8b84378fe1
Elevate MiroFish/CrowdSight from single-container dev to a SaaS foundation: - Local memory backend (Zep-compatible): memory services/models, local graph builder + updater, AgentActivity seam, import-boundary isolation; Zep stays default, local is opt-in behind MEMORY_BACKEND. Semantic parity not yet proven. - Durable product persistence: projects/simulations/reports schema (migration 0007) + tenant/owner-scoped ProductRepository + dual-write + scoped_project read-first + ArtifactStore abstraction; durable JobQueue + worker.py. - SaaS hardening: durable RateLimiter (wired to login), UsageService (LLM accounting), redacted AuditService, idempotency, CORS allowlist, safe API errors, single-use PasswordResetService + endpoints (covers invite-pending). - Exactly 3 roles (super_admin/admin/user) with tenant authz policy. - Admin UI: GET/POST/PATCH /api/admin/users + GET/PUT /api/admin/settings (super-admin only, encrypted/masked); AdminView.vue + SettingsView.vue with admin/super-admin route guards, th/en i18n. - Production deploy topology: multi-stage Dockerfile (frontend build + gunicorn wsgi + nginx SPA-proxy + supervisord worker), backend/wsgi.py, gunicorn dep. Backend 197 passed; frontend 10 tests + build green. ruff unavailable (gap). No commit of credentials; secrets handled via env/.env.example. Deferred: Zep semantic A/B parity, object storage cutover, mobile QA, EasyPanel container build of deploy topology.
42 lines
1.8 KiB
Python
42 lines
1.8 KiB
Python
from tempfile import TemporaryDirectory
|
|
|
|
from app.models.project import ProjectManager
|
|
from app.services.simulation_manager import SimulationManager
|
|
from test_resource_auth_scope import csrf_headers, login, make_resource_app
|
|
|
|
|
|
def test_simulation_create_rejects_in_scope_graph_from_another_project():
|
|
app, engine, organization_id, user_a_id, _user_b_id = make_resource_app()
|
|
original_projects_dir = ProjectManager.PROJECTS_DIR
|
|
original_simulations_dir = SimulationManager.SIMULATION_DATA_DIR
|
|
try:
|
|
with TemporaryDirectory() as temp_dir:
|
|
ProjectManager.PROJECTS_DIR = f"{temp_dir}/projects"
|
|
SimulationManager.SIMULATION_DATA_DIR = f"{temp_dir}/simulations"
|
|
project_a = ProjectManager.create_project(
|
|
"A", organization_id=organization_id, owner_user_id=user_a_id
|
|
)
|
|
project_a.graph_id = "graph-a"
|
|
ProjectManager.save_project(project_a)
|
|
project_b = ProjectManager.create_project(
|
|
"B", organization_id=organization_id, owner_user_id=user_a_id
|
|
)
|
|
project_b.graph_id = "graph-b"
|
|
ProjectManager.save_project(project_b)
|
|
|
|
client = app.test_client()
|
|
login(client)
|
|
response = client.post(
|
|
"/api/simulation/create",
|
|
json={"project_id": project_a.project_id, "graph_id": project_b.graph_id},
|
|
headers={
|
|
**csrf_headers(client),
|
|
"Idempotency-Key": "cross-project-graph",
|
|
},
|
|
)
|
|
assert response.status_code == 404
|
|
finally:
|
|
ProjectManager.PROJECTS_DIR = original_projects_dir
|
|
SimulationManager.SIMULATION_DATA_DIR = original_simulations_dir
|
|
engine.dispose()
|