steam-backlog-enforcer/steam_backlog_enforcer/tests/conftest.py
Krzysztof kuhy Rudnicki 21fe2f7742 Stop the enforcer launching Steam and notifications as root
The enforce service runs as root (no User=) but sets DISPLAY=:0, so any GUI
it starts lands on the desktop session. Two resolvers disagreed about who to
drop privileges to:

  library_hider._resolve_desktop_user()  read STEAM_ENFORCER_DESKTOP_USER
  game_install._get_real_user()          read only SUDO_USER or USER

systemd sets neither of the latter, so _get_real_user() returned None under
the service and every `geteuid() == 0 and real_user and ...` guard fell
through to running as root. Steam answered with a zenity modal ("Cannot run
as root user", /usr/lib/steam/steam:261) on screen.

Confirmed from the live process tree: root `bash /usr/lib/steam/steam
-cef-disable-gpu ... steam://install/618510` with a root zenity child. It
never reached the journal, because that text goes to zenity and _run_as_user
sends child output to DEVNULL.

- _desktop_env: add resolve_desktop_user/desktop_uid/desktop_user_cmd. Only
  the argv builder is shared, never the spawn call: tests/_no_subprocess.py
  patches subprocess per module by name, so a spawn site in an unpatched
  module could fire a real `sudo -u kuhy steam`.
- game_install._get_real_user: delegate to the shared resolver. This alone
  also fixes the root `steam -silent` in _ensure_steam_running and the
  no-op os.chown on new appmanifests.
- _trigger_steam_install / enforcer.send_notification: drop privileges.
  send_notification had no DBUS_SESSION_BUS_ADDRESS, so it silently reached
  nobody for all six of its callers.
- _run_as_user: fail closed. Running unchanged as root when no desktop user
  resolves is what put the modal on screen; refuse and log instead.

Also stop the retry storm behind it. steamapps does not exist (Steam has
never completed sign-in), so is_game_installed() was always False and the
loop re-triggered every allowed game every pass: 1656 attempts in 30
minutes, service RSS 1.5 GB (peak 4.3 GB), a FileNotFoundError traceback
each time. Guard install_game and _reinstall_missing_allowed on
steam_library_ready() -- a missing library means no install can succeed by
any route, so this is a correctness check rather than a tuned retry limit.

The module splits here are forced by the pre-commit 250-line gate, which
blocks any commit touching an over-cap file: game_install, library_hider and
_enforce_loop were already over before this change. They are split by
responsibility (_cdp transport, _steam_launch lifecycle, _steam_process
spawning, _steam_errors, _steam_client, _game_names, game_uninstall,
_enforce_steps, _owned_apps_cache, _echo, _protected_apps). game_install and
library_hider re-export their old public names, so the 15 modules that
import from them are untouched by this commit.

Verified as real root under the unit's environment: argv is now
`sudo -u kuhy env DISPLAY=:0 ... xdg-open steam://install/...` for both the
installer and notify-send; three enforce passes spawn no process and log
once; _run_as_user refuses with no desktop user. After restart: 0 retries,
0 tracebacks, 0 root-owned files under ~/.local/share/Steam, RSS 342 MB.

1311 tests pass. _desktop_env and _steam_state at 100% branch coverage.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016A1EYiv7e7HGhET84oa9M3
2026-08-24 13:55:44 +02:00

196 lines
7.6 KiB
Python

"""Safety conftest: prevent tests from touching real Steam/config files.
Redirects all filesystem paths used by the steam_backlog_enforcer package
to temporary directories. This stops tests from accidentally:
- Deleting real game files via uninstall_other_games / uninstall_game
- Overwriting ~/.config/steam_backlog_enforcer/state.json (losing the
user's current assignment)
- Reading real appmanifest files from ~/.local/share/Steam/steamapps
- Modifying /etc/hosts via the store blocker
- Corrupting the HLTB cache on disk
- Launching real Steam or calling real subprocess commands
- Deleting real ~/.steam, ~/.local/share/Steam, etc. via the total-block
Steam/Proton remnant purge
"""
from __future__ import annotations
from typing import TYPE_CHECKING
from unittest.mock import MagicMock, patch
import pytest
# Imported for its autouse side effect: naming it here registers it.
from steam_backlog_enforcer.tests._isolate_playtime import _isolate_playtime
from steam_backlog_enforcer.tests._no_subprocess import _block_real_subprocesses
# Re-exported so ruff --fix does not delete the imports above: pytest
# registers autouse fixtures by name, so they look unused to the linter.
__all__ = ["_block_real_subprocesses", "_isolate_playtime"]
from steam_backlog_enforcer.tests._total_block_paths import (
BLOCK,
HOSTS,
IPTABLES,
PURGE,
Paths,
build_paths,
)
if TYPE_CHECKING:
from collections.abc import Iterator
from pathlib import Path
@pytest.fixture(autouse=True)
def _isolate_filesystem(tmp_path: Path) -> Iterator[None]:
"""Redirect all real filesystem paths to a temporary directory.
Individual tests that also patch these paths will simply override
this fixture's patches for the duration of their own ``with`` block.
"""
fake_config = tmp_path / "config"
fake_config.mkdir()
fake_steamapps = tmp_path / "steamapps"
fake_steamapps.mkdir()
fake_hosts = tmp_path / "hosts"
with (
# Config / state / snapshot paths (used by State.save, Config.save, etc.)
patch(
"steam_backlog_enforcer.config.CONFIG_DIR",
fake_config,
),
patch(
"steam_backlog_enforcer.config.CONFIG_FILE",
fake_config / "config.json",
),
patch(
"steam_backlog_enforcer.config.STATE_FILE",
fake_config / "state.json",
),
patch(
"steam_backlog_enforcer.config.SNAPSHOT_FILE",
fake_config / "snapshot.json",
),
# Steam game manifests / install dirs. STEAMAPPS_PATH is canonical in
# _steam_state; game_install imports it, so both bindings need the
# patch (same gotcha as HOSTS_FILE below).
patch(
"steam_backlog_enforcer._steam_state.STEAMAPPS_PATH",
fake_steamapps,
),
patch(
"steam_backlog_enforcer.game_install.STEAMAPPS_PATH",
fake_steamapps,
),
# HLTB cache file (computed at import time from CONFIG_DIR, so
# patching CONFIG_DIR alone does not redirect it)
patch(
"steam_backlog_enforcer._hltb_types.HLTB_CACHE_FILE",
fake_config / "hltb_cache.json",
),
# /etc/hosts (store blocker + total block - each module has its own
# `from ... import HOSTS_FILE` binding, so each needs its own patch)
patch(
"steam_backlog_enforcer.store_blocker.HOSTS_FILE",
fake_hosts,
),
patch(
"steam_backlog_enforcer._total_block_hosts.HOSTS_FILE",
fake_hosts,
),
patch(
"steam_backlog_enforcer.config.HOSTS_FILE",
fake_hosts,
),
# Total-block lock + IP cache (computed at import time from
# CONFIG_DIR, so patching CONFIG_DIR alone does not redirect them -
# same gotcha as HLTB_CACHE_FILE above. A real total-block lock may
# be active on the host machine; tests must never touch it.)
patch(
"steam_backlog_enforcer._total_block.TOTAL_BLOCK_LOCK_FILE",
fake_config / "total_block_lock.json",
),
patch(
"steam_backlog_enforcer._total_block_iptables._IPTABLES_IP_CACHE_FILE",
fake_config / "total_block_ip_cache.json",
),
patch(
"steam_backlog_enforcer._total_block_purge._STEAM_PURGE_LOG_FILE",
fake_config / "total_block_purge_log.json",
),
# Steam/Proton remnant paths (real ~/.steam, ~/.local/share/Steam,
# etc. - _remove_steam_remnants() deletes these, so tests must never
# see the real ones)
patch(
"steam_backlog_enforcer._total_block_purge._STEAM_REMNANT_PATHS",
(
tmp_path / "fake_home" / ".steam",
tmp_path / "fake_home" / "steam",
tmp_path / "fake_home" / ".local" / "share" / "Steam",
tmp_path / "fake_home" / ".steampath",
tmp_path / "fake_home" / ".steampid",
tmp_path / "fake_home" / ".config" / "steamtinkerlaunch",
tmp_path / "fake_home" / ".config" / "CSDSteamBuild",
),
),
# Whitelist exception files (_whitelist module-level constants)
patch(
"steam_backlog_enforcer._whitelist.APPROVED_EXCEPTIONS_FILE",
fake_config / "approved_exceptions.json",
),
patch(
"steam_backlog_enforcer._whitelist.EXCEPTION_AUDIT_LOG",
fake_config / "exception_audit.log",
),
# _enforce_loop imports CONFIG_FILE directly; patch the local binding so
# lock_enforcement_files() uses the tmp path instead of the real one.
patch(
"steam_backlog_enforcer._enforce_loop.CONFIG_FILE",
fake_config / "config.json",
),
):
yield
@pytest.fixture(autouse=True)
def _no_real_sleep() -> Iterator[None]:
"""No-op every ``time.sleep`` used by the package.
Several modules call ``time.sleep`` for Steam-launch / install-retry /
rate-limit pacing. Individual tests that need to observe sleep
behaviour can override these patches inside their own ``with`` block.
"""
noop = MagicMock()
with (
patch("steam_backlog_enforcer._steam_client.time.sleep", noop),
patch("steam_backlog_enforcer._steam_launch.time.sleep", noop),
patch("steam_backlog_enforcer.steam_api.time.sleep", noop),
patch("steam_backlog_enforcer._enforce_loop.time.sleep", noop),
):
yield
# ──────────────────────────────────────────────────────────────
# Total-block path redirection
#
# Lives here rather than in a helper module because pytest resolves
# fixtures by name: an imported fixture looks unused to ruff, and this
# repo runs `ruff --fix --unsafe-fixes`, which deletes the import.
# ──────────────────────────────────────────────────────────────
@pytest.fixture(autouse=True)
def total_block_paths(tmp_path: Path) -> Iterator[Paths]:
"""Redirect every total-block path constant to tmp_path for one test."""
built = build_paths(tmp_path)
with (
patch(f"{BLOCK}.TOTAL_BLOCK_LOCK_FILE", built.lock_file),
patch(f"{IPTABLES}._IPTABLES_IP_CACHE_FILE", built.ip_cache_file),
patch(f"{HOSTS}.HOSTS_FILE", built.hosts_file),
patch(f"{PURGE}._STEAM_PURGE_LOG_FILE", built.purge_log_file),
patch(f"{PURGE}._STEAM_REMNANT_PATHS", built.remnant_paths),
):
yield built