feat: add safe blocker resolution workflow

2026-09-22 18:47:04 -03:00
parent 25af5cf0f0
commit 5180725238
7 changed files with 430 additions and 22 deletions
@@ -0,0 +1,155 @@
+from fastapi.testclient import TestClient
+from sqlalchemy import select
+
+from central.app.blocked_products import upsert_blocker
+from central.app.blocker_resolution import resolve_blocker_with_context, validate_resolution_input
+from central.app.main import create_app
+from central.app.models import AdminUser, AuditEvent, FiscalContextEntry, Job, Installation
+from central.tests.test_control_plane import seed, setup_db
+
+
+def _seed_blocker(session_factory):
+    agent_id, admin_id = seed(session_factory)
+    with session_factory() as session:
+        installation = session.scalar(select(Installation).where(Installation.agent_id == agent_id))
+        installation.company_code = "ACME-COMPANY"
+        blocker = upsert_blocker(
+            session,
+            installation.tenant_id,
+            {
+                "company": "Acme",
+                "product_code": "P-001",
+                "description": "Produto de teste",
+                "blocker_type": "BLOCKED_MISSING_EVIDENCE",
+                "field": "CFOP",
+                "reason_code": "MISSING_CONTEXT",
+                "input_fingerprint": "input-1",
+                "evidence_summary": {"source": "test"},
+            },
+            installation_id=installation.id,
+        )
+        return blocker.id, admin_id, installation.id
+
+
+def test_validate_resolution_input_accepts_known_enum_values():
+    for key, value in (("entry_scope", "INTER"), ("product_role", "RESALE")):
+        normalized, error = validate_resolution_input(
+            {"scope": "PRODUCT", "scope_key": "P-001", "key": key, "value": value, "reason": "operator note"}
+        )
+        assert error is None
+        assert normalized == {
+            "scope": "PRODUCT",
+            "scope_key": "P-001",
+            "key": key,
+            "value": value,
+            "reason": "operator note",
+        }
+
+
+def test_validate_resolution_input_rejects_unsafe_or_incomplete_values():
+    invalid_payloads = (
+        {"scope": "PRODUCT", "scope_key": "P-001", "key": "entry_scope", "value": "ARBITRARY", "reason": "note"},
+        {"scope": "PRODUCT", "scope_key": "P-001", "key": "not-a-key", "value": "x", "reason": "note"},
+        {"scope": "NCM", "scope_key": "22030000", "key": "entry_scope", "value": "INTER", "reason": "note"},
+        {"scope": "PRODUCT", "scope_key": "P-001", "key": "product_role", "value": "RESALE", "reason": ""},
+        {"scope": "PRODUCT", "key": "product_role", "value": "RESALE", "reason": "note"},
+        {"scope": "PRODUCT", "scope_key": "P-001", "key": "product_role", "value": "RESALE", "reason": "note", "context": "free text"},
+    )
+
+    for payload in invalid_payloads:
+        normalized, error = validate_resolution_input(payload)
+        assert normalized is None
+        assert error
+
+
+def test_resolve_blocker_with_context_persists_one_context_row_job_and_sanitized_audit():
+    session_factory = setup_db()
+    blocker_id, admin_id, installation_id = _seed_blocker(session_factory)
+
+    with session_factory() as session:
+        admin = session.get(AdminUser, admin_id)
+        result = resolve_blocker_with_context(
+            session,
+            blocker_id,
+            admin,
+            {
+                "scope": "PRODUCT",
+                "scope_key": "P-001",
+                "key": "product_role",
+                "value": "RESALE",
+                "reason": "reviewed token=secret-value",
+            },
+            request_ip="192.0.2.10",
+        )
+
+        entry = session.scalar(select(FiscalContextEntry).where(FiscalContextEntry.key == "product_role"))
+        job = session.get(Job, result["job_id"])
+        audit = session.get(AuditEvent, result["audit_id"])
+
+        assert result["blocker_id"] == blocker_id
+        assert entry.company_key == "ACME-COMPANY"
+        assert entry.scope == "PRODUCT"
+        assert entry.scope_key == "P-001"
+        assert entry.value == "RESALE"
+        assert entry.source == "OPERATOR"
+        assert job.agent_id == session.get(Installation, installation_id).agent_id
+        assert job.kind == "REPROCESS_PRODUCTS"
+        assert job.payload == {"codigos": ["P-001"]}
+        assert audit.action == "RESOLVE_BLOCKER_WITH_CONTEXT"
+        assert audit.target_type == "blocker"
+        assert audit.target_id == str(blocker_id)
+        assert audit.context["reprocess_job_id"] == job.id
+        assert audit.context["before"] is None
+        assert audit.context["after"]["value"] == "RESALE"
+        assert audit.context["request_ip"] == "192.0.2.10"
+        assert "secret-value" not in str(audit.context)
+        assert session.query(FiscalContextEntry).count() == 1
+
+
+def test_human_resolution_detail_requires_auth_csrf_and_renders_safe_form():
+    session_factory = setup_db()
+    blocker_id, _, _ = _seed_blocker(session_factory)
+    client = TestClient(create_app(database_probe=lambda: True, session_factory=session_factory, bootstrap_token=None))
+
+    assert client.get(f"/blockers/{blocker_id}", follow_redirects=False).status_code == 303
+    client.post("/login", data={"username": "operator", "password": "a-secure-password"}, follow_redirects=False)
+    detail = client.get(f"/blockers/{blocker_id}")
+    assert detail.status_code == 200
+    assert "Salvar contexto e reprocessar" in detail.text
+    assert "Cliente" in detail.text and "Servidor" in detail.text and "Produto" in detail.text
+    assert "Evidência" in detail.text and "Valores aceitos" in detail.text
+    assert "data-confirm" not in detail.text
+    assert 'name="context"' not in detail.text
+
+    missing_csrf = client.post(
+        f"/blockers/{blocker_id}/resolve-context",
+        data={"scope": "PRODUCT", "scope_key": "P-001", "key": "product_role", "value": "RESALE", "reason": "reviewed"},
+    )
+    assert missing_csrf.status_code == 403
+
+
+def test_human_and_json_resolution_routes_use_the_same_validated_workflow():
+    session_factory = setup_db()
+    blocker_id, _, _ = _seed_blocker(session_factory)
+    client = TestClient(create_app(database_probe=lambda: True, session_factory=session_factory, bootstrap_token=None))
+    client.post("/login", data={"username": "operator", "password": "a-secure-password"}, follow_redirects=False)
+    csrf = client.cookies.get("gti_csrf")
+
+    invalid = client.post(
+        f"/v1/blockers/{blocker_id}/resolve-human",
+        json={"csrf_token": csrf, "scope": "PRODUCT", "scope_key": "P-001", "key": "product_role", "value": "free text", "reason": "reviewed"},
+    )
+    assert invalid.status_code == 422
+
+    api_result = client.post(
+        f"/v1/blockers/{blocker_id}/resolve-human",
+        json={"csrf_token": csrf, "scope": "PRODUCT", "scope_key": "P-001", "key": "entry_scope", "value": "INTER", "reason": "reviewed"},
+    )
+    assert api_result.status_code == 200
+    assert set(api_result.json()) == {"blocker_id", "job_id", "audit_id"}
+
+    unauthenticated = TestClient(create_app(database_probe=lambda: True, session_factory=session_factory, bootstrap_token=None)).post(
+        f"/v1/blockers/{blocker_id}/resolve-human",
+        json={"scope": "PRODUCT", "scope_key": "P-001", "key": "entry_scope", "value": "INTER", "reason": "reviewed"},
+    )
+    assert unauthenticated.status_code == 401