Robert Syrnicki
3a9d18fcd5
wg-easy + Traefik docker-compose stack (Phase 1) plus a stdlib-only control-plane API for box registration, WireGuard peer provisioning via wg-easy, and per-box route publish/unpublish backed by Traefik's file provider (Phase 2, single-tenant mode). SQLite holds accounts/boxes/routes so a later multi-tenant shared instance is the same schema with more rows, not a reshape. wg-easy's actual REST API was verified against its source rather than assumed: it has no bearer-token auth (session-cookie login via POST /api/auth/password) and no way to accept an externally-generated public key (it always mints the keypair itself, private key included) — both corrected from the original plan during implementation.
28 lines
985 B
Python
28 lines
985 B
Python
from control_plane import accounts
|
|
from control_plane.db import Database
|
|
|
|
|
|
def test_ensure_single_tenant_account_is_idempotent(tmp_path):
|
|
db = Database(db_path=tmp_path / "gateway.db")
|
|
|
|
account_id1 = accounts.ensure_single_tenant_account(db, box_limit=5, route_limit_per_box=5)
|
|
account_id2 = accounts.ensure_single_tenant_account(db, box_limit=5, route_limit_per_box=5)
|
|
|
|
assert account_id1 == account_id2 == accounts.SINGLE_TENANT_ACCOUNT_ID
|
|
rows = db.query_all("SELECT id FROM accounts")
|
|
assert len(rows) == 1
|
|
|
|
|
|
def test_get_account(tmp_path):
|
|
db = Database(db_path=tmp_path / "gateway.db")
|
|
account_id = accounts.ensure_single_tenant_account(db, box_limit=7, route_limit_per_box=3)
|
|
|
|
row = accounts.get_account(db, account_id)
|
|
|
|
assert row["box_limit"] == 7
|
|
assert row["route_limit_per_box"] == 3
|
|
|
|
|
|
def test_get_account_missing(tmp_path):
|
|
db = Database(db_path=tmp_path / "gateway.db")
|
|
assert accounts.get_account(db, "nope") is None
|