, "_cron_default_profile", lambda: "default")
|
|
(tmp_path / ".env").write_text("API_SERVER_PORT=8701\n", encoding="utf-8")
|
|
url = web_server._gateway_fire_endpoint("worker_alpha", tmp_path)
|
|
assert url == "http://127.0.0.1:8701/api/cron/fire"
|
|
|
|
|
|
def test_fire_endpoint_multiplex_profile_prefix(tmp_path, monkeypatch):
|
|
"""Multiplex mode: a non-default profile routes through the default
|
|
gateway's port with the /p/<profile>/ prefix mirror."""
|
|
monkeypatch.delenv("API_SERVER_PORT", raising=False)
|
|
monkeypatch.setenv("GATEWAY_MULTIPLEX_PROFILES", "1")
|
|
monkeypatch.setattr(web_server, "load_config", lambda: {})
|
|
url = web_server._gateway_fire_endpoint("worker_alpha", tmp_path)
|
|
assert url == "http://127.0.0.1:8642/p/worker_alpha/api/cron/fire"
|
|
|
|
|
|
# ── OOF-266: intentional-stop drop + Retry-After on transient 503 ─────────
|
|
|
|
|
|
def test_gateway_unreachable_503_carries_retry_after(monkeypatch):
|
|
"""Transient unreachable window (wake/restart) -> 503 WITH Retry-After so
|
|
the scheduler spaces retries past the window instead of exhausting its
|
|
budget inside it (OOF-266)."""
|
|
|
|
async def fake_forward(profile, job_id, authorization):
|
|
return None # unreachable
|
|
|
|
monkeypatch.setattr(
|
|
"plugins.cron_providers.chronos.verify.get_fire_verifier",
|
|
lambda: (lambda **kw: {"purpose": "cron_fire"}),
|
|
)
|
|
monkeypatch.setattr(web_server, "_find_cron_job_profile", lambda jid: "default")
|
|
monkeypatch.setattr(web_server, "_forward_cron_fire_to_gateway", fake_forward)
|
|
monkeypatch.setattr(
|
|
web_server, "_gateway_intentionally_stopped", lambda p: False
|
|
)
|
|
|
|
client, pa, ph = _client(auth_required=False)
|
|
try:
|
|
resp = client.post("/api/cron/fire",
|
|
headers={"Authorization": "Bearer nas-jwt"},
|
|
json={"job_id": "j4"})
|
|
assert resp.status_code == 503
|
|
assert resp.headers.get("Retry-After") == "60"
|
|
finally:
|
|
_restore(pa, ph)
|
|
client.close()
|
|
|
|
|
|
def test_gateway_intentionally_stopped_drops_with_200(monkeypatch):
|
|
"""Operator-stopped gateway (durable desired_state == "stopped") -> the
|
|
fire is DROPPED with 200: retrying can never succeed until a human starts
|
|
the gateway, so burning the scheduler retry budget only produces
|
|
502-retry storms at NAS (OOF-266). Jobs re-arm via the Chronos provider's
|
|
reconcile on the next gateway start."""
|
|
executed = []
|
|
|
|
async def fake_forward(profile, job_id, authorization):
|
|
return None # unreachable — gateway process is down
|
|
|
|
monkeypatch.setattr(
|
|
"plugins.cron_providers.chronos.verify.get_fire_verifier",
|
|
lambda: (lambda **kw: {"purpose": "cron_fire"}),
|
|
)
|
|
monkeypatch.setattr(web_server, "_find_cron_job_profile", lambda jid: "default")
|
|
monkeypatch.setattr(web_server, "_forward_cron_fire_to_gateway", fake_forward)
|
|
monkeypatch.setattr(
|
|
web_server, "_gateway_intentionally_stopped", lambda p: True
|
|
)
|
|
monkeypatch.setattr(web_server, "_fire_cron_job_for_profile",
|
|
lambda p, j: executed.append((p, j)))
|
|
|
|
client, pa, ph = _client(auth_required=False)
|
|
try:
|
|
resp = client.post("/api/cron/fire",
|
|
headers={"Authorization": "Bearer nas-jwt"},
|
|
json={"job_id": "j5"})
|
|
assert resp.status_code == 200
|
|
assert resp.json().get("status") == "gateway_stopped"
|
|
assert executed == [] # dropped, never locally executed
|
|
finally:
|
|
_restore(pa, ph)
|
|
client.close()
|
|
|
|
|
|
def test_stopped_check_only_consulted_when_gateway_unreachable(monkeypatch):
|
|
"""A reachable gateway's response passes through untouched — the
|
|
intentional-stop check must not run (a stale desired_state file must
|
|
never shadow a live gateway)."""
|
|
consulted = []
|
|
|
|
async def fake_forward(profile, job_id, authorization):
|
|
return 202, {"status": "accepted", "job_id": job_id}
|
|
|
|
def fake_stopped(profile):
|
|
consulted.append(profile)
|
|
return True # would drop if (wrongly) consulted
|
|
|
|
monkeypatch.setattr(
|
|
"plugins.cron_providers.chronos.verify.get_fire_verifier",
|
|
lambda: (lambda **kw: {"purpose": "cron_fire"}),
|
|
)
|
|
monkeypatch.setattr(web_server, "_find_cron_job_profile", lambda jid: "default")
|
|
monkeypatch.setattr(web_server, "_forward_cron_fire_to_gateway", fake_forward)
|
|
monkeypatch.setattr(web_server, "_gateway_intentionally_stopped", fake_stopped)
|
|
|
|
client, pa, ph = _client(auth_required=False)
|
|
try:
|
|
resp = client.post("/api/cron/fire",
|
|
headers={"Authorization": "Bearer nas-jwt"},
|
|
json={"job_id": "j6"})
|
|
assert resp.status_code == 202
|
|
assert consulted == []
|
|
finally:
|
|
_restore(pa, ph)
|
|
client.close()
|
|
|
|
|
|
def test_gateway_own_503_also_carries_retry_after(monkeypatch):
|
|
"""The gateway's OWN 503 (draining / admission failure) is equally
|
|
transient — the pass-through stamps the same Retry-After hint. Other
|
|
statuses stay header-free."""
|
|
|
|
async def fake_forward(profile, job_id, authorization):
|
|
return 503, {"error": "gateway draining"}
|
|
|
|
monkeypatch.setattr(
|
|
"plugins.cron_providers.chronos.verify.get_fire_verifier",
|
|
lambda: (lambda **kw: {"purpose": "cron_fire"}),
|
|
)
|
|
monkeypatch.setattr(web_server, "_find_cron_job_profile", lambda jid: "default")
|
|
monkeypatch.setattr(web_server, "_forward_cron_fire_to_gateway", fake_forward)
|
|
|
|
client, pa, ph = _client(auth_required=False)
|
|
try:
|
|
resp = client.post("/api/cron/fire",
|
|
headers={"Authorization": "Bearer nas-jwt"},
|
|
json={"job_id": "j7"})
|
|
assert resp.status_code == 503
|
|
assert resp.headers.get("Retry-After") == "60"
|
|
finally:
|
|
_restore(pa, ph)
|
|
client.close()
|
|
|
|
|
|
# ── _gateway_intentionally_stopped (durable operator intent) ──────────────
|
|
|
|
|
|
def _stopped_check_home(monkeypatch, tmp_path):
|
|
"""Point the profile resolver at tmp_path so the check reads our file."""
|
|
monkeypatch.setattr(
|
|
web_server, "_cron_profile_home", lambda p: ("default", tmp_path)
|
|
)
|
|
|
|
|
|
def test_intentionally_stopped_true_on_desired_state_stopped(tmp_path, monkeypatch):
|
|
_stopped_check_home(monkeypatch, tmp_path)
|
|
(tmp_path / "gateway_state.json").write_text(
|
|
'{"gateway_state":"stopped","desired_state":"stopped"}', encoding="utf-8"
|
|
)
|
|
assert web_server._gateway_intentionally_stopped("default") is True
|
|
|
|
|
|
def test_intentionally_stopped_false_when_desired_running(tmp_path, monkeypatch):
|
|
"""Crash loop / transient outage: runtime says stopped but operator intent
|
|
is running -> stay on the retryable path."""
|
|
_stopped_check_home(monkeypatch, tmp_path)
|
|
(tmp_path / "gateway_state.json").write_text(
|
|
'{"gateway_state":"startup_failed","desired_state":"running"}',
|
|
encoding="utf-8",
|
|
)
|
|
assert web_server._gateway_intentionally_stopped("default") is False
|
|
|
|
|
|
def test_intentionally_stopped_false_on_legacy_file_without_desired_state(
|
|
tmp_path, monkeypatch
|
|
):
|
|
"""Legacy gateway_state.json (no desired_state) must NOT count as
|
|
intentional — the volatile runtime field can read 'stopped' during
|
|
transient windows. Fail open to the retryable path."""
|
|
_stopped_check_home(monkeypatch, tmp_path)
|
|
(tmp_path / "gateway_state.json").write_text(
|
|
'{"gateway_state":"stopped"}', encoding="utf-8"
|
|
)
|
|
assert web_server._gateway_intentionally_stopped("default") is False
|
|
|
|
|
|
def test_intentionally_stopped_false_on_missing_or_bad_file(tmp_path, monkeypatch):
|
|
_stopped_check_home(monkeypatch, tmp_path)
|
|
assert web_server._gateway_intentionally_stopped("default") is False
|
|
(tmp_path / "gateway_state.json").write_text("{not json", encoding="utf-8")
|
|
assert web_server._gateway_intentionally_stopped("default") is False
|
|
(tmp_path / "gateway_state.json").write_text('["list"]', encoding="utf-8")
|
|
assert web_server._gateway_intentionally_stopped("default") is False
|
|
|
|
|
|
def test_intentionally_stopped_false_when_profile_resolution_fails(monkeypatch):
|
|
"""Exception-safe: any resolution failure (unknown profile, bad name)
|
|
returns False — never blocks the retryable path."""
|
|
def boom(profile):
|
|
raise RuntimeError("no such profile")
|
|
|
|
monkeypatch.setattr(web_server, "_cron_profile_home", boom)
|
|
assert web_server._gateway_intentionally_stopped("ghost") is False
|