77 lines
3.9 KiB
Python
77 lines
3.9 KiB
Python
|
from dataclasses import replace
|
||
|
|
import json
|
||
|
|
import os
|
||
|
|
from pathlib import Path
|
||
|
|
import time
|
||
|
|
|
||
|
|
import pytest
|
||
|
|
|
||
|
|
from informed_decision.disposition import Verb
|
||
|
|
from informed_decision.policy import build_request
|
||
|
|
from informed_decision.runtime import AuditPump
|
||
|
|
from informed_decision.web import SESSION_COOKIE
|
||
|
|
from test_browser_auth import call, signing_key
|
||
|
|
from test_approval_component import component
|
||
|
|
from test_review_controller import review, opened
|
||
|
|
from test_durable_component import receiver
|
||
|
|
from review_components import flex_component
|
||
|
|
|
||
|
|
|
||
|
|
@pytest.fixture
|
||
|
|
def pdp(tmp_path,signing_key):
|
||
|
|
binary=os.environ.get('INFD_FLEX_AUTH_BINARY')
|
||
|
|
if not binary:pytest.skip('set INFD_FLEX_AUTH_BINARY to test the actual evaluator and caller boundary')
|
||
|
|
assert Path(binary).is_file()
|
||
|
|
with flex_component(binary,tmp_path,signing_key) as value:yield value
|
||
|
|
|
||
|
|
|
||
|
|
def test_actual_pdp_enrichment_and_workload_caller_boundary(pdp,review):
|
||
|
|
client,calls=pdp;controller,session,_,memo,*_=review
|
||
|
|
request=build_request(session,memo,'read',client.version)
|
||
|
|
observation=client.check(request);assert observation.outcome=='allow',observation
|
||
|
|
decision=json.loads(observation.decision_json)
|
||
|
|
assert decision['binding']['request_digest']!=decision['binding']['submitted_request_digest']
|
||
|
|
assert calls[-1]=={'known':True,'audiences':['flex-auth']}
|
||
|
|
client.token_provider=lambda:'synthetic-wrong-caller'
|
||
|
|
assert client.check(request).outcome=='caller_refused'
|
||
|
|
client.token_provider=lambda:session.access_token
|
||
|
|
assert client.check(request).outcome=='caller_refused' # Browser JWT is never a workload credential.
|
||
|
|
|
||
|
|
|
||
|
|
def test_actual_request_digest_handles_go_string_escaping(pdp,review):
|
||
|
|
client,_=pdp;_,session,_,memo,*_=review
|
||
|
|
session=replace(session,roles=('Reviewer <x>& ü \u2028 \u2029',))
|
||
|
|
observation=client.check(build_request(session,memo,'read',client.version))
|
||
|
|
assert observation.outcome=='allow',observation
|
||
|
|
|
||
|
|
|
||
|
|
def test_actual_policy_engine_and_independent_audit_receive_browser_act(pdp,review,receiver):
|
||
|
|
controller,session,app,memo,engine,transport=review;controller.policy=pdp[0]
|
||
|
|
page=opened(review);p=page.presentation
|
||
|
|
controller.acknowledge(session,p.id,['h-1'])
|
||
|
|
controller.act(session,p.id,Verb.ACCEPT,operation_id='real-component-click')
|
||
|
|
assert len(engine.get('fixture').entries)==1
|
||
|
|
sink,receiver_transport,_=receiver
|
||
|
|
pump=AuditPump(controller.store,sink);pump.tick();assert pump.ready()
|
||
|
|
assert all(row['state']=='delivered' for row in controller.store.outbox())
|
||
|
|
observations=controller.store.policy_observations()
|
||
|
|
assert len(observations)==3 and all(row['outcome']=='allow' and row['decision_attributable']==0 for row in observations)
|
||
|
|
response=call(app,'/presentations/'+p.id,cookie=SESSION_COOKIE+'=fixture-session')
|
||
|
|
assert 'Approval entry recorded.' in response['body']
|
||
|
|
event=controller.store.evidence()[0]
|
||
|
|
status,body=receiver_transport.request('GET','https://audit.test/v1/events/'+event['id'],headers={'Authorization':'Bearer synthetic-auditor-token'})
|
||
|
|
assert status==200 and body['details']['data']['view_hash']==p.view_hash
|
||
|
|
assert 'private-brief-sentinel' not in json.dumps(body)
|
||
|
|
report=json.loads((controller.store.path.parent/'audit-reconciliation.json').read_text())
|
||
|
|
assert report['source_time_basis']=='occurred_at' and report['receiver_time_basis']=='accepted_at'
|
||
|
|
assert not report['completeness_proven'] and not report['automatic_loss_finding']
|
||
|
|
|
||
|
|
|
||
|
|
def test_actual_policy_refusal_prevents_content_and_engine_read(pdp,review):
|
||
|
|
controller,session,app,memo,engine,transport=review;controller.policy=pdp[0]
|
||
|
|
controller.store.save_memo(replace(memo,id='not-assigned-in-fixture'))
|
||
|
|
before=len(transport.calls)
|
||
|
|
response=call(app,'/review',query='memo_id=not-assigned-in-fixture',cookie=SESSION_COOKIE+'=fixture-session')
|
||
|
|
assert response['status']==403 and 'private-brief-sentinel' not in response['body']
|
||
|
|
assert len(transport.calls)==before and controller.store.evidence()==[]
|