tests.test_cloudflare_r2 module

Tests for serving oversized site files from Cloudflare R2.

The signer runs against AWS’s published Signature Version 4 vectors. Everything else runs against stand-ins for the two network seams, _send for the S3 API and _call for the REST API: the module’s value is in the decisions it makes, none of which needs a live bucket to prove.

class tests.test_cloudflare_r2.FakeBucket(held=(), fail=None)

Bases: object

An R2Bucket stand-in holding objects in memory.

exists(key)
put(key, path, payload_sha256)
tests.test_cloudflare_r2.project_dir(tmp_path, monkeypatch)

A checkout declaring nothing, so this repository’s own config stays out.

tests.test_cloudflare_r2.test_bucket_from_environment_names_the_missing_secrets(monkeypatch)
tests.test_cloudflare_r2.test_bucket_from_environment_needs_a_declared_bucket()
tests.test_cloudflare_r2.test_bucket_from_environment_resolves_the_account(monkeypatch)
tests.test_cloudflare_r2.test_check_passes_a_bucket_in_the_declared_state(capsys)
tests.test_cloudflare_r2.test_check_reports_drift_and_writes_nothing(state, capsys)
tests.test_cloudflare_r2.test_cli_check_needs_a_declared_bucket(project_dir)
tests.test_cloudflare_r2.test_cli_offload_drops_without_a_bucket(project_dir)
tests.test_cloudflare_r2.test_cli_wants_exactly_one_mode(project_dir, args)
tests.test_cloudflare_r2.test_create_builds_everything_from_nothing()
tests.test_cloudflare_r2.test_create_converges_without_writing_twice()
tests.test_cloudflare_r2.test_create_names_the_manual_step_when_the_zone_is_unreadable(capsys)
tests.test_cloudflare_r2.test_create_raises_the_tls_floor_of_an_attached_domain()
tests.test_cloudflare_r2.test_exists_lets_a_refusal_through()

A 403 is a credential problem, not a missing object: it must not read as “upload it”, since the upload would be refused the same way.

tests.test_cloudflare_r2.test_exists_reads_a_404_as_absence(raised, expected)
tests.test_cloudflare_r2.test_offload_drops_a_file_whose_upload_fails(tmp_path)
tests.test_cloudflare_r2.test_offload_encodes_paths_in_rules(tmp_path)

A space would split the rule into fields.

tests.test_cloudflare_r2.test_offload_keeps_pages_out_of_the_bucket(tmp_path)
tests.test_cloudflare_r2.test_offload_puts_its_rules_above_the_existing_ones(tmp_path)

Above the first dynamic rule is the only place an exact rule is free.

tests.test_cloudflare_r2.test_offload_refuses_to_break_existing_rules(tmp_path)

A full static budget cannot take one more rule without losing its last.

tests.test_cloudflare_r2.test_offload_reuses_an_object_the_bucket_holds(tmp_path)

A content-addressed key that exists already holds these exact bytes.

tests.test_cloudflare_r2.test_offload_uploads_and_redirects(tmp_path)
tests.test_cloudflare_r2.test_offload_without_a_bucket_drops_every_file(tmp_path)
tests.test_cloudflare_r2.test_oversized_files_skips_what_pages_accepts(tmp_path)
tests.test_cloudflare_r2.test_put_falls_back_to_a_byte_stream_for_an_unknown_format(tmp_path)
tests.test_cloudflare_r2.test_put_streams_the_file_with_its_type_length_and_cache_header(tmp_path)
tests.test_cloudflare_r2.test_request_is_path_style_and_signs_the_s3_headers()
tests.test_cloudflare_r2.test_run_offload_fails_loudly_on_a_dropped_file(tmp_path, monkeypatch, capsys)

The tree is still deployable, but the run must end red: a dead link is already broken, and a green run with a warning is how one hid for years.

tests.test_cloudflare_r2.test_run_offload_succeeds_when_every_file_reaches_the_bucket(tmp_path, capsys)
tests.test_cloudflare_r2.test_run_offload_touches_no_credential_when_nothing_is_oversized(tmp_path)
tests.test_cloudflare_r2.test_send_turns_a_broken_connection_into_a_cloudflare_error(raised)

A timeout mid-upload is no URLError: it must still reach the offload as an error it catches, or the deploy fails.

tests.test_cloudflare_r2.test_sign_v4_depends_on_the_secret()

Control: the vectors above would pass a signer that ignored the key.

tests.test_cloudflare_r2.test_sign_v4_matches_the_aws_test_suite(method, path, headers, payload, expected)