coulomb/audit-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
audit-core/tests/test_senders.py
tegwick 3c2cdcdf79 AUDIT-WP-0010 T01/T03/T04 — admit tenant-engine, and the envelope does not match 
Registration: attributive, with the declared completeness_trade recorded on the
receiver side rather than only in the emitter, per §9.6's requirement that the
trade travel with the trail. tenants ["*"] is justified rather than inherited —
tenant-engine's events carry the affected tenant, the set is every tenant
including ones created later, and an explicit list would fail closed at exactly
the moment a tenant is provisioned, dead-lettering the creation evidence of the
tenant whose creation it is. source stays pinned exactly. Ingress ANDs namespace
and pod label; a weaker evidence class is not a reason for a wider network rule.
All inert until the token exists.

Then the finding T04 existed to find: tenant-engine cannot deliver a single
event today. envelope_for sends five required fields under other names —
event_id, action, resource, observed_at, details — and omits correlation_id
entirely, so normalize() raises invalid_event. Verified by running the real
envelope through the real function, not by reading.

Worse than an ordinary integration bug. The drain treats 400 as terminal, so the
outbox row is marked handled while audit-core holds only a dead letter, which is
not chained and is not custody. Lost on both sides, and since the drain is
non-blocking and attributive, nothing fails loudly — a silent total loss of the
stream presenting as a working integration.

Taking the correction the intake invited rather than accepting a lossy record.
normalize() is NOT relaxed to accept the alternate spellings: a receiver that
guesses which sender key means which stored field has made the mapping its own,
and the record stops being the sender's assertion. correlation_id cannot be
synthesized at all — an invented one ties an event to an operation audit-core
never observed.

Root cause is ours. The accepted envelope was published nowhere a sender could
read it; audit-backend-contract.md describes the stored record, and a sender
reading it would reasonably infer exactly the names tenant-engine used.
schema_version audit-core.event.v1alpha1 selects nothing here and gave a false
impression of a negotiated contract. Published docs/event-envelope.md as the
wire contract, including the point that a 400 means the event is not in the
archive and must be treated as a defect to fix rather than a delivery outcome.

T05 moved to wait: nothing to prove end to end until an event can be accepted.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Nb7Q6ZmXppNDkTWytfYqfv

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2069992@bnt-lap001
Assistant-Session: 167dd7f8-2a25-4be1-aa46-3b6f1a5f94c6
2026-09-10 16:34:45 +02:00

452 lines
16 KiB
Python
Raw Blame History

import json
from datetime import datetime, timezone
from pathlib import Path
import pytest
from audit_core.senders import SenderIdentity, SenderRegistry, WILDCARD
ROOT = Path(__file__).resolve().parents[1]
SCOPE_FILE = ROOT / "deploy" / "senders-scope.json"
def test_declared_scope_keeps_user_engine_tenants_wildcard():
scope = json.loads(SCOPE_FILE.read_text())
user_engine = next(entry for entry in scope if entry["name"] == "user-engine")
assert user_engine["tenants"] == ["*"]
assert user_engine["sources"] == ["user-engine"]
assert user_engine["may_write"] is True
assert user_engine["may_read"] is False
assert "tokens" not in user_engine
assert "token" not in user_engine
def test_scope_overlay_widens_narrow_secret_tenants(tmp_path):
secret = json.dumps(
[
{
"name": "user-engine",
"tokens": ["live-token"],
"sources": ["user-engine"],
"tenants": ["tenant:friendly:binky"],
"may_write": True,
"may_read": False,
}
]
)
env = {
"AUDIT_CORE_SENDERS": secret,
"AUDIT_CORE_SENDERS_SCOPE_PATH": str(SCOPE_FILE),
}
registry = SenderRegistry.from_env(env)
identity = registry.authenticate("Bearer live-token")
assert identity is not None
assert WILDCARD in identity.tenants
assert identity.permits_tenant("tenant:other:x")
assert identity.tokens == ("live-token",)
def test_scope_overlay_does_not_take_tokens_from_git():
overlay = json.dumps(
[
{
"name": "user-engine",
"tokens": ["must-not-be-used"],
"tenants": ["*"],
}
]
)
secret = json.dumps(
[
{
"name": "user-engine",
"tokens": ["live-token"],
"sources": ["user-engine"],
"tenants": ["tenant:friendly:binky"],
}
]
)
registry = SenderRegistry.from_env(
{"AUDIT_CORE_SENDERS": secret, "AUDIT_CORE_SENDERS_SCOPE": overlay}
)
assert registry.authenticate("Bearer must-not-be-used") is None
assert registry.authenticate("Bearer live-token") is not None
def test_missing_overlay_leaves_secret_as_is():
secret = json.dumps(
[
{
"name": "user-engine",
"tokens": ["live-token"],
"sources": ["user-engine"],
"tenants": ["tenant:friendly:binky"],
}
]
)
identity = SenderRegistry.from_env({"AUDIT_CORE_SENDERS": secret}).identities[0]
assert identity.tenants == frozenset({"tenant:friendly:binky"})
def test_temporary_sender_is_rejected_at_and_after_expiry():
registry = SenderRegistry.from_env(
{
"AUDIT_CORE_SENDERS": json.dumps(
[
{
"name": "whitehat-a",
"tokens": ["temporary"],
"sources": ["whitehat-security"],
"tenants": ["tenant:trial:whitehat-a"],
"expires_at": "2026-08-22T18:15:00Z",
}
]
)
}
)
before = datetime(2026, 8, 22, 18, 14, 59, tzinfo=timezone.utc)
boundary = datetime(2026, 8, 22, 18, 15, 0, tzinfo=timezone.utc)
assert registry.authenticate("Bearer temporary", now=before) is not None
assert registry.authenticate("Bearer temporary", now=boundary) is None
@pytest.mark.parametrize("expires_at", ["not-a-time", "2026-08-22T18:15:00"])
def test_temporary_sender_expiry_must_be_valid_and_timezone_aware(expires_at):
sender = json.dumps(
[
{
"name": "whitehat-a",
"tokens": ["temporary"],
"sources": ["whitehat-security"],
"expires_at": expires_at,
}
]
)
with pytest.raises(ValueError, match="expires_at"):
SenderRegistry.from_env({"AUDIT_CORE_SENDERS": sender})
def test_scope_overlay_cannot_remove_secret_backed_expiry():
registry = SenderRegistry.from_env(
{
"AUDIT_CORE_SENDERS": json.dumps(
[
{
"name": "user-engine",
"tokens": ["temporary"],
"sources": ["user-engine"],
"expires_at": "2026-08-22T18:15:00Z",
}
]
),
"AUDIT_CORE_SENDERS_SCOPE": json.dumps(
[{"name": "user-engine", "tenants": ["*"]}]
),
}
)
assert registry.identities[0].expires_at == datetime(
2026, 8, 22, 18, 15, 0, tzinfo=timezone.utc
)
def test_invalid_scope_overlay_is_a_startup_error():
secret = json.dumps(
[{"name": "user-engine", "tokens": ["t"], "sources": ["user-engine"]}]
)
with pytest.raises(ValueError, match="JSON list"):
SenderRegistry.from_env(
{"AUDIT_CORE_SENDERS": secret, "AUDIT_CORE_SENDERS_SCOPE": "{}"}
)
# --- AUDIT-WP-0009-T03: §9.6 evidence kind ---------------------------------
def test_evidence_kind_defaults_to_attributive():
"""A source that has not declared must not be treated as load-bearing.
The other default would have audit-core imply a completeness obligation no
source ever accepted.
"""
identity = SenderIdentity(
name="quiet", tokens=("t",), sources=frozenset({"quiet"})
)
assert identity.evidence_kind == "attributive"
assert identity.is_load_bearing is False
def test_load_bearing_is_an_explicit_declaration():
identity = SenderIdentity(
name="approval-engine",
tokens=("t",),
sources=frozenset({"approval-engine"}),
evidence_kind="load-bearing",
)
assert identity.is_load_bearing is True
def test_unknown_evidence_kind_is_refused():
with pytest.raises(ValueError, match="evidence_kind must be one of"):
SenderIdentity(
name="x", tokens=("t",), sources=frozenset({"x"}), evidence_kind="best-effort"
)
def test_attributive_source_carries_its_declared_trade():
identity = SenderIdentity(
name="tenant-engine",
tokens=("t",),
sources=frozenset({"tenant-engine"}),
completeness_trade="drain is non-blocking; emission is after commit",
)
declaration = identity.evidence_declaration()
assert declaration["completeness_trade"].startswith("drain is non-blocking")
# Neither kind licenses a completeness claim (§9.6).
assert declaration["completeness_claimed"] is False
def test_load_bearing_source_may_not_declare_a_trade():
"""§9.6 requires atomicity of it, so there is no trade to record."""
with pytest.raises(ValueError, match="may not declare a completeness_trade"):
SenderIdentity(
name="approval-engine",
tokens=("t",),
sources=frozenset({"approval-engine"}),
evidence_kind="load-bearing",
completeness_trade="emits after commit",
)
def test_blank_trade_is_refused_rather_than_stored():
with pytest.raises(ValueError, match="completeness_trade must say what"):
SenderIdentity(
name="x", tokens=("t",), sources=frozenset({"x"}), completeness_trade=" "
)
def test_registration_schema_carries_evidence_kind():
registry = SenderRegistry.from_env({
"AUDIT_CORE_SENDERS": json.dumps([
{
"name": "approval-engine",
"tokens": ["tok"],
"sources": ["approval-engine"],
"tenants": ["*"],
"evidence_kind": "load-bearing",
},
{
"name": "tenant-engine",
"tokens": ["tok2"],
"sources": ["tenant-engine"],
"tenants": ["*"],
"completeness_trade": "non-blocking drain",
},
])
})
by_name = {i.name: i for i in registry.identities}
assert by_name["approval-engine"].is_load_bearing is True
assert by_name["tenant-engine"].is_load_bearing is False
assert by_name["tenant-engine"].completeness_trade == "non-blocking drain"
def test_scope_overlay_may_raise_the_evidence_kind():
registry = SenderRegistry.from_env({
"AUDIT_CORE_SENDERS": json.dumps(
[{"name": "approval-engine", "tokens": ["tok"], "sources": ["approval-engine"]}]
),
"AUDIT_CORE_SENDERS_SCOPE": json.dumps(
[{"name": "approval-engine", "evidence_kind": "load-bearing"}]
),
})
assert registry.identities[0].is_load_bearing is True
def test_scope_overlay_may_not_downgrade_a_load_bearing_source():
"""A ConfigMap refresh must not quietly drop atomicity obligations."""
with pytest.raises(ValueError, match="may not downgrade"):
SenderRegistry.from_env({
"AUDIT_CORE_SENDERS": json.dumps([{
"name": "approval-engine",
"tokens": ["tok"],
"sources": ["approval-engine"],
"evidence_kind": "load-bearing",
}]),
"AUDIT_CORE_SENDERS_SCOPE": json.dumps(
[{"name": "approval-engine", "evidence_kind": "attributive"}]
),
})
# --- AUDIT-WP-0009-T09: approval-engine registration inputs ----------------
SCOPE_CONFIGMAP = ROOT / "deploy" / "senders-scope.yaml"
def test_declared_scope_and_configmap_stay_in_lockstep():
"""The header says to keep them in lockstep; nothing asserted it."""
yaml = pytest.importorskip("yaml")
embedded = yaml.safe_load(SCOPE_CONFIGMAP.read_text())["data"]["senders-scope.json"]
assert json.loads(embedded) == json.loads(SCOPE_FILE.read_text())
def test_approval_engine_is_declared_load_bearing():
scope = json.loads(SCOPE_FILE.read_text())
entry = next(e for e in scope if e["name"] == "approval-engine")
assert entry["evidence_kind"] == "load-bearing"
assert entry["sources"] == ["approval-engine"]
# A source does not gain a read surface by emitting.
assert entry["may_read"] is False
# §9.6 permits no completeness trade for a load-bearing source.
assert "completeness_trade" not in entry
assert "tokens" not in entry and "token" not in entry
def test_a_scope_entry_without_a_token_admits_nothing():
"""What makes it safe to land approval-engine's scope ahead of its credential."""
registry = SenderRegistry.from_env({
"AUDIT_CORE_SENDERS": json.dumps(
[{"name": "user-engine", "tokens": ["live"], "sources": ["user-engine"]}]
),
"AUDIT_CORE_SENDERS_SCOPE_PATH": str(SCOPE_FILE),
})
assert [i.name for i in registry.identities] == ["user-engine"]
assert registry.authenticate("Bearer live").name == "user-engine"
@pytest.mark.parametrize("tenant", ["platform", "tenant:coulomb", "tenant:Platform", "tenant:platform ", "tenant:customer"])
def test_approval_scope_restricts_a_stale_wildcard_registration(tenant):
registry = SenderRegistry.from_env({
"AUDIT_CORE_SENDERS": json.dumps([{
"name": "approval-engine", "tokens": ["fixture-only"],
"sources": ["*"], "tenants": ["*"],
"may_read": True, "secret_policy": "redact",
}]),
"AUDIT_CORE_SENDERS_SCOPE_PATH": str(SCOPE_FILE),
})
identity = registry.authenticate("Bearer fixture-only")
assert identity.permits_tenant("tenant:platform")
assert not identity.permits_tenant(tenant)
assert identity.permits_source("approval-engine")
assert not identity.permits_source("user-engine")
assert identity.may_write and not identity.may_read
assert identity.secret_policy == "redact"
assert identity.is_load_bearing
def test_user_engine_evidence_kind_is_not_asserted_on_its_behalf():
"""Undeclared means attributive by default, not a claim audit-core made."""
scope = json.loads(SCOPE_FILE.read_text())
entry = next(e for e in scope if e["name"] == "user-engine")
assert "evidence_kind" not in entry
# --- AUDIT-WP-0009-T11: informed-decision registration inputs --------------
def test_informed_decision_is_declared_load_bearing():
scope = json.loads(SCOPE_FILE.read_text())
entry = next(e for e in scope if e["name"] == "informed-decision")
assert entry["evidence_kind"] == "load-bearing"
assert entry["sources"] == ["informed-decision"]
assert entry["tenants"] == ["tenant:platform"]
assert entry["may_read"] is False
# §9.6 permits no completeness trade for a load-bearing source.
assert "completeness_trade" not in entry
assert "tokens" not in entry and "token" not in entry
def test_informed_decision_scope_entry_admits_nothing_without_a_token():
"""Safe to land ahead of the credential, asserted rather than read."""
registry = SenderRegistry.from_env({
"AUDIT_CORE_SENDERS": json.dumps(
[{"name": "user-engine", "tokens": ["live"], "sources": ["user-engine"]}]
),
"AUDIT_CORE_SENDERS_SCOPE_PATH": str(SCOPE_FILE),
})
assert "informed-decision" not in [i.name for i in registry.identities]
@pytest.mark.parametrize(
"tenant", ["platform", "tenant:coulomb", "tenant:Platform", "tenant:platform "]
)
def test_informed_decision_scope_restricts_a_stale_wildcard_registration(tenant):
registry = SenderRegistry.from_env({
"AUDIT_CORE_SENDERS": json.dumps([{
"name": "informed-decision", "tokens": ["fixture-only"],
"sources": ["*"], "tenants": ["*"],
"may_read": True, "secret_policy": "redact",
}]),
"AUDIT_CORE_SENDERS_SCOPE_PATH": str(SCOPE_FILE),
})
identity = registry.authenticate("Bearer fixture-only")
assert identity.permits_tenant("tenant:platform")
assert not identity.permits_tenant(tenant)
assert identity.permits_source("informed-decision")
assert not identity.permits_source("approval-engine")
assert identity.may_write and not identity.may_read
assert identity.is_load_bearing
def test_a_load_bearing_source_cannot_be_given_a_completeness_trade():
"""informed-decision declares no trade and may not acquire one by overlay."""
with pytest.raises(ValueError, match="completeness_trade"):
SenderIdentity(
name="informed-decision",
tokens=("t",),
sources=frozenset({"informed-decision"}),
evidence_kind="load-bearing",
completeness_trade="emits after commit",
)
# --- AUDIT-WP-0010: tenant-engine admission --------------------------------
def test_tenant_engine_is_attributive_with_its_trade_declared():
scope = json.loads(SCOPE_FILE.read_text())
entry = next(e for e in scope if e["name"] == "tenant-engine")
assert entry["evidence_kind"] == "attributive"
assert entry["sources"] == ["tenant-engine"]
assert entry["may_read"] is False
# §9.6 permits the trade only where it is declared. Recorded on the
# receiver side, not only in the emitter's documentation.
assert "after commit" in entry["completeness_trade"]
def test_tenant_engine_wildcard_tenant_does_not_widen_its_source():
"""The wildcard is on tenants only; source stays pinned."""
registry = SenderRegistry.from_env({
"AUDIT_CORE_SENDERS": json.dumps([{
"name": "tenant-engine", "tokens": ["fixture-only"],
"sources": ["*"], "tenants": ["*"],
}]),
"AUDIT_CORE_SENDERS_SCOPE_PATH": str(SCOPE_FILE),
})
identity = registry.authenticate("Bearer fixture-only")
assert identity.permits_tenant("tenant:anything-created-later")
assert identity.permits_source("tenant-engine")
assert not identity.permits_source("user-engine")
assert not identity.permits_source("approval-engine")
assert identity.evidence_kind == "attributive"
def test_an_overlay_cannot_lower_a_load_bearing_source_to_attributive():
"""A ConfigMap refresh must not drop §9.6 obligations. Downgrading raises."""
with pytest.raises(ValueError, match="downgrade|lower"):
SenderRegistry.from_env({
"AUDIT_CORE_SENDERS": json.dumps([{
"name": "informed-decision", "tokens": ["fixture-only"],
"sources": ["informed-decision"], "evidence_kind": "load-bearing",
}]),
"AUDIT_CORE_SENDERS_SCOPE_PATH": str(_write_downgrade_overlay()),
})
def _write_downgrade_overlay():
import tempfile
path = Path(tempfile.mkdtemp()) / "scope.json"
path.write_text(json.dumps(
[{"name": "informed-decision", "evidence_kind": "attributive"}]
))
return path
Reference in a new issue View git blame Copy permalink