Stefano Bertelli
0546b44507
Complete Python/NiceGUI rewrite of the Wirezone (Elixir/Phoenix) VPN management platform. All 10 implementation phases delivered. Core stack: - NiceGUI reactive UI with SQLModel ORM on PostgreSQL (asyncpg) - Alembic migrations, Valkey/Redis cache, pydantic-settings config - WireGuard management via subprocess (wg/ip/nft CLIs) - 164 tests passing, 35% code coverage Features: - User/device/rule CRUD with admin and unprivileged roles - Full device config form with per-device WG overrides - WireGuard client config generation with QR codes - REST API (v0) with Bearer token auth for all resources - TOTP MFA with QR registration and challenge flow - OIDC SSO with authlib (provider registry, auto-create users) - Magic link passwordless sign-in via email - SAML SP-initiated SSO with IdP metadata parsing - WebAuthn/FIDO2 security key registration - nftables firewall with per-user chains and masquerade - Background tasks: WG stats polling, VPN session expiry, OIDC token refresh, WAN connectivity checks - Startup reconciliation (DB ↔ WireGuard state sync) - In-memory notification system with header badge - Admin UI: users, devices, rules, settings (3 tabs), diagnostics - Loguru logging with optional timestamped file output Deployment: - Multi-stage Dockerfile (python:3.13-slim) - Docker Compose prod stack (bridge networking, NET_ADMIN, nftables) - Forgejo CI: tests → semantic versioning → Docker registry push - Health endpoint at /api/health
124 lines
3.7 KiB
Python
124 lines
3.7 KiB
Python
"""Tests for services — WireGuard and events."""
|
|
|
|
from unittest.mock import AsyncMock, patch
|
|
|
|
from wiregui.models.device import Device
|
|
from wiregui.models.rule import Rule
|
|
from wiregui.services.events import on_device_created, on_device_deleted, on_device_updated, on_rule_created
|
|
|
|
|
|
def _make_device(**kwargs) -> Device:
|
|
defaults = dict(
|
|
name="test",
|
|
public_key="pk-test",
|
|
preshared_key="psk-test",
|
|
ipv4="10.3.2.5",
|
|
ipv6="fd00::3:2:5",
|
|
user_id="00000000-0000-0000-0000-000000000000",
|
|
)
|
|
defaults.update(kwargs)
|
|
return Device(**defaults)
|
|
|
|
|
|
# --- Events (with WG enabled) ---
|
|
|
|
|
|
@patch("wiregui.services.events.get_settings")
|
|
@patch("wiregui.services.events.firewall")
|
|
@patch("wiregui.services.events.wireguard")
|
|
async def test_on_device_created_calls_add_peer(mock_wg, mock_fw, mock_settings):
|
|
mock_settings.return_value.wg_enabled = True
|
|
mock_wg.add_peer = AsyncMock()
|
|
mock_fw.add_device_jump_rule = AsyncMock()
|
|
|
|
device = _make_device()
|
|
await on_device_created(device)
|
|
|
|
mock_wg.add_peer.assert_awaited_once_with(
|
|
public_key="pk-test",
|
|
allowed_ips=["10.3.2.5/32", "fd00::3:2:5/128"],
|
|
preshared_key="psk-test",
|
|
)
|
|
mock_fw.add_device_jump_rule.assert_awaited_once()
|
|
|
|
|
|
@patch("wiregui.services.events.get_settings")
|
|
@patch("wiregui.services.events.wireguard")
|
|
async def test_on_device_deleted_calls_remove_peer(mock_wg, mock_settings):
|
|
mock_settings.return_value.wg_enabled = True
|
|
mock_wg.remove_peer = AsyncMock()
|
|
|
|
device = _make_device()
|
|
await on_device_deleted(device)
|
|
|
|
mock_wg.remove_peer.assert_awaited_once_with(public_key="pk-test")
|
|
|
|
|
|
@patch("wiregui.services.events.get_settings")
|
|
@patch("wiregui.services.events.wireguard")
|
|
async def test_on_device_updated_calls_add_peer(mock_wg, mock_settings):
|
|
mock_settings.return_value.wg_enabled = True
|
|
mock_wg.add_peer = AsyncMock()
|
|
|
|
device = _make_device()
|
|
await on_device_updated(device)
|
|
|
|
mock_wg.add_peer.assert_awaited_once()
|
|
|
|
|
|
# --- Events (WG disabled) ---
|
|
|
|
|
|
@patch("wiregui.services.events.get_settings")
|
|
@patch("wiregui.services.events.wireguard")
|
|
async def test_events_skip_when_wg_disabled(mock_wg, mock_settings):
|
|
mock_settings.return_value.wg_enabled = False
|
|
mock_wg.add_peer = AsyncMock()
|
|
mock_wg.remove_peer = AsyncMock()
|
|
|
|
device = _make_device()
|
|
await on_device_created(device)
|
|
await on_device_deleted(device)
|
|
await on_device_updated(device)
|
|
|
|
mock_wg.add_peer.assert_not_awaited()
|
|
mock_wg.remove_peer.assert_not_awaited()
|
|
|
|
|
|
# --- Events (WG error handling) ---
|
|
|
|
|
|
@patch("wiregui.services.events.get_settings")
|
|
@patch("wiregui.services.events.firewall")
|
|
@patch("wiregui.services.events.wireguard")
|
|
async def test_on_device_created_handles_wg_error(mock_wg, mock_fw, mock_settings):
|
|
mock_settings.return_value.wg_enabled = True
|
|
mock_wg.add_peer = AsyncMock(side_effect=RuntimeError("wg failed"))
|
|
mock_fw.add_device_jump_rule = AsyncMock()
|
|
|
|
device = _make_device()
|
|
# Should not raise — error is logged
|
|
await on_device_created(device)
|
|
|
|
|
|
# --- Rule events ---
|
|
|
|
|
|
@patch("wiregui.services.events.get_settings")
|
|
@patch("wiregui.services.events.firewall")
|
|
async def test_on_rule_created_calls_apply_rule(mock_fw, mock_settings):
|
|
mock_settings.return_value.wg_enabled = True
|
|
mock_fw.apply_rule = AsyncMock()
|
|
|
|
rule = Rule(
|
|
action="accept",
|
|
destination="10.0.0.0/8",
|
|
port_type="tcp",
|
|
port_range="80",
|
|
user_id="00000000-0000-0000-0000-000000000000",
|
|
)
|
|
await on_rule_created(rule)
|
|
|
|
mock_fw.apply_rule.assert_awaited_once_with(
|
|
"00000000-0000-0000-0000-000000000000", "10.0.0.0/8", "accept", "tcp", "80",
|
|
)
|