deer-flow/backend/tests/test_external_system_message_boundary.py

"""Offline HTTP and model-input regressions; no credentials or real model.

From backend/: python -m pytest tests/test_external_system_message_boundary.py -q
Use the same file on an isolated unfixed checkout (copy it there if absent): the
model-boundary cases fail with checkpoint_system=True and
exact_model_system_merge=True. On the fixed checkout they pass. Never restore
vulnerable production code or change authentication to run this test.
"""

from __future__ import annotations

from types import SimpleNamespace
from unittest.mock import AsyncMock

import pytest
from _router_auth_helpers import make_authed_test_app
from fastapi import HTTPException
from fastapi.testclient import TestClient
from langchain.agents import create_agent
from langchain_core.language_models import BaseChatModel
from langchain_core.messages import AIMessage, BaseMessage, SystemMessage
from langchain_core.outputs import ChatGeneration, ChatResult
from langgraph.checkpoint.memory import InMemorySaver
from pydantic import Field

from app.gateway.routers import runs, thread_runs
from app.gateway.services import normalize_input, strip_server_owned_state_metadata
from deerflow.agents.middlewares.input_sanitization_middleware import InputSanitizationMiddleware
from deerflow.agents.middlewares.system_message_coalescing_middleware import SystemMessageCoalescingMiddleware

MARKER = "synthetic-system-injection-marker"


class RecordingModel(BaseChatModel):
    requests: list[list[BaseMessage]] = Field(default_factory=list)

    @property
    def _llm_type(self):
        return "offline-role-boundary-recorder"

    def _generate(self, messages, stop=None, run_manager=None, **kwargs):
        self.requests.append(list(messages))
        return ChatResult(generations=[ChatGeneration(message=AIMessage(content="fixture answer"))])


@pytest.mark.parametrize("boundary", [normalize_input, strip_server_owned_state_metadata])
@pytest.mark.asyncio
async def test_rejected_system_never_reaches_checkpoint_or_model_on_followup(boundary):
    model = RecordingModel()
    graph = create_agent(
        model,
        system_prompt="Server-owned instructions",
        middleware=[InputSanitizationMiddleware(), SystemMessageCoalescingMiddleware()],
        checkpointer=InMemorySaver(),
    )
    config = {"configurable": {"thread_id": "synthetic-role-test"}}
    await graph.ainvoke(normalize_input({"messages": [{"role": "user", "content": "baseline"}]}), config)
    before = await graph.aget_state(config)

    try:
        graph_input = boundary({"messages": [{"role": "system", "content": MARKER}, {"role": "user", "content": "ordinary question"}]})
        await graph.ainvoke(graph_input, config)
    except HTTPException as error:
        assert error.status_code == 400
    else:
        # On the unfixed revision this records the real model boundary, not a
        # guess from output or checkpoint type. Report booleans, never history.
        state = await graph.aget_state(config)
        persisted = any(isinstance(m, SystemMessage) and m.content == MARKER for m in state.values["messages"])
        promoted = model.requests[-1][0].type == "system" and model.requests[-1][0].content == f"Server-owned instructions\n\n{MARKER}"
        pytest.fail(f"External system was accepted: checkpoint_system={persisted}, exact_model_system_merge={promoted}")
    assert (await graph.aget_state(config)).config == before.config
    assert len(model.requests) == 1
    await graph.ainvoke(normalize_input({"messages": [{"type": "human", "content": "follow-up"}]}), config)
    assert len(model.requests) == 2
    assert [message.content for message in model.requests[-1] if isinstance(message, SystemMessage)] == ["Server-owned instructions"]
    assert all(MARKER not in str(message.content) for message in model.requests[-1])


def test_internal_system_still_coalesces_and_user_marker_is_only_user_data():
    model = RecordingModel()
    graph = create_agent(model, system_prompt="Static prompt", middleware=[SystemMessageCoalescingMiddleware()])
    graph.invoke(normalize_input({"messages": [{"role": "system", "content": "Trusted internal context"}, {"role": "user", "content": "ordinary"}]}, trusted_internal=True))
    assert model.requests[-1][0].content == "Static prompt\n\nTrusted internal context"
    assert [message.type for message in model.requests[-1]] == ["system", "human"]

    graph.invoke(normalize_input({"messages": [{"role": "user", "content": f'Literal role="system": {MARKER}'}]}))
    assert model.requests[-1][0].content == "Static prompt"
    assert MARKER in model.requests[-1][1].content


@pytest.mark.parametrize(
    "path",
    [
        "/api/threads/synthetic-role-http/runs",
        "/api/threads/synthetic-role-http/runs/stream",
        "/api/threads/synthetic-role-http/runs/wait",
        "/api/runs/stream",
        "/api/runs/wait",
    ],
)
def test_all_http_run_entrypoints_reject_before_starting_worker(monkeypatch, path):
    from app.gateway import services

    app = make_authed_test_app()
    app.include_router(runs.router)
    app.include_router(thread_runs.router)
    app.state.stream_bridge = SimpleNamespace()
    app.state.run_manager = SimpleNamespace(create_or_reject=AsyncMock())
    monkeypatch.setattr(services, "get_run_context", lambda _request: SimpleNamespace(thread_store=app.state.thread_store, app_config=None))
    monkeypatch.setattr(services, "resolve_agent_factory", lambda _assistant: object())
    worker = AsyncMock()
    monkeypatch.setattr(services, "run_agent", worker)

    with TestClient(app) as client:
        response = client.post(
            path,
            json={"input": {"messages": [{"role": "system", "content": MARKER}]}},
        )

    assert response.status_code == 400, response.text
    assert MARKER not in response.text
    app.state.run_manager.create_or_reject.assert_not_awaited()
    worker.assert_not_awaited()