Merge branch '3.1' into base-configs-3.0

tests/api/routes/controller/test_computes.py

@@ -17,6 +17,7 @@
 
 import uuid
 import pytest
+from unittest.mock import MagicMock, patch
 
 from fastapi import FastAPI, status
 from httpx import AsyncClient
@@ -25,8 +26,7 @@ from gns3server.schemas.controller.computes import Compute
 
 pytestmark = pytest.mark.asyncio
 
-import unittest
-from tests.utils import asyncio_patch
+from tests.utils import asyncio_patch, AsyncioMagicMock
 
 
 class TestComputeRoutes:
@@ -128,6 +128,21 @@ class TestComputeFeatures:
             mock.assert_called_with("GET", "docker", "images")
             assert response.json() == [{"image": "docker1"}, {"image": "docker2"}]
 
+    async def test_compute_pull_docker_image(
+            self, app: FastAPI, client: AsyncClient, test_compute: Compute
+    ) -> None:
+
+        compute = MagicMock()
+        compute.forward = AsyncioMagicMock(return_value={})
+        with patch("gns3server.api.routes.controller.computes.Controller.instance") as controller:
+            controller.return_value.get_compute.return_value = compute
+            response = await client.post(
+                app.url_path_for("docker_pull_image", compute_id=test_compute.compute_id),
+                json={"image": "nginx:latest"}
+            )
+            compute.forward.assert_called_with("POST", "docker", "images/pull", data={"image": "nginx:latest"})
+            assert response.status_code == status.HTTP_204_NO_CONTENT
+
     async def test_compute_list_virtualbox_vms(self, app: FastAPI, client: AsyncClient) -> None:
 
         params = {

tests/api/routes/controller/test_markers.py

@@ -0,0 +1,267 @@
+# -*- coding: utf-8 -*-
+#
+# Copyright (C) 2025 GNS3 Technologies Inc.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+"""
+HTTP-route tests for the traffic-insight marker endpoints: per-link markers,
+project-level definitions, and the project-wide aggregation view.
+"""
+
+import pytest
+from fastapi import FastAPI, status
+from httpx import AsyncClient
+
+from tests.utils import asyncio_patch
+
+from gns3server.controller.project import Project
+from gns3server.controller.udp_link import UDPLink
+
+pytestmark = pytest.mark.asyncio
+
+
+def _inherited(link, name="arp"):
+    """Inject an inherited marker so the controller's inheritance guard can fire."""
+    link._markers[f"global-{name}"] = {
+        "bpf": name, "tag": None, "enabled": True, "color": None,
+        "highlight_duration": None, "capture_node_id": "node-id",
+        "inherited_from": name,
+    }
+
+
+class TestMarkerRoutes:
+
+    # -----------------------------------------------------------------------
+    # Per-link markers
+    # -----------------------------------------------------------------------
+
+    async def test_create_marker(self, app: FastAPI, client: AsyncClient, project: Project) -> None:
+
+        link = UDPLink(project)
+        project._links = {link.id: link}
+
+        with asyncio_patch("gns3server.controller.udp_link.UDPLink.start_marker") as mock:
+            response = await client.post(
+                app.url_path_for("create_marker", project_id=project.id, link_id=link.id),
+                json={"bpf": "icmp", "tag": 3, "color": "#ff5722", "highlight_duration": 800},
+            )
+
+        assert response.status_code == status.HTTP_201_CREATED
+        mock.assert_called_once()
+        _, kwargs = mock.call_args
+        assert kwargs["bpf"] == "icmp"
+        assert kwargs["tag"] == 3
+        assert kwargs["color"] == "#ff5722"
+        assert kwargs["highlight_duration"] == 800
+        assert kwargs["name"].startswith("marker-")
+
+    async def test_create_marker_with_explicit_name(self, app: FastAPI, client: AsyncClient, project: Project) -> None:
+
+        link = UDPLink(project)
+        project._links = {link.id: link}
+
+        with asyncio_patch("gns3server.controller.udp_link.UDPLink.start_marker") as mock:
+            response = await client.post(
+                app.url_path_for("create_marker", project_id=project.id, link_id=link.id),
+                json={"name": "web", "bpf": "tcp port 80"},
+            )
+        assert response.status_code == status.HTTP_201_CREATED
+        _, kwargs = mock.call_args
+        assert kwargs["name"] == "web"
+
+    async def test_create_marker_global_prefix_rejected(self, app: FastAPI, client: AsyncClient, project: Project) -> None:
+
+        link = UDPLink(project)
+        project._links = {link.id: link}
+
+        with asyncio_patch("gns3server.controller.udp_link.UDPLink.start_marker") as mock:
+            response = await client.post(
+                app.url_path_for("create_marker", project_id=project.id, link_id=link.id),
+                json={"name": "global-x", "bpf": "icmp"},
+            )
+        assert response.status_code == status.HTTP_409_CONFLICT
+        assert not mock.called  # rejected before reaching the controller
+
+    async def test_create_marker_bad_format_rejected(self, app: FastAPI, client: AsyncClient, project: Project) -> None:
+
+        link = UDPLink(project)
+        project._links = {link.id: link}
+
+        response = await client.post(
+            app.url_path_for("create_marker", project_id=project.id, link_id=link.id),
+            json={"name": "bad name!", "bpf": "icmp"},
+        )
+        assert response.status_code == status.HTTP_422_UNPROCESSABLE_ENTITY
+
+    async def test_create_marker_name_too_long_rejected(self, app: FastAPI, client: AsyncClient, project: Project) -> None:
+
+        link = UDPLink(project)
+        project._links = {link.id: link}
+
+        response = await client.post(
+            app.url_path_for("create_marker", project_id=project.id, link_id=link.id),
+            json={"name": "x" * 33, "bpf": "icmp"},  # max_length is 32
+        )
+        assert response.status_code == status.HTTP_422_UNPROCESSABLE_ENTITY
+
+    async def test_get_markers(self, app: FastAPI, client: AsyncClient, project: Project) -> None:
+
+        link = UDPLink(project)
+        link._markers["web"] = {"bpf": "tcp port 80", "tag": None, "enabled": True,
+                                "color": None, "highlight_duration": 800, "capture_node_id": "n1"}
+        project._links = {link.id: link}
+
+        response = await client.get(
+            app.url_path_for("get_markers", project_id=project.id, link_id=link.id)
+        )
+        assert response.status_code == status.HTTP_200_OK
+        assert response.json()["web"]["highlight_duration"] == 800
+
+    async def test_update_marker(self, app: FastAPI, client: AsyncClient, project: Project) -> None:
+
+        link = UDPLink(project)
+        project._links = {link.id: link}
+
+        with asyncio_patch("gns3server.controller.udp_link.UDPLink.update_marker") as mock:
+            response = await client.put(
+                app.url_path_for("update_marker", project_id=project.id, link_id=link.id, marker_name="web"),
+                json={"bpf": "udp port 53", "highlight_duration": 1500},
+            )
+        assert response.status_code == status.HTTP_200_OK
+        _, kwargs = mock.call_args
+        assert kwargs["bpf"] == "udp port 53"
+        assert kwargs["highlight_duration"] == 1500
+
+    async def test_update_inherited_marker_rejected(self, app: FastAPI, client: AsyncClient, project: Project) -> None:
+
+        link = UDPLink(project)
+        _inherited(link, "arp")
+        project._links = {link.id: link}
+
+        response = await client.put(
+            app.url_path_for("update_marker", project_id=project.id, link_id=link.id, marker_name="global-arp"),
+            json={"name": "global-arp", "bpf": "arp"},
+        )
+        assert response.status_code == status.HTTP_409_CONFLICT
+        assert "inherited" in response.json()["message"]
+
+    async def test_delete_marker(self, app: FastAPI, client: AsyncClient, project: Project) -> None:
+
+        link = UDPLink(project)
+        project._links = {link.id: link}
+
+        with asyncio_patch("gns3server.controller.udp_link.UDPLink.stop_marker") as mock:
+            response = await client.delete(
+                app.url_path_for("delete_marker", project_id=project.id, link_id=link.id, marker_name="web")
+            )
+        assert response.status_code == status.HTTP_204_NO_CONTENT
+        mock.assert_called_once_with("web")
+
+    async def test_delete_inherited_marker_rejected(self, app: FastAPI, client: AsyncClient, project: Project) -> None:
+
+        link = UDPLink(project)
+        _inherited(link, "arp")
+        project._links = {link.id: link}
+
+        response = await client.delete(
+            app.url_path_for("delete_marker", project_id=project.id, link_id=link.id, marker_name="global-arp")
+        )
+        assert response.status_code == status.HTTP_409_CONFLICT
+
+    # -----------------------------------------------------------------------
+    # Project-level marker definitions
+    # -----------------------------------------------------------------------
+
+    async def test_create_marker_definition(self, app: FastAPI, client: AsyncClient, project: Project) -> None:
+
+        with asyncio_patch("gns3server.controller.project.Project.create_marker_definition") as mock:
+            response = await client.post(
+                app.url_path_for("create_marker_definition", project_id=project.id),
+                json={"name": "arp", "bpf": "arp", "highlight_duration": 1200},
+            )
+        assert response.status_code == status.HTTP_201_CREATED
+        _, kwargs = mock.call_args
+        assert kwargs["name"] == "arp"
+        assert kwargs["bpf"] == "arp"
+        assert kwargs["highlight_duration"] == 1200
+
+    async def test_create_marker_definition_global_prefix_rejected(self, app: FastAPI, client: AsyncClient, project: Project) -> None:
+
+        with asyncio_patch("gns3server.controller.project.Project.create_marker_definition") as mock:
+            response = await client.post(
+                app.url_path_for("create_marker_definition", project_id=project.id),
+                json={"name": "global-x", "bpf": "arp"},
+            )
+        assert response.status_code == status.HTTP_409_CONFLICT
+        assert not mock.called
+
+    async def test_update_marker_definition(self, app: FastAPI, client: AsyncClient, project: Project) -> None:
+
+        with asyncio_patch("gns3server.controller.project.Project.update_marker_definition") as mock:
+            response = await client.put(
+                app.url_path_for("update_marker_definition", project_id=project.id, def_name="arp"),
+                json={"bpf": "arp or rarp", "highlight_duration": 900},
+            )
+        assert response.status_code == status.HTTP_200_OK
+        _, kwargs = mock.call_args
+        assert kwargs["bpf"] == "arp or rarp"
+        assert kwargs["highlight_duration"] == 900
+
+    async def test_delete_marker_definition(self, app: FastAPI, client: AsyncClient, project: Project) -> None:
+
+        with asyncio_patch("gns3server.controller.project.Project.delete_marker_definition") as mock:
+            response = await client.delete(
+                app.url_path_for("delete_marker_definition", project_id=project.id, def_name="arp")
+            )
+        assert response.status_code == status.HTTP_204_NO_CONTENT
+        mock.assert_called_once_with("arp")
+
+    async def test_get_marker_definitions(self, app: FastAPI, client: AsyncClient, project: Project) -> None:
+
+        project._marker_definitions = {
+            "arp": {"bpf": "arp", "tag": 5, "color": None, "highlight_duration": 1200},
+        }
+        project._links = {}
+
+        response = await client.get(
+            app.url_path_for("get_marker_definitions", project_id=project.id)
+        )
+        assert response.status_code == status.HTTP_200_OK
+        body = response.json()
+        assert body["arp"]["bpf"] == "arp"
+        assert body["arp"]["highlight_duration"] == 1200
+        assert body["arp"]["link_ids"] == []
+
+    # -----------------------------------------------------------------------
+    # Aggregation
+    # -----------------------------------------------------------------------
+
+    async def test_get_project_markers(self, app: FastAPI, client: AsyncClient, project: Project) -> None:
+
+        link = UDPLink(project)
+        link._markers["icmp"] = {"bpf": "icmp", "tag": 1, "enabled": True, "color": "#ff5722",
+                                 "highlight_duration": 800, "capture_node_id": "node-1"}
+        project._links = {link.id: link}
+
+        response = await client.get(
+            app.url_path_for("get_project_markers", project_id=project.id)
+        )
+        assert response.status_code == status.HTTP_200_OK
+        body = response.json()
+        key = f"{link.id}/icmp"
+        assert key in body
+        assert body[key]["highlight_duration"] == 800
+        assert body[key]["link_id"] == link.id
+        assert body[key]["node_id"] == "node-1"

tests/api/routes/controller/test_nodes.py

@@ -553,24 +553,33 @@ class TestNodeRoutes:
             compute: Compute,
             node: Node
     ) -> None:
-    
-        response = MagicMock()
-        response.body = b"world"
-        response.status = status.HTTP_200_OK
-        compute.http_query = AsyncioMagicMock(return_value=response)
-    
+
+        # Mock the streaming response
+        async def mock_iter_chunked(chunk_size):
+            yield b"world"
+
+        mock_stream = AsyncioMagicMock()
+        mock_stream.iter_chunked = mock_iter_chunked
+        mock_stream.close = MagicMock()
+
+        mock_response = AsyncioMagicMock()
+        mock_response.status = status.HTTP_200_OK
+        mock_response.content = mock_stream
+
+        compute.http_query = AsyncioMagicMock(return_value=mock_response)
+
         response = await client.get(app.url_path_for("get_file", project_id=project.id, node_id=node.id, file_path="hello"))
         assert response.status_code == status.HTTP_200_OK
         assert response.content == b'world'
-    
+
         compute.http_query.assert_called_with(
             "GET",
             "/projects/{project_id}/files/project-files/vpcs/{node_id}/hello".format(
                 project_id=project.id,
                 node_id=node.id),
             timeout=None,
-            raw=True)
-    
+            stream=True)
+
         response = await client.get(app.url_path_for(
             "get_file",
             project_id=project.id,
@@ -595,8 +604,15 @@ class TestNodeRoutes:
             node_id=node.id,
             file_path="hello"), content=b"hello")
         assert response.status_code == status.HTTP_201_CREATED
-    
-        compute.http_query.assert_called_with("POST", "/projects/{project_id}/files/project-files/vpcs/{node_id}/hello".format(project_id=project.id, node_id=node.id), data=b'hello', timeout=None, raw=True)
+
+        # Verify http_query was called with stream parameter
+        compute.http_query.assert_called_once()
+        call_args = compute.http_query.call_args
+        assert call_args[0][0] == "POST"
+        assert call_args[0][1] == "/projects/{project_id}/files/project-files/vpcs/{node_id}/hello".format(project_id=project.id, node_id=node.id)
+        assert call_args[1]["timeout"] is None
+        # data should be an async generator from request.stream()
+        assert hasattr(call_args[1]["data"], "__aiter__")
     
         response = await client.get("/projects/{project_id}/nodes/{node_id}/files/../hello".format(project_id=project.id, node_id=node.id))
         assert response.status_code == status.HTTP_404_NOT_FOUND

tests/api/routes/controller/test_users.py

@@ -255,6 +255,10 @@ class TestUserLogin:
         assert "token_type" in response.json()
         assert response.json().get("token_type") == "bearer"
 
+        # check that refresh token is returned
+        assert "refresh_token" in response.json()
+        assert response.json().get("refresh_token") is not None
+
     @pytest.mark.parametrize(
         "username, password, status_code",
         (
@@ -311,6 +315,7 @@ class TestUnauthorizedUser:
         response = await unauthorized_client.post(app.url_path_for("authenticate"), json=credentials)
         assert response.status_code == status.HTTP_200_OK
         assert response.json().get("access_token")
+        assert response.json().get("refresh_token") is not None
 
         token = response.json().get("access_token")
         response = await unauthorized_client.get(app.url_path_for("statistics"), params={"token": token})
@@ -485,6 +490,176 @@ class TestLogout:
         assert response.status_code == status.HTTP_401_UNAUTHORIZED
 
 
+class TestRefreshToken:
+
+    async def test_login_returns_refresh_token(
+            self,
+            app: FastAPI,
+            unauthorized_client: AsyncClient,
+            test_user: User,
+    ) -> None:
+
+        credentials = {"username": test_user.username, "password": "user1_password"}
+        response = await unauthorized_client.post(app.url_path_for("login"),
+                                                  data=credentials,
+                                                  headers={"content-type": "application/x-www-form-urlencoded"})
+        assert response.status_code == status.HTTP_200_OK
+        assert "refresh_token" in response.json()
+        assert response.json().get("refresh_token") is not None
+
+    async def test_authenticate_returns_refresh_token(
+            self,
+            app: FastAPI,
+            unauthorized_client: AsyncClient,
+            test_user: User,
+    ) -> None:
+
+        credentials = {"username": test_user.username, "password": "user1_password"}
+        response = await unauthorized_client.post(app.url_path_for("authenticate"), json=credentials)
+        assert response.status_code == status.HTTP_200_OK
+        assert "refresh_token" in response.json()
+        assert response.json().get("refresh_token") is not None
+
+    async def test_refresh_endpoint_returns_new_tokens(
+            self,
+            app: FastAPI,
+            unauthorized_client: AsyncClient,
+            test_user: User,
+    ) -> None:
+
+        # authenticate to get a refresh token
+        credentials = {"username": test_user.username, "password": "user1_password"}
+        auth_response = await unauthorized_client.post(app.url_path_for("authenticate"), json=credentials)
+        refresh_token = auth_response.json()["refresh_token"]
+
+        # use the refresh token at /refresh
+        response = await unauthorized_client.post(
+            app.url_path_for("refresh_access_token"),
+            json={"refresh_token": refresh_token},
+        )
+        assert response.status_code == status.HTTP_200_OK
+        assert "access_token" in response.json()
+        assert response.json().get("token_type") == "bearer"
+        assert "refresh_token" in response.json()
+        assert response.json().get("refresh_token") is not None
+
+    async def test_new_access_token_from_refresh_works_on_protected_route(
+            self,
+            app: FastAPI,
+            unauthorized_client: AsyncClient,
+            test_user: User,
+    ) -> None:
+
+        credentials = {"username": test_user.username, "password": "user1_password"}
+        auth_response = await unauthorized_client.post(app.url_path_for("authenticate"), json=credentials)
+        refresh_token = auth_response.json()["refresh_token"]
+
+        # refresh to get a new access token
+        refresh_response = await unauthorized_client.post(
+            app.url_path_for("refresh_access_token"),
+            json={"refresh_token": refresh_token},
+        )
+        new_access_token = refresh_response.json()["access_token"]
+
+        # the new access token must work on a protected route
+        response = await unauthorized_client.get(
+            app.url_path_for("get_logged_in_user"),
+            headers={"Authorization": f"Bearer {new_access_token}"},
+        )
+        assert response.status_code == status.HTTP_200_OK
+        assert response.json()["username"] == test_user.username
+
+    async def test_refresh_with_stale_token_after_logout(
+            self,
+            app: FastAPI,
+            unauthorized_client: AsyncClient,
+            test_user: User,
+    ) -> None:
+
+        # authenticate and get a refresh token
+        credentials = {"username": test_user.username, "password": "user1_password"}
+        auth_response = await unauthorized_client.post(app.url_path_for("authenticate"), json=credentials)
+        refresh_token = auth_response.json()["refresh_token"]
+
+        # logout — bumps token_version, invalidating the refresh token
+        access_token = auth_response.json()["access_token"]
+        await unauthorized_client.post(
+            app.url_path_for("logout"),
+            headers={"Authorization": f"Bearer {access_token}"}
+        )
+
+        # /refresh must now reject the stale refresh token
+        response = await unauthorized_client.post(
+            app.url_path_for("refresh_access_token"),
+            json={"refresh_token": refresh_token},
+        )
+        assert response.status_code == status.HTTP_401_UNAUTHORIZED
+
+    async def test_refresh_rejects_access_token(
+            self,
+            app: FastAPI,
+            unauthorized_client: AsyncClient,
+            test_user: User,
+    ) -> None:
+
+        # an access token presented at /refresh must be rejected
+        credentials = {"username": test_user.username, "password": "user1_password"}
+        auth_response = await unauthorized_client.post(app.url_path_for("authenticate"), json=credentials)
+        access_token = auth_response.json()["access_token"]
+
+        response = await unauthorized_client.post(
+            app.url_path_for("refresh_access_token"),
+            json={"refresh_token": access_token},
+        )
+        assert response.status_code == status.HTTP_401_UNAUTHORIZED
+
+    async def test_refresh_rejects_expired_token(
+            self,
+            app: FastAPI,
+            unauthorized_client: AsyncClient,
+            test_user: User,
+    ) -> None:
+
+        # a refresh token with an already-expired timestamp
+        expired_refresh = auth_service.create_refresh_token(test_user.username, expires_in=-1)
+
+        response = await unauthorized_client.post(
+            app.url_path_for("refresh_access_token"),
+            json={"refresh_token": expired_refresh},
+        )
+        assert response.status_code == status.HTTP_401_UNAUTHORIZED
+
+    async def test_refresh_rejects_invalid_token(
+            self,
+            app: FastAPI,
+            unauthorized_client: AsyncClient,
+    ) -> None:
+
+        response = await unauthorized_client.post(
+            app.url_path_for("refresh_access_token"),
+            json={"refresh_token": "not-a-valid-token"},
+        )
+        assert response.status_code == status.HTTP_401_UNAUTHORIZED
+
+    async def test_refresh_token_rejected_as_bearer(
+            self,
+            app: FastAPI,
+            unauthorized_client: AsyncClient,
+            test_user: User,
+    ) -> None:
+
+        # a refresh token used as a bearer access token must be rejected
+        credentials = {"username": test_user.username, "password": "user1_password"}
+        auth_response = await unauthorized_client.post(app.url_path_for("authenticate"), json=credentials)
+        refresh_token = auth_response.json()["refresh_token"]
+
+        response = await unauthorized_client.get(
+            app.url_path_for("get_logged_in_user"),
+            headers={"Authorization": f"Bearer {refresh_token}"},
+        )
+        assert response.status_code == status.HTTP_401_UNAUTHORIZED
+
+
 class TestSuperAdmin:
 
     async def test_super_admin_exists(