Внедрение KESL на ВМ2 + замена CLAMAV на KESL

VM2_services/codebase/services/message-safety/tests/test_api_contract.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+from datetime import UTC, datetime, timedelta
 from uuid import uuid4
 
 import httpx
@@ -7,6 +8,7 @@ import pytest
 
 from app.api import create_app
 from app.db import TaskStatus
+from app.file_pipeline import AntivirusStatus
 from app.repository import ConflictError
 from app.service import SafetyService
 from app.settings import EmergencyMode
@@ -54,6 +56,15 @@ class ForbiddenResolver:
         raise AssertionError("MOCK must not call DNS")
 
 
+class StaleAntivirus:
+    async def status(self):
+        return AntivirusStatus(
+            "12.4",
+            "sha256:" + "a" * 64,
+            datetime.now(UTC) - timedelta(hours=241),
+        )
+
+
 def body(kind: str, message_id=None) -> dict:
     value = {
         "message_id": str(message_id or uuid4()),
@@ -188,3 +199,27 @@ async def test_final_task_response_keeps_task_config_snapshot(active_config) ->
 
     assert final.status_code == 200
     assert final.json()["config_version"] == 99
+
+
+async def test_stale_kesl_databases_disable_only_files(active_config) -> None:
+    repo = FakeRepository()
+    service = SafetyService(
+        repo,
+        active_config,
+        EmergencyMode(),
+        ForbiddenResolver(),
+        antivirus=StaleAntivirus(),
+    )
+    async with httpx.AsyncClient(
+        transport=httpx.ASGITransport(app=create_app(service, "secret")),
+        base_url="http://test",
+        headers={"X-Service-Token": "secret"},
+    ) as client:
+        file_response = await client.post(
+            "/internal/safety/v2/messages/check", json=body("file")
+        )
+        text_response = await client.post(
+            "/internal/safety/v2/messages/check", json=body("text")
+        )
+    assert file_response.status_code == 503
+    assert text_response.status_code == 200