mirror of
https://github.com/Sea-Haven-Industries/open-swe.git
synced 2026-10-01 13:13:14 +00:00
0a2e682364
* fix: scope public reviewer tokens Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com> * refactor: simplify reviewer token wiring; fix push re-scope + red test - Remove the redundant _check_or_recreate_sandbox_for_proxy / _refresh_github_proxy_or_recreate_for_proxy wrappers and call the underlying functions directly (they already default the token to None). - process_github_push_event: re-scope the GitHub App token when the push payload lacked repo privacy/id but PR metadata reveals a public repo, so reviewer.py never proxies a full-installation token for a public PR. - Clarify the two-token sequence in trigger_pr_review_from_ref. - Fix pre-existing failing test test_proxy_refresh_failure_recreates_sandbox and add coverage for _reviewer_token_for_repo + push-event scoping. --------- Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
394 lines
14 KiB
Python
394 lines
14 KiB
Python
"""Tests for the opened / ready_for_review auto-review webhook handlers."""
|
|
|
|
from __future__ import annotations
|
|
|
|
from typing import Any
|
|
from unittest.mock import AsyncMock, MagicMock, patch
|
|
|
|
import pytest
|
|
|
|
from agent import webapp
|
|
|
|
|
|
def _pr_payload(
|
|
*,
|
|
action: str,
|
|
draft: bool,
|
|
author: str = "alice",
|
|
private: bool | None = None,
|
|
) -> dict[str, Any]:
|
|
repository: dict[str, Any] = {"owner": {"login": "lc"}, "name": "repo", "id": 123}
|
|
if private is not None:
|
|
repository["private"] = private
|
|
return {
|
|
"action": action,
|
|
"repository": repository,
|
|
"pull_request": {
|
|
"number": 7,
|
|
"html_url": "https://github.com/lc/repo/pull/7",
|
|
"title": "T",
|
|
"draft": draft,
|
|
"user": {"login": author},
|
|
"head": {"sha": "headsha", "ref": "feat-x"},
|
|
"base": {"sha": "basesha", "ref": "main"},
|
|
},
|
|
"sender": {"login": author, "id": 1},
|
|
}
|
|
|
|
|
|
def _patch_dispatch_deps(monkeypatch: pytest.MonkeyPatch, fake_client: Any) -> None:
|
|
monkeypatch.setattr(
|
|
webapp,
|
|
"get_github_app_installation_token_with_expiry",
|
|
AsyncMock(return_value=("token", None)),
|
|
)
|
|
monkeypatch.setattr(webapp, "_ensure_thread_exists_for_metadata", AsyncMock(return_value=True))
|
|
monkeypatch.setattr(webapp, "persist_encrypted_github_token", AsyncMock(return_value="enc"))
|
|
monkeypatch.setattr(webapp, "set_reviewer_thread_metadata", AsyncMock())
|
|
monkeypatch.setattr(webapp, "is_thread_active", AsyncMock(return_value=False))
|
|
monkeypatch.setattr(webapp, "get_client", lambda url: fake_client)
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_pr_ready_non_draft_triggers_run(monkeypatch: pytest.MonkeyPatch) -> None:
|
|
fake_client = MagicMock()
|
|
fake_client.runs.create = AsyncMock()
|
|
_patch_dispatch_deps(monkeypatch, fake_client)
|
|
monkeypatch.setattr(webapp, "get_profile", AsyncMock(return_value=None))
|
|
monkeypatch.setattr(webapp, "get_team_settings", AsyncMock(return_value={}))
|
|
|
|
await webapp.process_github_pr_ready(_pr_payload(action="opened", draft=False))
|
|
|
|
fake_client.runs.create.assert_awaited_once()
|
|
_, kwargs = fake_client.runs.create.await_args
|
|
assert kwargs["config"]["configurable"]["source"] == "github"
|
|
assert kwargs["config"]["configurable"]["pr_number"] == 7
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_pr_ready_public_repo_uses_scoped_reviewer_token(
|
|
monkeypatch: pytest.MonkeyPatch,
|
|
) -> None:
|
|
fake_client = MagicMock()
|
|
fake_client.runs.create = AsyncMock()
|
|
get_token = AsyncMock(return_value=("scoped-token", "expires"))
|
|
monkeypatch.setattr(webapp, "get_github_app_installation_token_with_expiry", get_token)
|
|
monkeypatch.setattr(webapp, "_ensure_thread_exists_for_metadata", AsyncMock(return_value=True))
|
|
persist_token = AsyncMock(return_value="enc")
|
|
monkeypatch.setattr(webapp, "persist_encrypted_github_token", persist_token)
|
|
monkeypatch.setattr(webapp, "set_reviewer_thread_metadata", AsyncMock())
|
|
monkeypatch.setattr(webapp, "is_thread_active", AsyncMock(return_value=False))
|
|
monkeypatch.setattr(webapp, "get_client", lambda url: fake_client)
|
|
monkeypatch.setattr(webapp, "get_profile", AsyncMock(return_value=None))
|
|
monkeypatch.setattr(webapp, "get_team_settings", AsyncMock(return_value={}))
|
|
|
|
await webapp.process_github_pr_ready(_pr_payload(action="opened", draft=False, private=False))
|
|
|
|
get_token.assert_awaited_once_with(repository_ids=[123])
|
|
persist_token.assert_awaited_once()
|
|
assert persist_token.await_args.args[1] == "scoped-token"
|
|
_, kwargs = fake_client.runs.create.await_args
|
|
assert kwargs["config"]["configurable"]["repo_private"] is False
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_pr_ready_private_repo_uses_full_reviewer_token(
|
|
monkeypatch: pytest.MonkeyPatch,
|
|
) -> None:
|
|
fake_client = MagicMock()
|
|
fake_client.runs.create = AsyncMock()
|
|
get_token = AsyncMock(return_value=("full-token", "expires"))
|
|
monkeypatch.setattr(webapp, "get_github_app_installation_token_with_expiry", get_token)
|
|
monkeypatch.setattr(webapp, "_ensure_thread_exists_for_metadata", AsyncMock(return_value=True))
|
|
monkeypatch.setattr(webapp, "persist_encrypted_github_token", AsyncMock(return_value="enc"))
|
|
monkeypatch.setattr(webapp, "set_reviewer_thread_metadata", AsyncMock())
|
|
monkeypatch.setattr(webapp, "is_thread_active", AsyncMock(return_value=False))
|
|
monkeypatch.setattr(webapp, "get_client", lambda url: fake_client)
|
|
monkeypatch.setattr(webapp, "get_profile", AsyncMock(return_value=None))
|
|
monkeypatch.setattr(webapp, "get_team_settings", AsyncMock(return_value={}))
|
|
|
|
await webapp.process_github_pr_ready(_pr_payload(action="opened", draft=False, private=True))
|
|
|
|
get_token.assert_awaited_once_with()
|
|
_, kwargs = fake_client.runs.create.await_args
|
|
assert kwargs["config"]["configurable"]["repo_private"] is True
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_pr_ready_for_review_triggers_run(monkeypatch: pytest.MonkeyPatch) -> None:
|
|
fake_client = MagicMock()
|
|
fake_client.runs.create = AsyncMock()
|
|
_patch_dispatch_deps(monkeypatch, fake_client)
|
|
monkeypatch.setattr(webapp, "_get_thread_metadata_safe", AsyncMock(return_value=None))
|
|
monkeypatch.setattr(webapp, "get_profile", AsyncMock(return_value=None))
|
|
monkeypatch.setattr(webapp, "get_team_settings", AsyncMock(return_value={}))
|
|
|
|
await webapp.process_github_pr_ready(_pr_payload(action="ready_for_review", draft=False))
|
|
|
|
fake_client.runs.create.assert_awaited_once()
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_pr_ready_for_review_skips_when_head_already_reviewed(
|
|
monkeypatch: pytest.MonkeyPatch,
|
|
) -> None:
|
|
fake_client = MagicMock()
|
|
fake_client.runs.create = AsyncMock()
|
|
set_metadata = AsyncMock()
|
|
get_token = AsyncMock(return_value=("token", None))
|
|
monkeypatch.setattr(webapp, "get_github_app_installation_token_with_expiry", get_token)
|
|
monkeypatch.setattr(webapp, "set_reviewer_thread_metadata", set_metadata)
|
|
monkeypatch.setattr(
|
|
webapp,
|
|
"_get_thread_metadata_safe",
|
|
AsyncMock(
|
|
return_value={
|
|
"kind": "reviewer",
|
|
"watch": False,
|
|
"last_reviewed_sha": "headsha",
|
|
}
|
|
),
|
|
)
|
|
monkeypatch.setattr(webapp, "get_client", lambda url: fake_client)
|
|
monkeypatch.setattr(webapp, "get_profile", AsyncMock(return_value=None))
|
|
monkeypatch.setattr(webapp, "get_team_settings", AsyncMock(return_value={}))
|
|
|
|
await webapp.process_github_pr_ready(_pr_payload(action="ready_for_review", draft=False))
|
|
|
|
fake_client.runs.create.assert_not_called()
|
|
get_token.assert_not_awaited()
|
|
set_metadata.assert_awaited_once()
|
|
assert set_metadata.await_args.kwargs["watch"] is True
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_pr_ready_for_review_uses_re_review_after_previous_review(
|
|
monkeypatch: pytest.MonkeyPatch,
|
|
) -> None:
|
|
fake_client = MagicMock()
|
|
fake_client.runs.create = AsyncMock()
|
|
_patch_dispatch_deps(monkeypatch, fake_client)
|
|
monkeypatch.setattr(
|
|
webapp,
|
|
"_get_thread_metadata_safe",
|
|
AsyncMock(
|
|
return_value={
|
|
"kind": "reviewer",
|
|
"watch": False,
|
|
"last_reviewed_sha": "oldsha",
|
|
}
|
|
),
|
|
)
|
|
monkeypatch.setattr(webapp, "get_profile", AsyncMock(return_value=None))
|
|
monkeypatch.setattr(webapp, "get_team_settings", AsyncMock(return_value={}))
|
|
|
|
await webapp.process_github_pr_ready(_pr_payload(action="ready_for_review", draft=False))
|
|
|
|
fake_client.runs.create.assert_awaited_once()
|
|
_, kwargs = fake_client.runs.create.await_args
|
|
configurable = kwargs["config"]["configurable"]
|
|
assert configurable["re_review"] is True
|
|
assert configurable["last_reviewed_sha"] == "oldsha"
|
|
assert configurable["head_sha"] == "headsha"
|
|
assert "marked ready for review" in kwargs["input"]["messages"][0]["content"]
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_pr_ready_draft_user_override_off_wins_over_team_on(
|
|
monkeypatch: pytest.MonkeyPatch,
|
|
) -> None:
|
|
fake_client = MagicMock()
|
|
fake_client.runs.create = AsyncMock()
|
|
_patch_dispatch_deps(monkeypatch, fake_client)
|
|
monkeypatch.setattr(
|
|
webapp,
|
|
"get_profile",
|
|
AsyncMock(return_value={"login": "alice", "review_draft_prs": False}),
|
|
)
|
|
monkeypatch.setattr(
|
|
webapp, "get_team_settings", AsyncMock(return_value={"review_draft_prs": True})
|
|
)
|
|
|
|
await webapp.process_github_pr_ready(_pr_payload(action="opened", draft=True))
|
|
|
|
fake_client.runs.create.assert_not_called()
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_pr_ready_draft_user_override_on_wins_over_team_off(
|
|
monkeypatch: pytest.MonkeyPatch,
|
|
) -> None:
|
|
fake_client = MagicMock()
|
|
fake_client.runs.create = AsyncMock()
|
|
_patch_dispatch_deps(monkeypatch, fake_client)
|
|
monkeypatch.setattr(
|
|
webapp,
|
|
"get_profile",
|
|
AsyncMock(return_value={"login": "alice", "review_draft_prs": True}),
|
|
)
|
|
monkeypatch.setattr(
|
|
webapp,
|
|
"get_team_settings",
|
|
AsyncMock(return_value={"review_draft_prs": False}),
|
|
)
|
|
|
|
await webapp.process_github_pr_ready(_pr_payload(action="opened", draft=True))
|
|
|
|
fake_client.runs.create.assert_awaited_once()
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_pr_ready_draft_user_default_falls_back_to_team_on(
|
|
monkeypatch: pytest.MonkeyPatch,
|
|
) -> None:
|
|
fake_client = MagicMock()
|
|
fake_client.runs.create = AsyncMock()
|
|
_patch_dispatch_deps(monkeypatch, fake_client)
|
|
# User profile exists but review_draft_prs is None — inherit team default.
|
|
monkeypatch.setattr(
|
|
webapp,
|
|
"get_profile",
|
|
AsyncMock(return_value={"login": "alice", "review_draft_prs": None}),
|
|
)
|
|
monkeypatch.setattr(
|
|
webapp, "get_team_settings", AsyncMock(return_value={"review_draft_prs": True})
|
|
)
|
|
|
|
await webapp.process_github_pr_ready(_pr_payload(action="opened", draft=True))
|
|
|
|
fake_client.runs.create.assert_awaited_once()
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_pr_ready_draft_no_profile_falls_back_to_team_off(
|
|
monkeypatch: pytest.MonkeyPatch,
|
|
) -> None:
|
|
fake_client = MagicMock()
|
|
fake_client.runs.create = AsyncMock()
|
|
_patch_dispatch_deps(monkeypatch, fake_client)
|
|
# External contributor — inherit team default (off).
|
|
monkeypatch.setattr(webapp, "get_profile", AsyncMock(return_value=None))
|
|
monkeypatch.setattr(
|
|
webapp,
|
|
"get_team_settings",
|
|
AsyncMock(return_value={"review_draft_prs": False}),
|
|
)
|
|
|
|
await webapp.process_github_pr_ready(_pr_payload(action="opened", draft=True))
|
|
|
|
fake_client.runs.create.assert_not_called()
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_pr_ready_draft_no_profile_falls_back_to_team_on(
|
|
monkeypatch: pytest.MonkeyPatch,
|
|
) -> None:
|
|
fake_client = MagicMock()
|
|
fake_client.runs.create = AsyncMock()
|
|
_patch_dispatch_deps(monkeypatch, fake_client)
|
|
monkeypatch.setattr(webapp, "get_profile", AsyncMock(return_value=None))
|
|
monkeypatch.setattr(
|
|
webapp, "get_team_settings", AsyncMock(return_value={"review_draft_prs": True})
|
|
)
|
|
|
|
await webapp.process_github_pr_ready(_pr_payload(action="opened", draft=True))
|
|
|
|
fake_client.runs.create.assert_awaited_once()
|
|
|
|
|
|
def _converted_to_draft_payload(author: str = "alice") -> dict[str, Any]:
|
|
return {
|
|
"action": "converted_to_draft",
|
|
"repository": {"owner": {"login": "lc"}, "name": "repo"},
|
|
"pull_request": {
|
|
"number": 7,
|
|
"head": {"ref": "feat-x"},
|
|
"user": {"login": author},
|
|
},
|
|
}
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_converted_to_draft_disables_watch_when_drafts_off(
|
|
monkeypatch: pytest.MonkeyPatch,
|
|
) -> None:
|
|
captured: list[Any] = []
|
|
|
|
async def fake_set(thread_id: str, **kwargs: Any) -> None:
|
|
captured.append((thread_id, kwargs))
|
|
|
|
with (
|
|
patch(
|
|
"agent.webapp._get_thread_metadata_safe",
|
|
new_callable=AsyncMock,
|
|
return_value={"kind": "reviewer", "watch": True},
|
|
),
|
|
patch(
|
|
"agent.webapp.get_profile",
|
|
new_callable=AsyncMock,
|
|
return_value={"login": "alice", "review_draft_prs": False},
|
|
),
|
|
patch(
|
|
"agent.webapp.get_team_settings",
|
|
new_callable=AsyncMock,
|
|
return_value={"review_draft_prs": False},
|
|
),
|
|
patch("agent.webapp.set_reviewer_thread_metadata", side_effect=fake_set),
|
|
):
|
|
await webapp.process_github_pr_close(_converted_to_draft_payload())
|
|
assert captured and captured[0][1]["watch"] is False
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_converted_to_draft_keeps_watch_when_author_drafts_on(
|
|
monkeypatch: pytest.MonkeyPatch,
|
|
) -> None:
|
|
fake_set = AsyncMock()
|
|
with (
|
|
patch(
|
|
"agent.webapp._get_thread_metadata_safe",
|
|
new_callable=AsyncMock,
|
|
return_value={"kind": "reviewer", "watch": True},
|
|
),
|
|
patch(
|
|
"agent.webapp.get_profile",
|
|
new_callable=AsyncMock,
|
|
return_value={"login": "alice", "review_draft_prs": True},
|
|
),
|
|
patch(
|
|
"agent.webapp.get_team_settings",
|
|
new_callable=AsyncMock,
|
|
return_value={"review_draft_prs": False},
|
|
),
|
|
patch("agent.webapp.set_reviewer_thread_metadata", new=fake_set),
|
|
):
|
|
await webapp.process_github_pr_close(_converted_to_draft_payload())
|
|
fake_set.assert_not_called()
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_converted_to_draft_keeps_watch_when_team_default_drafts_on(
|
|
monkeypatch: pytest.MonkeyPatch,
|
|
) -> None:
|
|
fake_set = AsyncMock()
|
|
with (
|
|
patch(
|
|
"agent.webapp._get_thread_metadata_safe",
|
|
new_callable=AsyncMock,
|
|
return_value={"kind": "reviewer", "watch": True},
|
|
),
|
|
# Author inherits team default — team has drafts on.
|
|
patch(
|
|
"agent.webapp.get_profile",
|
|
new_callable=AsyncMock,
|
|
return_value={"login": "alice", "review_draft_prs": None},
|
|
),
|
|
patch(
|
|
"agent.webapp.get_team_settings",
|
|
new_callable=AsyncMock,
|
|
return_value={"review_draft_prs": True},
|
|
),
|
|
patch("agent.webapp.set_reviewer_thread_metadata", new=fake_set),
|
|
):
|
|
await webapp.process_github_pr_close(_converted_to_draft_payload())
|
|
fake_set.assert_not_called()
|