commit aa40f0306c534721e3fd0a7e043bb29863a4a0a8
parent adb7938c48140089b0541bd5cf44d31ae3c542e2
Author: triesap <tyson@radroots.org>
Date: Mon, 21 Sep 2026 21:29:12 +0000
test: strict port-0 local servers and bounded reads (C002)
Diffstat:
6 files changed, 200 insertions(+), 45 deletions(-)
diff --git a/pixi.toml b/pixi.toml
@@ -27,6 +27,7 @@ test-runtime = "mojo -I src tests/test_runtime_paths.mojo"
test-repo-local-process = "mojo -I src tests/test_repo_local_process_contract.mojo"
test-stdio = "mojo -I src tests/test_stdio_contract.mojo"
test-provider-adapter = "mojo -I src -I tests tests/test_provider_adapter.mojo"
+test-provider-helpers = "mojo -I src -I tests tests/test_provider_helpers.mojo"
test-domain = "mojo -I src -I tests tests/test_domain.mojo"
test-assist = "mojo -I src -I tests tests/test_assist.mojo"
test-jev = "mojo -I src -I tests tests/test_jev.mojo"
@@ -62,6 +63,7 @@ test = { depends-on = [
"test-stdio-session",
"test-journeys",
"test-provider-adapter",
+ "test-provider-helpers",
"test-spec",
"test-architecture",
"test-runtime-contract",
diff --git a/tests/jev_provider_helper.mojo b/tests/jev_provider_helper.mojo
@@ -90,6 +90,21 @@ def _request_path(request: String) -> String:
return String(rest[byte=0:second_space])
+def _header_value(request: String, name: String) -> String:
+ var header_end = request.find("\r\n\r\n")
+ var header_block = request if header_end < 0 else String(
+ request[byte=0:header_end]
+ )
+ var lowered = header_block.lower()
+ var marker = lowered.find(name.lower() + ":")
+ if marker < 0:
+ return ""
+ var rest = String(header_block[byte = marker + name.byte_length() + 1 :])
+ var line_end = rest.find("\r\n")
+ var value = rest if line_end < 0 else String(rest[byte=0:line_end])
+ return String(String(value).strip())
+
+
def _json_string(value: String) -> String:
return '"' + value.replace("\\", "\\\\").replace('"', '\\"') + '"'
@@ -135,6 +150,16 @@ def _send_raw(mut stream: TcpStream, response: String) raises:
def _handle(mut stream: TcpStream, mode: String) raises:
var request = _read_request(stream)
var path = _request_path(request)
+ if mode == "echo_authorization":
+ _send(
+ stream,
+ 200,
+ '{"authorization":"'
+ + _header_value(request, "authorization")
+ + '"}',
+ )
+ stream.close()
+ return
if path != "/v1/systemone":
_send(stream, 404, '{"error":{"message":"not found"}}')
stream.close()
diff --git a/tests/max_local_process_helper.mojo b/tests/max_local_process_helper.mojo
@@ -44,13 +44,47 @@ def _read_pipe_line(mut pipe: Pipe) raises -> String:
return output^
+comptime MAX_TEST_REQUEST_BYTES = 1048576
+
+
def _read_request(mut stream: TcpStream) raises -> String:
- var buffer = List[UInt8]()
- buffer.resize(8192, 0)
- var n = stream.read(buffer.unsafe_ptr(), len(buffer))
- if n <= 0:
+ var bytes = List[UInt8]()
+ var chunk = InlineArray[Byte, 4096](fill=0)
+ var expected_total = -1
+ while True:
+ var n = stream.read(chunk.unsafe_ptr(), 4096)
+ if n <= 0:
+ break
+ for index in range(Int(n)):
+ bytes.append(chunk[index])
+ if len(bytes) > MAX_TEST_REQUEST_BYTES:
+ break
+ var text = String(unsafe_from_utf8=bytes[:])
+ var header_end = text.find("\r\n\r\n")
+ if header_end >= 0 and expected_total < 0:
+ var lowered = text.lower()
+ var marker = lowered.find("content-length:")
+ var content_length = 0
+ if marker >= 0:
+ var rest = String(text[byte = marker + 15 :])
+ var line_end = rest.find("\r\n")
+ var value = rest if line_end < 0 else String(
+ rest[byte=0:line_end]
+ )
+ content_length = Int(String(String(value).strip()))
+ expected_total = header_end + 4 + content_length
+ if expected_total >= 0 and len(bytes) >= expected_total:
+ break
+ if len(bytes) == 0:
return ""
- return String(unsafe_from_utf8=buffer[:n])
+ return String(unsafe_from_utf8=bytes[:])
+
+
+def _request_body(request: String) -> String:
+ var header_end = request.find("\r\n\r\n")
+ if header_end < 0:
+ return ""
+ return String(request[byte = header_end + 4 :])
def _request_path(request: String) -> String:
@@ -180,10 +214,20 @@ def _handle_chat_completions(mut stream: TcpStream, mode: String) raises:
_send(stream, 500, '{"error":"unsupported_mode"}')
-def _handle_request(mut stream: TcpStream, mode: String) raises:
+def _handle_request(mut stream: TcpStream, mode: String, index: Int) raises:
var request = _read_request(stream)
var path = _request_path(request)
- if path == "/health":
+ if mode == "echo_body_bytes":
+ _send(
+ stream,
+ 200,
+ '{"received_bytes":'
+ + String(_request_body(request).byte_length())
+ + "}",
+ )
+ elif mode == "count_requests":
+ _send(stream, 200, '{"request_index":' + String(index + 1) + "}")
+ elif path == "/health":
_handle_health(stream, mode)
elif path == "/v1/chat/completions":
_handle_chat_completions(stream, mode)
@@ -194,18 +238,21 @@ def _handle_request(mut stream: TcpStream, mode: String) raises:
def _serve_max_local_stub(port: Int, mode: String, requests: Int) raises:
var listener = TcpListener.bind(SocketAddr.localhost(UInt16(port)))
- _write(1, "ready\n")
- for _ in range(requests):
+ var actual_port = Int(listener.local_addr().port)
+ _write(1, "ready " + String(actual_port) + "\n")
+ for request_index in range(requests):
var stream = listener.accept()
- _handle_request(stream, mode)
+ _handle_request(stream, mode, request_index)
listener.close()
struct SpawnedMaxLocalStub(Movable):
var pid: Int
+ var port: Int
- def __init__(out self, pid: Int):
+ def __init__(out self, pid: Int, port: Int):
self.pid = pid
+ self.port = port
def wait(mut self) raises:
var process = Process(self.pid)
@@ -245,11 +292,16 @@ def spawn_max_local_stub(
stdout_pipe.set_input_only()
var ready_line = _read_pipe_line(stdout_pipe)
- if ready_line != "ready":
+ if not ready_line.startswith("ready"):
stdout_pipe.set_output_only()
var process = Process(Int(pid))
_ = process.wait()
raise Error("max_local stub failed to report ready")
+ var reported_port = port
+ var space = ready_line.find(" ")
+ if space >= 0:
+ reported_port = Int(String(ready_line[byte = space + 1 :]))
+
stdout_pipe.set_output_only()
- return SpawnedMaxLocalStub(Int(pid))
+ return SpawnedMaxLocalStub(Int(pid), reported_port)
diff --git a/tests/test_provider_adapter.mojo b/tests/test_provider_adapter.mojo
@@ -261,10 +261,10 @@ def test_max_local_transport_boundary_rejects_invalid_health_url() raises:
def test_max_local_transport_boundary_reports_unknown_chat_transport() raises:
- var provider_port = reserve_loopback_port()
var provider_stub = spawn_max_local_stub(
- provider_port, "query_rewrite_malformed_http", 1
+ 0, "query_rewrite_malformed_http", 1
)
+ var provider_port = provider_stub.port
var outcome = post_max_local_chat_completion(
_provider_config_for_port(provider_port), loads("{}")
)
@@ -278,10 +278,8 @@ def test_max_local_transport_boundary_reports_unknown_chat_transport() raises:
def test_max_local_transport_boundary_reports_unknown_health_transport() raises:
- var provider_port = reserve_loopback_port()
- var provider_stub = spawn_max_local_stub(
- provider_port, "health_malformed_http", 1
- )
+ var provider_stub = spawn_max_local_stub(0, "health_malformed_http", 1)
+ var provider_port = provider_stub.port
var outcome = get_max_local_health(_provider_config_for_port(provider_port))
assert_true(outcome.failure)
diff --git a/tests/test_provider_helpers.mojo b/tests/test_provider_helpers.mojo
@@ -0,0 +1,90 @@
+from std.testing import TestSuite, assert_true
+
+from flare.net import SocketAddr
+from flare.tcp import TcpStream
+
+from max_local_process_helper import spawn_max_local_stub
+from jev_provider_helper import spawn_jev_stub_auto
+
+
+def _client_request(
+ port: Int, path: String, body: String, auth: String = ""
+) raises -> String:
+ var client = TcpStream.connect(SocketAddr.localhost(UInt16(port)))
+ var auth_line = "" if auth == "" else "authorization: " + auth + "\r\n"
+ var headers = (
+ "POST "
+ + path
+ + " HTTP/1.1\r\nhost: 127.0.0.1\r\n"
+ + auth_line
+ + "content-type: application/json\r\ncontent-length: "
+ + String(body.byte_length())
+ + "\r\nconnection: close\r\n\r\n"
+ )
+ client.write_all(Span[UInt8, _](headers.as_bytes()))
+ var sent = 0
+ while sent < body.byte_length():
+ var end = sent + 3000
+ if end > body.byte_length():
+ end = body.byte_length()
+ client.write_all(Span[UInt8, _](body[byte=sent:end].as_bytes()))
+ sent = end
+ var buffer = InlineArray[Byte, 4096](fill=0)
+ var response = String("")
+ while True:
+ var n = client.read(buffer.unsafe_ptr(), 4096)
+ if n <= 0:
+ break
+ response += String(
+ unsafe_from_utf8=Span(ptr=buffer.unsafe_ptr(), length=Int(n))
+ )
+ client.close()
+ return response^
+
+
+def test_max_local_stub_reads_fragmented_large_body() raises:
+ var stub = spawn_max_local_stub(0, "echo_body_bytes", 1)
+ var body = String("")
+ for _ in range(9000):
+ body += "x"
+ var response = _client_request(stub.port, "/v1/chat/completions", body)
+ assert_true(response.find('"received_bytes":9000') >= 0)
+ stub.wait()
+
+
+def test_max_local_stub_counts_every_wire_attempt() raises:
+ var requests = 3
+ var stub = spawn_max_local_stub(0, "count_requests", requests)
+ for index in range(requests):
+ var response = _client_request(stub.port, "/v1/chat/completions", "{}")
+ assert_true(response.find('"request_index":' + String(index + 1)) >= 0)
+ stub.wait()
+
+
+def test_max_local_stub_rejects_unknown_path() raises:
+ var stub = spawn_max_local_stub(0, "query_rewrite_ok", 1)
+ var response = _client_request(stub.port, "/not-a-route", "{}")
+ assert_true(response.find("404") >= 0)
+ assert_true(response.find('"not_found"') >= 0)
+ stub.wait()
+
+
+def test_max_local_stub_binds_and_reports_port() raises:
+ var stub = spawn_max_local_stub(0, "count_requests", 1)
+ assert_true(stub.port > 0)
+ var response = _client_request(stub.port, "/v1/chat/completions", "{}")
+ assert_true(response.find('"request_index":1') >= 0)
+ stub.wait()
+
+
+def test_jev_stub_observes_bearer_sentinel_at_intended_origin() raises:
+ var started = spawn_jev_stub_auto("echo_authorization", 1)
+ var response = _client_request(
+ started.port, "/v1/systemone", "{}", "Bearer hyf-sentinel-token"
+ )
+ assert_true(response.find("Bearer hyf-sentinel-token") >= 0)
+ started.stub.wait()
+
+
+def main() raises:
+ TestSuite.discover_tests[__functions_in_module()]().run()
diff --git a/tests/test_stdio_contract.mojo b/tests/test_stdio_contract.mojo
@@ -198,8 +198,8 @@ def _assert_query_rewrite_provider_fallback_with_deadline(
requests: Int,
) raises:
with SafeTempDir() as temp_dir:
- var provider_port = reserve_loopback_port()
- var provider_stub = spawn_max_local_stub(provider_port, mode, requests)
+ var provider_stub = spawn_max_local_stub(0, mode, requests)
+ var provider_port = provider_stub.port
var startup_config_path = Path(temp_dir) / "explicit-hyf-config.toml"
startup_config_path.write_text(
_max_local_runtime_config_toml_with_urls(
@@ -1001,10 +1001,8 @@ def test_status_reports_unconfigured_assisted_runtime_truthfully() raises:
def test_status_reports_non_2xx_max_local_health_truthfully() raises:
with SafeTempDir() as temp_dir:
- var provider_port = reserve_loopback_port()
- var provider_stub = spawn_max_local_stub(
- provider_port, "health_non_2xx", 1
- )
+ var provider_stub = spawn_max_local_stub(0, "health_non_2xx", 1)
+ var provider_port = provider_stub.port
var startup_config_path = Path(temp_dir) / "explicit-hyf-config.toml"
startup_config_path.write_text(
_max_local_runtime_config_toml_with_urls(
@@ -1047,10 +1045,8 @@ def test_status_reports_non_2xx_max_local_health_truthfully() raises:
def test_status_reports_ready_max_local_provider_truthfully() raises:
with SafeTempDir() as temp_dir:
- var provider_port = reserve_loopback_port()
- var provider_stub = spawn_max_local_stub(
- provider_port, "query_rewrite_ok", 1
- )
+ var provider_stub = spawn_max_local_stub(0, "query_rewrite_ok", 1)
+ var provider_port = provider_stub.port
var startup_config_path = Path(temp_dir) / "explicit-hyf-config.toml"
startup_config_path.write_text(
_max_local_runtime_config_toml_with_urls(
@@ -1135,10 +1131,8 @@ def test_status_reports_ready_max_local_provider_truthfully() raises:
def test_status_bounds_max_local_health_probe_timeout() raises:
with SafeTempDir() as temp_dir:
- var provider_port = reserve_loopback_port()
- var provider_stub = spawn_max_local_stub(
- provider_port, "health_timeout", 1
- )
+ var provider_stub = spawn_max_local_stub(0, "health_timeout", 1)
+ var provider_port = provider_stub.port
var startup_config_path = Path(temp_dir) / "explicit-hyf-config.toml"
startup_config_path.write_text(
_max_local_runtime_config_toml_with_urls(
@@ -1515,10 +1509,8 @@ def test_capabilities_reports_configured_provider_runtime_truthfully() raises:
def test_capabilities_reports_ready_max_local_provider_truthfully() raises:
with SafeTempDir() as temp_dir:
- var provider_port = reserve_loopback_port()
- var provider_stub = spawn_max_local_stub(
- provider_port, "query_rewrite_ok", 1
- )
+ var provider_stub = spawn_max_local_stub(0, "query_rewrite_ok", 1)
+ var provider_port = provider_stub.port
var startup_config_path = Path(temp_dir) / "explicit-hyf-config.toml"
startup_config_path.write_text(
_max_local_runtime_config_toml_with_urls(
@@ -1581,10 +1573,8 @@ def test_capabilities_reports_ready_max_local_provider_truthfully() raises:
def test_capabilities_bounds_max_local_health_probe_timeout() raises:
with SafeTempDir() as temp_dir:
- var provider_port = reserve_loopback_port()
- var provider_stub = spawn_max_local_stub(
- provider_port, "health_timeout", 1
- )
+ var provider_stub = spawn_max_local_stub(0, "health_timeout", 1)
+ var provider_port = provider_stub.port
var startup_config_path = Path(temp_dir) / "explicit-hyf-config.toml"
startup_config_path.write_text(
_max_local_runtime_config_toml_with_urls(
@@ -1758,10 +1748,8 @@ def test_assisted_semantic_rank_falls_back_as_unsupported_provider_capability()
def test_query_rewrite_uses_max_local_provider_when_ready() raises:
with SafeTempDir() as temp_dir:
- var provider_port = reserve_loopback_port()
- var provider_stub = spawn_max_local_stub(
- provider_port, "query_rewrite_ok", 2
- )
+ var provider_stub = spawn_max_local_stub(0, "query_rewrite_ok", 2)
+ var provider_port = provider_stub.port
var startup_config_path = Path(temp_dir) / "explicit-hyf-config.toml"
startup_config_path.write_text(
_max_local_runtime_config_toml_with_urls(
