tegwick
2370f69927
Close remaining in-repo APPROVAL-WP-0002 gaps: drive GH-DEC-2026-003 against the real HTTP surface, fail closed on JWT/human-consume/static-token paths, treat audit 200 duplicates as drained, and ask KeyCape for the production audience and client grants. Assistant: grok Assistant-Session: 01a06253-e557-7971-93d9-4f4c2cfbf455
70 lines
2.2 KiB
Python
70 lines
2.2 KiB
Python
import json
|
|
|
|
import pytest
|
|
|
|
from approval_engine.cli import main
|
|
|
|
|
|
def test_migrate_verify_and_backup_commands(tmp_path, capsys):
|
|
database = tmp_path / "approval.sqlite"
|
|
backup = tmp_path / "approval.backup.sqlite"
|
|
assert main(["migrate", "--db", str(database)]) == 0
|
|
migrated = json.loads(capsys.readouterr().out)
|
|
assert migrated["ok"] is True
|
|
assert main(["verify", "--db", str(database)]) == 0
|
|
assert json.loads(capsys.readouterr().out)["schema_current"] is True
|
|
assert main(["backup", "--db", str(database), "--output", str(backup)]) == 0
|
|
assert json.loads(capsys.readouterr().out)["integrity"] == "ok"
|
|
|
|
|
|
def test_production_refuses_memory_store_before_serving():
|
|
with pytest.raises(SystemExit):
|
|
main(["serve", "--production", "--db", ":memory:"])
|
|
|
|
|
|
def test_production_requires_jwt_verifier_not_static_token(tmp_path, capsys):
|
|
database = tmp_path / "approval.sqlite"
|
|
assert main(["migrate", "--db", str(database)]) == 0
|
|
capsys.readouterr()
|
|
audit = tmp_path / "audit.token"
|
|
audit.write_text("audit")
|
|
static = tmp_path / "dev.token"
|
|
static.write_text("dev")
|
|
with pytest.raises(SystemExit):
|
|
main(
|
|
[
|
|
"serve",
|
|
"--production",
|
|
"--db",
|
|
str(database),
|
|
"--audit-url",
|
|
"http://audit-core:8080",
|
|
"--audit-token-file",
|
|
str(audit),
|
|
"--dev-token-file",
|
|
str(static),
|
|
]
|
|
)
|
|
assert "KeyCape JWT verifier" in capsys.readouterr().err
|
|
|
|
|
|
def test_production_requires_authenticated_audit_delivery(tmp_path, capsys):
|
|
database = tmp_path / "approval.sqlite"
|
|
assert main(["migrate", "--db", str(database)]) == 0
|
|
capsys.readouterr()
|
|
with pytest.raises(SystemExit):
|
|
main(
|
|
[
|
|
"serve",
|
|
"--production",
|
|
"--db",
|
|
str(database),
|
|
"--jwt-issuer",
|
|
"https://keycape.example",
|
|
"--jwt-audience",
|
|
"approval-engine",
|
|
"--jwks-url",
|
|
"https://keycape.example/jwks",
|
|
]
|
|
)
|
|
assert "authenticated audit delivery" in capsys.readouterr().err
|