WeKnora deployment source with the reviewed wiki identity, summary and recovery fixes

scripts/verify_asset_api.py

@@ -0,0 +1,144 @@
+#!/usr/bin/env python3
+"""Verify migrated assets through acceptance HTTP without printing bodies."""
+import argparse
+import json
+import secrets
+import urllib.error
+import urllib.request
+import uuid
+from pathlib import Path
+
+from apply_weknora_assets import target_snapshot
+from apply_weknora_identities import sql_run
+from weknora_asset_etl import LEDGER, asset_id
+from weknora_category_etl import literal, save_json
+from weknora_identity_etl import TARGET_DATABASE, TARGET_TENANT
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('--credentials', type=Path, required=True)
+    parser.add_argument('--out', type=Path, required=True)
+    args = parser.parse_args()
+    if args.out.exists():
+        parser.error('Report exists')
+    opener = urllib.request.build_opener(urllib.request.ProxyHandler({}))
+    checks, fixture_user, fixture_agent = [], None, None
+    completed = False
+
+    def request(path, token=None, data=None, method=None, tenant=TARGET_TENANT):
+        headers = {'Content-Type': 'application/json'}
+        if token:
+            headers.update(Authorization='Bearer ' + token)
+            if tenant:
+                headers['X-Tenant-ID'] = str(tenant)
+        req = urllib.request.Request('http://127.0.0.1:18080' + path, headers=headers,
+                                     data=json.dumps(data).encode() if data is not None else None,
+                                     method=method)
+        try:
+            with opener.open(req, timeout=30) as response:
+                return response.status, json.load(response)
+        except urllib.error.HTTPError as error:
+            return error.code, {}
+
+    def check(name, passed):
+        checks.append({'check': name, 'passed': bool(passed)})
+
+    before = target_snapshot()
+    if before['database'] != TARGET_DATABASE:
+        raise RuntimeError('Acceptance database mismatch')
+    credentials = json.loads(args.credentials.read_text())
+    status, auth = request('/api/v1/auth/login', data={k: credentials[k] for k in ('email', 'password')})
+    if status != 200 or not auth.get('token'):
+        raise RuntimeError('Acceptance administrator login failed')
+    token = auth['token']
+    expected = json.loads(sql_run(f"SELECT json_agg(json_build_object('kind',source_kind,'source_id',source_id,'id',target_id,'native',native_snapshot)) FROM {LEDGER} WHERE target_tenant_id={TARGET_TENANT} AND source_kind IN ('agent','skill');"))
+    agents = [a for a in expected if a['kind'] == 'agent']
+    skills = [a for a in expected if a['kind'] == 'skill']
+    try:
+        status, response = request('/api/v1/agents', token)
+        listed = {a['id']: a for a in response.get('data', [])}
+        check('administrator_sees_all_15_agents', status == 200 and len(agents) == 15 and all(a['id'] in listed for a in agents))
+        for item in agents:
+            status, response = request('/api/v1/agents/' + item['id'], token)
+            native, current = item['native'], response.get('data', {})
+            check('agent_' + str(item['source_id']) + '_body_model_bindings_and_owner', status == 200 and
+                  all(current.get(k) == native[k] for k in ('name', 'created_by', 'visibility', 'enabled')) and
+                  all(current.get('config', {}).get(k, []) == native['config'][k]
+                      for k in ('system_prompt', 'model_id', 'knowledge_bases', 'instruction_skill_ids')))
+        status, response = request('/api/v1/skills/instructions', token)
+        listed = {a['id']: a for a in response.get('data', [])}
+        check('administrator_sees_all_9_skills', status == 200 and len(skills) == 9 and all(s['id'] in listed for s in skills))
+        for item in skills:
+            status, response = request('/api/v1/skills/instructions/' + item['id'], token)
+            current, native = response.get('data', {}), item['native']
+            check('skill_' + str(item['source_id']) + '_body_and_owner', status == 200 and
+                  all(current.get(k) == native[k] for k in ('name', 'instructions', 'created_by', 'visibility', 'enabled')))
+        for endpoint in ('/api/v1/agents', '/api/v1/skills/instructions'):
+            status, _ = request(endpoint)
+            check('anonymous_' + endpoint.rsplit('/', 1)[-1] + '_denied', status in (401, 403))
+
+        suffix = secrets.token_hex(6)
+        password = secrets.token_urlsafe(18) + 'aA1!'
+        email = 'asset-check-' + suffix + '@migration.invalid'
+        status, response = request('/api/v1/system/admin/users/create', token,
+                                    {'username': 'asset-check-' + suffix, 'email': email, 'password': password})
+        fixture_user = response.get('user', {}).get('id')
+        if status != 201 or not fixture_user or str(uuid.UUID(fixture_user)) != fixture_user:
+            raise RuntimeError(f'Temporary acceptance user provisioning failed (HTTP {status})')
+        sql_run(f"INSERT INTO tenant_members(user_id,tenant_id,role,status) VALUES ({literal(fixture_user)},{TARGET_TENANT},'contributor','active');")
+        status, member_auth = request('/api/v1/auth/login', data={'email': email, 'password': password})
+        if status != 200 or not member_auth.get('token'):
+            raise RuntimeError('Temporary acceptance user login failed')
+        member_token = member_auth['token']
+        status, response = request('/api/v1/agents', member_token)
+        visible = {a['id'] for a in response.get('data', [])}
+        check('member_sees_13_global_agents_and_no_private_agents', status == 200 and
+              all((a['id'] in visible) == (a['native']['visibility'] == 'global' and a['native']['enabled']) for a in agents))
+        status, response = request('/api/v1/skills/instructions', member_token)
+        visible = {a['id'] for a in response.get('data', [])}
+        check('member_sees_7_global_skills_and_no_private_skills', status == 200 and
+              all((s['id'] in visible) == (s['native']['visibility'] == 'global') for s in skills))
+        for kind, number, endpoint in (('agent', 22, '/api/v1/agents/'), ('skill', 5, '/api/v1/skills/instructions/'), ('skill', 9, '/api/v1/skills/instructions/')):
+            status, _ = request(endpoint + asset_id(kind, number), member_token)
+            check('private_' + kind + '_' + str(number) + '_direct_read_denied', status in (403, 404))
+        # A valid no-op payload avoids modifying the original even if a guard regresses.
+        first = agents[0]
+        status, _ = request('/api/v1/agents/' + first['id'], member_token,
+                            {'name': first['native']['name'], 'config': first['native']['config']}, 'PUT')
+        check('member_cannot_update_global_original_agent', status in (403, 404))
+        status, _ = request('/api/v1/skills/instructions/mount', member_token,
+                            {'agent_ids': [first['id']], 'skill_ids': [asset_id('skill', 1)], 'mode': 'add'})
+        check('member_cannot_mount_on_another_owners_agent', status in (403, 404))
+        status, response = request('/api/v1/agents', member_token, {
+            'name': 'asset-check-' + suffix, 'config': {'agent_mode': 'quick-answer', 'kb_selection_mode': 'none',
+            'skills_selection_mode': 'none', 'model_id': first['native']['config']['model_id']}})
+        fixture_agent = response.get('data', {}).get('id')
+        if status != 201 or not fixture_agent or str(uuid.UUID(fixture_agent)) != fixture_agent:
+            raise RuntimeError('Temporary Agent creation failed')
+        status, response = request('/api/v1/skills/instructions/mount', member_token,
+                                    {'agent_ids': [fixture_agent], 'skill_ids': [asset_id('skill', 1)], 'mode': 'add'})
+        check('member_can_mount_global_skill_on_own_agent', status == 200)
+        status, response = request('/api/v1/agents/' + fixture_agent, member_token)
+        check('mounted_global_skill_persisted', status == 200 and asset_id('skill', 1) in response.get('data', {}).get('config', {}).get('instruction_skill_ids', []))
+        status, _ = request('/api/v1/skills/instructions/mount', member_token,
+                            {'agent_ids': [fixture_agent], 'skill_ids': [asset_id('skill', 5)], 'mode': 'add'})
+        check('member_cannot_mount_private_skill', status in (403, 404))
+        status, _ = request('/api/v1/agents/' + first['id'], member_token, tenant=10060)
+        check('unrelated_tenant_header_denied', status in (403, 404))
+        completed = True
+    finally:
+        if fixture_user:
+            # Scope cleanup by the exact user returned by this run, never by name prefixes.
+            sql_run(f"BEGIN; DELETE FROM custom_agents WHERE created_by={literal(fixture_user)}; DELETE FROM tenant_members WHERE user_id={literal(fixture_user)} AND tenant_id={TARGET_TENANT}; DELETE FROM auth_tokens WHERE user_id={literal(fixture_user)}; UPDATE users SET is_active=false,updated_at=now() WHERE id={literal(fixture_user)}; COMMIT;")
+        check('existing_assets_models_and_knowledge_unchanged', before == target_snapshot())
+        check('all_api_checks_completed', completed)
+        result = {'passed': all(c['passed'] for c in checks), 'checks': checks,
+                  'fixture_user_deactivated': bool(fixture_user), 'fixture_agent_removed': bool(fixture_agent)}
+        save_json(args.out, result)
+    print(json.dumps(result))
+    return 0 if result['passed'] else 1
+
+
+if __name__ == '__main__':
+    raise SystemExit(main())