Merge branch 'main' into logging

dbasunag · web-flow · commit 65fe5fda2c9f · 2026-03-24T12:37:36.000-04:00
diff --git a/tests/model_registry/mcp_servers/config/conftest.py b/tests/model_registry/mcp_servers/config/conftest.py
@@ -10,10 +10,12 @@
     MCP_CATALOG_INVALID_SOURCE,
     MCP_CATALOG_SOURCE,
     MCP_CATALOG_SOURCE2,
+    MCP_CATALOG_SOURCE3,
     MCP_CATALOG_SOURCE_ID,
     MCP_CATALOG_SOURCE_NAME,
     MCP_SERVERS_YAML,
     MCP_SERVERS_YAML2,
+    MCP_SERVERS_YAML3,
     MCP_SERVERS_YAML_CATALOG_PATH,
 )
 from tests.model_registry.utils import (
@@ -63,6 +65,46 @@ def mcp_multi_source_configmap_patch(
     )
 
 
+@pytest.fixture(scope="class")
+def mcp_source_label_configmap_patch(
+    admin_client: DynamicClient,
+    model_registry_namespace: str,
+    mcp_catalog_rest_urls: list[str],
+    model_registry_rest_headers: dict[str, str],
+) -> Generator[None]:
+    """
+    Class-scoped fixture that patches the model-catalog-sources ConfigMap
+    with three MCP catalog sources: two labeled and one unlabeled.
+    Used for sourceLabel filtering tests (TC-API-036 to TC-API-039).
+    """
+    catalog_config_map, current_data = get_mcp_catalog_sources(
+        admin_client=admin_client, model_registry_namespace=model_registry_namespace
+    )
+    if "mcp_catalogs" not in current_data:
+        current_data["mcp_catalogs"] = []
+    current_data["mcp_catalogs"].extend([MCP_CATALOG_SOURCE, MCP_CATALOG_SOURCE2, MCP_CATALOG_SOURCE3])
+
+    patches = {
+        "data": {
+            "sources.yaml": yaml.dump(current_data, default_flow_style=False),
+            "mcp-servers.yaml": MCP_SERVERS_YAML,
+            "mcp-servers-2.yaml": MCP_SERVERS_YAML2,
+            "mcp-servers-3.yaml": MCP_SERVERS_YAML3,
+        }
+    }
+
+    with ResourceEditor(patches={catalog_config_map: patches}):
+        wait_for_model_catalog_pod_ready_after_deletion(
+            client=admin_client, model_registry_namespace=model_registry_namespace
+        )
+        wait_for_mcp_catalog_api(url=mcp_catalog_rest_urls[0], headers=model_registry_rest_headers)
+        yield
+
+    wait_for_model_catalog_pod_ready_after_deletion(
+        client=admin_client, model_registry_namespace=model_registry_namespace
+    )
+
+
 @pytest.fixture(scope="class")
 def mcp_invalid_yaml_configmap_patch(
     request: pytest.FixtureRequest,
diff --git a/tests/model_registry/mcp_servers/config/test_source_label.py b/tests/model_registry/mcp_servers/config/test_source_label.py
@@ -0,0 +1,73 @@
+from typing import Self
+
+import pytest
+from simple_logger.logger import get_logger
+
+from tests.model_registry.mcp_servers.constants import (
+    MCP_CATALOG_SOURCE2_NAME,
+    MCP_CATALOG_SOURCE_NAME,
+)
+from tests.model_registry.utils import execute_get_command
+
+LOGGER = get_logger(name=__name__)
+
+
+@pytest.mark.usefixtures("mcp_source_label_configmap_patch")
+class TestMCPServerSourceLabel:
+    """Tests for MCP server sourceLabel filtering (TC-API-036 to TC-API-039)."""
+
+    @pytest.mark.smoke
+    def test_mcp_server_source_label(
+        self: Self,
+        mcp_catalog_rest_urls: list[str],
+        model_registry_rest_headers: dict[str, str],
+    ):
+        """
+        Validate MCP server filtering by source label (TC-API-036, TC-API-038, TC-API-039).
+        """
+        source1_size = execute_get_command(
+            url=f"{mcp_catalog_rest_urls[0]}mcp_servers",
+            headers=model_registry_rest_headers,
+            params={"sourceLabel": MCP_CATALOG_SOURCE_NAME},
+        )["size"]
+        source2_size = execute_get_command(
+            url=f"{mcp_catalog_rest_urls[0]}mcp_servers",
+            headers=model_registry_rest_headers,
+            params={"sourceLabel": MCP_CATALOG_SOURCE2_NAME},
+        )["size"]
+        null_label_size = execute_get_command(
+            url=f"{mcp_catalog_rest_urls[0]}mcp_servers",
+            headers=model_registry_rest_headers,
+            params={"sourceLabel": "null"},
+        )["size"]
+        no_filtered_size = execute_get_command(
+            url=f"{mcp_catalog_rest_urls[0]}mcp_servers",
+            headers=model_registry_rest_headers,
+        )["size"]
+        both_labeled_size = execute_get_command(
+            url=f"{mcp_catalog_rest_urls[0]}mcp_servers",
+            headers=model_registry_rest_headers,
+            params={"sourceLabel": f"{MCP_CATALOG_SOURCE_NAME},{MCP_CATALOG_SOURCE2_NAME}"},
+        )["size"]
+        LOGGER.info(f"no_filtered_size: {no_filtered_size}")
+        assert no_filtered_size > 0
+        assert null_label_size >= 0
+        assert source1_size + source2_size == both_labeled_size
+        assert no_filtered_size == both_labeled_size + null_label_size
+
+    @pytest.mark.tier3
+    def test_mcp_server_invalid_source_label(
+        self: Self,
+        mcp_catalog_rest_urls: list[str],
+        model_registry_rest_headers: dict[str, str],
+    ):
+        """
+        Validate MCP server filtering by invalid source label (TC-API-037).
+        """
+        invalid_size = execute_get_command(
+            url=f"{mcp_catalog_rest_urls[0]}mcp_servers",
+            headers=model_registry_rest_headers,
+            params={"sourceLabel": "invalid"},
+        )["size"]
+
+        assert invalid_size == 0
diff --git a/tests/model_registry/mcp_servers/constants.py b/tests/model_registry/mcp_servers/constants.py
@@ -184,3 +184,36 @@
     "calculator": MCP_CATALOG_SOURCE_ID,
     "code-reviewer": MCP_CATALOG_SOURCE2_ID,
 }
+
+# Source 3: unlabeled source (no labels) for sourceLabel=null testing
+MCP_CATALOG_SOURCE3_ID: str = "test_mcp_servers_unlabeled"
+MCP_CATALOG_SOURCE3_NAME: str = "Test MCP Servers Unlabeled"
+MCP_SERVERS_YAML3_CATALOG_PATH: str = "/data/user-sources/mcp-servers-3.yaml"
+
+MCP_SERVERS_YAML3: str = """\
+mcp_servers:
+  - name: database-connector
+    description: "Database connection MCP server"
+    provider: "Data Tools"
+    version: "1.0.0"
+    license: "MIT"
+    tags:
+      - database
+      - sql
+    tools:
+      - name: execute_query
+        description: "Execute a database query"
+"""
+
+MCP_CATALOG_SOURCE3: dict = {
+    "name": MCP_CATALOG_SOURCE3_NAME,
+    "id": MCP_CATALOG_SOURCE3_ID,
+    "type": "yaml",
+    "enabled": True,
+    "properties": {"yamlCatalogPath": MCP_SERVERS_YAML3_CATALOG_PATH},
+}
+
+EXPECTED_MCP_SOURCE3_SERVER_NAMES: set[str] = {"database-connector"}
+EXPECTED_ALL_MCP_SERVER_NAMES_WITH_UNLABELED: set[str] = (
+    EXPECTED_ALL_MCP_SERVER_NAMES | EXPECTED_MCP_SOURCE3_SERVER_NAMES
+)
diff --git a/tests/model_registry/model_catalog/search/test_model_search.py b/tests/model_registry/model_catalog/search/test_model_search.py
@@ -40,7 +40,7 @@ def test_search_model_catalog_source_label(
         Validate search model catalog by source label
         """
 
-        redhat_ai_filter_moldels_size = get_models_from_catalog_api(
+        redhat_ai_filter_models_size = get_models_from_catalog_api(
             model_catalog_rest_url=model_catalog_rest_url,
             model_registry_rest_headers=model_registry_rest_headers,
             source_label=REDHAT_AI_CATALOG_NAME,
@@ -50,20 +50,24 @@ def test_search_model_catalog_source_label(
             model_registry_rest_headers=model_registry_rest_headers,
             source_label=REDHAT_AI_VALIDATED_UNESCAPED_CATALOG_NAME,
         )["size"]
+        null_label_models_size = get_models_from_catalog_api(
+            model_catalog_rest_url=model_catalog_rest_url,
+            model_registry_rest_headers=model_registry_rest_headers,
+            source_label="null",
+        )["size"]
         no_filtered_models_size = get_models_from_catalog_api(
             model_catalog_rest_url=model_catalog_rest_url, model_registry_rest_headers=model_registry_rest_headers
         )["size"]
-        both_filtered_models_size = get_models_from_catalog_api(
+        both_labeled_models_size = get_models_from_catalog_api(
             model_catalog_rest_url=model_catalog_rest_url,
             model_registry_rest_headers=model_registry_rest_headers,
             source_label=f"{REDHAT_AI_VALIDATED_UNESCAPED_CATALOG_NAME},{REDHAT_AI_CATALOG_NAME}",
         )["size"]
         LOGGER.info(f"no_filtered_models_size: {no_filtered_models_size}")
         assert no_filtered_models_size > 0
-        # no_filtered includes models from sources without labels (e.g. Other Models),
-        # which cannot be queried via sourceLabel, so total >= labeled sum
-        assert no_filtered_models_size >= both_filtered_models_size
-        assert redhat_ai_filter_moldels_size + redhat_ai_validated_filter_models_size == both_filtered_models_size
+        assert null_label_models_size >= 0
+        assert redhat_ai_filter_models_size + redhat_ai_validated_filter_models_size == both_labeled_models_size
+        assert no_filtered_models_size == both_labeled_models_size + null_label_models_size
 
     @pytest.mark.tier3
     def test_search_model_catalog_invalid_source_label(
@@ -74,22 +78,13 @@ def test_search_model_catalog_invalid_source_label(
         """
         Validate search model catalog by invalid source label
         """
-
-        # "null" is a valid source label for sources without explicit labels (e.g. Other Models)
-        null_size = get_models_from_catalog_api(
-            model_catalog_rest_url=model_catalog_rest_url,
-            model_registry_rest_headers=model_registry_rest_headers,
-            source_label="null",
-        )["size"]
-
         invalid_size = get_models_from_catalog_api(
             model_catalog_rest_url=model_catalog_rest_url,
             model_registry_rest_headers=model_registry_rest_headers,
             source_label="invalid",
         )["size"]
 
-        assert null_size >= 0, f"Expected non-negative size for null source label, got {null_size}"
-        assert invalid_size == 0, f"Expected 0 models for invalid source label, got {invalid_size}"
+        assert invalid_size == 0
 
     @pytest.mark.parametrize(
         "randomly_picked_model_from_catalog_api_by_source,source_filter",
diff --git a/tests/model_serving/maas_billing/maas_subscription/conftest.py b/tests/model_serving/maas_billing/maas_subscription/conftest.py
@@ -657,6 +657,36 @@ def two_active_api_key_ids(
         )
 
 
+@pytest.fixture(scope="function")
+def three_active_api_key_ids(
+    request_session_http: requests.Session,
+    base_url: str,
+    ocp_token_for_actor: str,
+) -> Generator[list[str], Any, Any]:
+    """Create three active API keys and yield their IDs for bulk-revoke tests."""
+    key_ids = [
+        create_api_key(
+            base_url=base_url,
+            ocp_user_token=ocp_token_for_actor,
+            request_session_http=request_session_http,
+            api_key_name=f"e2e-bulk-key-{index}-{generate_random_name()}",
+        )[1]["id"]
+        for index in range(1, 4)
+    ]
+    LOGGER.info(f"three_active_api_key_ids: created keys {key_ids}")
+    yield key_ids
+    for key_id in key_ids:
+        LOGGER.info(f"three_active_api_key_ids: teardown revoking key {key_id}")
+        revoke_resp, _ = revoke_api_key(
+            request_session_http=request_session_http,
+            base_url=base_url,
+            key_id=key_id,
+            ocp_user_token=ocp_token_for_actor,
+        )
+        if revoke_resp.status_code not in (200, 404):
+            raise AssertionError(f"Unexpected teardown status for key id={key_id}: {revoke_resp.status_code}")
+
+
 @pytest.fixture(scope="function")
 def active_api_key_id(
     request_session_http: requests.Session,
diff --git a/tests/model_serving/maas_billing/maas_subscription/test_api_key_bulk_operations.py b/tests/model_serving/maas_billing/maas_subscription/test_api_key_bulk_operations.py
@@ -0,0 +1,106 @@
+from __future__ import annotations
+
+import pytest
+import requests
+from simple_logger.logger import get_logger
+
+from tests.model_serving.maas_billing.maas_subscription.utils import (
+    assert_bulk_revoke_success,
+    bulk_revoke_api_keys,
+    get_api_key,
+    resolve_api_key_username,
+)
+
+LOGGER = get_logger(name=__name__)
+
+
+@pytest.mark.usefixtures(
+    "maas_subscription_controller_enabled_latest",
+    "maas_gateway_api",
+    "maas_api_gateway_reachable",
+)
+class TestAPIKeyBulkOperations:
+    """Tests for MaaS API key bulk revoke operations."""
+
+    @pytest.mark.tier1
+    @pytest.mark.parametrize("ocp_token_for_actor", [{"type": "admin"}], indirect=True)
+    def test_bulk_revoke_own_keys(
+        self,
+        request_session_http: requests.Session,
+        base_url: str,
+        ocp_token_for_actor: str,
+        three_active_api_key_ids: list[str],
+    ) -> None:
+        """Verify a user can bulk revoke all their own active API keys."""
+        username = resolve_api_key_username(
+            request_session_http=request_session_http,
+            base_url=base_url,
+            key_id=three_active_api_key_ids[0],
+            ocp_user_token=ocp_token_for_actor,
+        )
+
+        revoked_count = assert_bulk_revoke_success(
+            request_session_http=request_session_http,
+            base_url=base_url,
+            ocp_user_token=ocp_token_for_actor,
+            username=username,
+            min_revoked_count=3,
+        )
+        LOGGER.info(f"[bulk-revoke] User {username} bulk revoked {revoked_count} key(s)")
+
+        for key_id in three_active_api_key_ids:
+            get_resp, get_body = get_api_key(
+                request_session_http=request_session_http,
+                base_url=base_url,
+                key_id=key_id,
+                ocp_user_token=ocp_token_for_actor,
+            )
+            assert get_resp.status_code == 200, (
+                f"Expected 200 on GET /v1/api-keys/{key_id} after bulk-revoke, "
+                f"got {get_resp.status_code}: {get_resp.text[:200]}"
+            )
+            assert get_body.get("status") == "revoked", (
+                f"Expected key id={key_id} to have status='revoked', got: {get_body.get('status')}"
+            )
+        LOGGER.info(f"[bulk-revoke] All {len(three_active_api_key_ids)} key(s) confirmed revoked")
+
+    @pytest.mark.tier1
+    @pytest.mark.parametrize("ocp_token_for_actor", [{"type": "free"}], indirect=True)
+    def test_bulk_revoke_other_user_forbidden(
+        self,
+        request_session_http: requests.Session,
+        base_url: str,
+        ocp_token_for_actor: str,
+    ) -> None:
+        """Verify a non-admin user gets 403 when attempting to bulk revoke another user's keys."""
+        bulk_resp, _ = bulk_revoke_api_keys(
+            request_session_http=request_session_http,
+            base_url=base_url,
+            ocp_user_token=ocp_token_for_actor,
+            username="someotheruser",
+        )
+        assert bulk_resp.status_code == 403, (
+            f"Expected 403 (non-admin cannot bulk revoke other users), "
+            f"got {bulk_resp.status_code}: {bulk_resp.text[:200]}"
+        )
+        LOGGER.info("[bulk-revoke] Non-admin correctly received 403 when attempting to bulk revoke another user's keys")
+
+    @pytest.mark.tier1
+    @pytest.mark.parametrize("ocp_token_for_actor", [{"type": "free"}], indirect=True)
+    def test_bulk_revoke_admin_can_revoke_any_user(
+        self,
+        request_session_http: requests.Session,
+        base_url: str,
+        active_api_key_id: str,
+        free_user_username: str,
+        admin_ocp_token: str,
+    ) -> None:
+        """Verify an admin can bulk revoke any user's active API keys."""
+        revoked_count = assert_bulk_revoke_success(
+            request_session_http=request_session_http,
+            base_url=base_url,
+            ocp_user_token=admin_ocp_token,
+            username=free_user_username,
+            min_revoked_count=1,
+        )
+        LOGGER.info(f"[bulk-revoke] Admin successfully revoked {revoked_count} key(s) for user {free_user_username}")
diff --git a/tests/model_serving/maas_billing/maas_subscription/utils.py b/tests/model_serving/maas_billing/maas_subscription/utils.py
