tegwick
a40c956a87
Some checks failed
Use-case regression gate / usecase-regressions (push) Failing after 6m31s
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a119cf-56d0-7fa3-840b-eb8732e1db0b
75 lines
3.2 KiB
Python
75 lines
3.2 KiB
Python
"""Prove the cross-owner gate cannot send, hide skips or leak inherited credentials."""
|
|
|
|
import importlib.util
|
|
import json
|
|
from pathlib import Path
|
|
|
|
import pytest
|
|
|
|
|
|
@pytest.fixture
|
|
def gate(tmp_path, monkeypatch):
|
|
script = Path(__file__).resolve().parents[1] / "scripts/check-communication.py"
|
|
spec = importlib.util.spec_from_file_location("communication_gate", script)
|
|
module = importlib.util.module_from_spec(spec)
|
|
spec.loader.exec_module(module)
|
|
contract = tmp_path / "contract.json"
|
|
contract.write_text(json.dumps({
|
|
"schema_version": 1, "owner": "synthetic-owner",
|
|
"test_file": "tests/test_contract.py", "required_tests": ["test_contract"],
|
|
"remaining_acceptance": ["User review remains separate"],
|
|
}))
|
|
monkeypatch.setattr(module, "CONTRACT", contract)
|
|
owner = tmp_path / "owner"
|
|
(owner / "src/email_connect").mkdir(parents=True)
|
|
(owner / "src/email_connect/__init__.py").write_text("")
|
|
(owner / "tests").mkdir()
|
|
return module, owner, tmp_path / "receipt.json"
|
|
|
|
|
|
def test_communication_gate_scrubs_credentials_and_does_not_modify_owner(gate, monkeypatch):
|
|
module, owner, receipt = gate
|
|
monkeypatch.setenv("SMTP_PASSWORD", "synthetic-inherited-secret")
|
|
test = owner / "tests/test_contract.py"
|
|
test.write_text(
|
|
"import os\ndef test_contract():\n assert 'SMTP_PASSWORD' not in os.environ\n"
|
|
)
|
|
before = sorted(p.relative_to(owner) for p in owner.rglob("*"))
|
|
evidence = module.check(owner, receipt)
|
|
assert evidence["passed"] and evidence["tests"] == 1
|
|
assert evidence["acceptance_complete"] is False
|
|
assert "synthetic-inherited-secret" not in receipt.read_text()
|
|
assert sorted(p.relative_to(owner) for p in owner.rglob("*")) == before
|
|
|
|
|
|
@pytest.mark.parametrize("body", [
|
|
("import socket\ndef test_contract():\n"
|
|
" socket.create_connection(('smtp.example.test', 25))\n"),
|
|
"import pytest\n@pytest.mark.skip\ndef test_contract():\n pass\n",
|
|
"def test_renamed():\n pass\n",
|
|
])
|
|
def test_communication_gate_refuses_network_disabled_or_missing_contract(gate, body):
|
|
module, owner, receipt = gate
|
|
(owner / "tests/test_contract.py").write_text(body)
|
|
evidence = module.check(owner, receipt)
|
|
assert evidence["passed"] is False
|
|
assert "smtp.example.test" not in receipt.read_text()
|
|
assert "RuntimeError" not in receipt.read_text()
|
|
|
|
|
|
def test_communication_gate_binds_each_required_function_to_its_module(gate):
|
|
module, owner, receipt = gate
|
|
module.CONTRACT.write_text(json.dumps({
|
|
"schema_version": 1, "owner": "synthetic-owner",
|
|
"test_files": ["tests/test_contract.py", "tests/test_other.py"],
|
|
"required_tests": ["test_contract::test_contract", "test_other::test_contract"],
|
|
"remaining_acceptance": [],
|
|
}))
|
|
(owner / "tests/test_contract.py").write_text("def test_contract():\n pass\n")
|
|
other = owner / "tests/test_other.py"
|
|
other.write_text("def test_other():\n pass\n")
|
|
evidence = module.check(owner, receipt)
|
|
assert not evidence["passed"]
|
|
assert evidence["missing_required_tests"] == ["test_other::test_contract"]
|
|
other.write_text("def test_contract():\n pass\n")
|
|
assert module.check(owner, receipt)["passed"]
|