add p1_secret_verify: mounted-credential end-to-end auth test

probes/p1_secret_verify.py

@@ -0,0 +1,129 @@
+# Phase 1 verification: does the Kaggle-mounted secret store actually work end to end, and can a job
+# write to the Hub with it?
+#
+# This is the decisive test for D-002. It carries NO token in its source: the credential arrives via
+# the mounted private dataset dodosoomro/ounce100m-secret-store, which is the whole point of the store.
+#
+# Checks, in order:
+#   1. the mount exists and parses,
+#   2. token integrity -- length + a truncated sha256 compared against the value the bootstrap
+#      recorded, which proves the right credential without ever printing it,
+#   3. HF read auth (whoami),
+#   4. HF WRITE auth, the thing §3.13 needs: create a throwaway repo, commit a file, verify it is
+#      listed on the Hub from outside, delete it.
+#
+# Every optional diagnostic is wrapped: the bootstrap job died because one unwrapped cross-check
+# raised AFTER the real work had succeeded, so the run produced no report at all (E-012). A probe that
+# cannot survive its own instrumentation is not a probe.
+#
+# Zero GPU quota (CPU session).
+
+import hashlib
+import json
+import os
+import time
+import urllib.error
+import urllib.request
+
+R = {}
+MOUNT = "/kaggle/input/ounce100m-secret-store/credentials.json"
+DS_ID = "dodosoomro/ounce100m-secret-store"
+EXPECTED_SHA12 = "076ca223fcf6"  # recorded by p1_secret_bootstrap v1, value-free
+TEST_REPO = "Cion-lab/ounce100m-authtest-DELETEME"
+
+
+def guard(name, fn):
+    try:
+        R[name] = fn()
+    except Exception as e:
+        R[name] = {"error": f"{type(e).__name__}: {e}"[:300]}
+
+
+# ---- 1 + 2: the mount, checked without echoing anything secret
+def read_mount():
+    if not os.path.exists(MOUNT):
+        siblings = sorted(os.listdir("/kaggle/input")) if os.path.isdir("/kaggle/input") else None
+        return {"mounted": False, "kaggle_input_listing": siblings,
+                "note": "the private dataset did not mount -- creation probably never succeeded"}
+    with open(MOUNT) as f:
+        blob = json.load(f)
+    tok = blob.get("HF_TOKEN", "")
+    return {"mounted": True, "keys": sorted(blob.keys()), "token_length": len(tok),
+            "token_sha256_prefix": hashlib.sha256(tok.encode()).hexdigest()[:12],
+            "matches_bootstrap_record": hashlib.sha256(tok.encode()).hexdigest()[:12] == EXPECTED_SHA12,
+            "mode": oct(os.stat(MOUNT).st_mode & 0o777)}
+
+
+guard("mount", read_mount)
+
+tok = ""
+if isinstance(R.get("mount"), dict) and R["mount"].get("mounted"):
+    with open(MOUNT) as f:
+        tok = json.load(f).get("HF_TOKEN", "")
+
+# ---- privacy, re-proved from the outside: an anonymous download must NOT work
+def privacy():
+    url = f"https://www.kaggle.com/api/v1/datasets/download/{DS_ID}"
+    try:
+        with urllib.request.urlopen(url, timeout=60) as r:
+            return {"status": r.status, "verdict": "PUBLIC_LEAK"}
+    except urllib.error.HTTPError as e:
+        return {"status": e.code, "verdict": "PRIVATE" if e.code in (401, 403) else f"HTTP_{e.code}"}
+
+
+guard("privacy_anonymous", privacy)
+
+# ---- 3: HF read auth, using the mounted credential only in memory
+def hf_read():
+    from huggingface_hub import HfApi
+
+    api = HfApi(token=tok)
+    me = api.whoami()
+    return {"name": me.get("name"), "type": me.get("type"),
+            "can_be_org": bool(me.get("orgs")), "token_kind": me.get("full", {}).get("fullname")}
+
+
+guard("hf_whoami", hf_read)
+
+# ---- 4: HF write auth -- the capability the checkpoint cycle depends on
+def hf_write():
+    from huggingface_hub import HfApi, create_repo, delete_repo
+
+    api = HfApi(token=tok)
+    t0 = time.monotonic()
+    create_repo(TEST_REPO.split("/")[1], token=tok, repo_type="model",
+                namespace=TEST_REPO.split("/")[0], private=False, exist_ok=True)
+    api.upload_file(path_or_fileobj=b"ounce100m auth round-trip probe\n",
+                    path_in_repo="authcheck.txt", repo_id=TEST_REPO, repo_type="model",
+                    commit_message="auth write check")
+    # Independent verification: read it back over plain anonymous HTTPS, not through the client that
+    # wrote it, so a fake success in the library cannot be mistaken for a working upload path.
+    url = f"https://huggingface.co/{TEST_REPO}/resolve/main/authcheck.txt"
+    with urllib.request.urlopen(url, timeout=60) as r:
+        body = r.read()
+    verified = body.strip() == b"ounce100m auth round-trip probe"
+    delete_repo(TEST_REPO, repo_type="model", token=tok)
+    gone = False
+    try:
+        urllib.request.urlopen(url, timeout=30)
+    except urllib.error.HTTPError as e:
+        gone = e.code in (404, 401, 403)
+    except Exception:
+        pass
+    return {"created": True, "readback_verified": verified, "seconds": round(time.monotonic() - t0, 1),
+            "deleted": True, "delete_confirmed_gone": gone}
+
+
+guard("hf_write_roundtrip", hf_write)
+
+# ---- how a training job should use this, for the record
+R["usage_pattern"] = {
+    "save_notebook_datasetDataSources": [DS_ID],
+    "read": f"json.load(open({MOUNT!r}))['HF_TOKEN']",
+    "rule": "set os.environ['HF_TOKEN'] in-process; never print the value; never copy the file into "
+            "/kaggle/working, because working-dir files become kernel output artifacts",
+}
+
+print("PROBE_JSON_BEGIN")
+print(json.dumps(R, indent=1, default=str))
+print("PROBE_JSON_END")