Connect policy-gated browser review and audit runtime

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

tests/test_review_component.py

@@ -0,0 +1,76 @@
+from dataclasses import replace
+import json
+import os
+from pathlib import Path
+import time
+
+import pytest
+
+from informed_decision.disposition import Verb
+from informed_decision.policy import build_request
+from informed_decision.runtime import AuditPump
+from informed_decision.web import SESSION_COOKIE
+from test_browser_auth import call, signing_key
+from test_approval_component import component
+from test_review_controller import review, opened
+from test_durable_component import receiver
+from review_components import flex_component
+
+
+@pytest.fixture
+def pdp(tmp_path,signing_key):
+    binary=os.environ.get('INFD_FLEX_AUTH_BINARY')
+    if not binary:pytest.skip('set INFD_FLEX_AUTH_BINARY to test the actual evaluator and caller boundary')
+    assert Path(binary).is_file()
+    with flex_component(binary,tmp_path,signing_key) as value:yield value
+
+
+def test_actual_pdp_enrichment_and_workload_caller_boundary(pdp,review):
+    client,calls=pdp;controller,session,_,memo,*_=review
+    request=build_request(session,memo,'read',client.version)
+    observation=client.check(request);assert observation.outcome=='allow',observation
+    decision=json.loads(observation.decision_json)
+    assert decision['binding']['request_digest']!=decision['binding']['submitted_request_digest']
+    assert calls[-1]=={'known':True,'audiences':['flex-auth']}
+    client.token_provider=lambda:'synthetic-wrong-caller'
+    assert client.check(request).outcome=='caller_refused'
+    client.token_provider=lambda:session.access_token
+    assert client.check(request).outcome=='caller_refused'  # Browser JWT is never a workload credential.
+
+
+def test_actual_request_digest_handles_go_string_escaping(pdp,review):
+    client,_=pdp;_,session,_,memo,*_=review
+    session=replace(session,roles=('Reviewer <x>& ü \u2028 \u2029',))
+    observation=client.check(build_request(session,memo,'read',client.version))
+    assert observation.outcome=='allow',observation
+
+
+def test_actual_policy_engine_and_independent_audit_receive_browser_act(pdp,review,receiver):
+    controller,session,app,memo,engine,transport=review;controller.policy=pdp[0]
+    page=opened(review);p=page.presentation
+    controller.acknowledge(session,p.id,['h-1'])
+    controller.act(session,p.id,Verb.ACCEPT,operation_id='real-component-click')
+    assert len(engine.get('fixture').entries)==1
+    sink,receiver_transport,_=receiver
+    pump=AuditPump(controller.store,sink);pump.tick();assert pump.ready()
+    assert all(row['state']=='delivered' for row in controller.store.outbox())
+    observations=controller.store.policy_observations()
+    assert len(observations)==3 and all(row['outcome']=='allow' and row['decision_attributable']==0 for row in observations)
+    response=call(app,'/presentations/'+p.id,cookie=SESSION_COOKIE+'=fixture-session')
+    assert 'Approval entry recorded.' in response['body']
+    event=controller.store.evidence()[0]
+    status,body=receiver_transport.request('GET','https://audit.test/v1/events/'+event['id'],headers={'Authorization':'Bearer synthetic-auditor-token'})
+    assert status==200 and body['details']['data']['view_hash']==p.view_hash
+    assert 'private-brief-sentinel' not in json.dumps(body)
+    report=json.loads((controller.store.path.parent/'audit-reconciliation.json').read_text())
+    assert report['source_time_basis']=='occurred_at' and report['receiver_time_basis']=='accepted_at'
+    assert not report['completeness_proven'] and not report['automatic_loss_finding']
+
+
+def test_actual_policy_refusal_prevents_content_and_engine_read(pdp,review):
+    controller,session,app,memo,engine,transport=review;controller.policy=pdp[0]
+    controller.store.save_memo(replace(memo,id='not-assigned-in-fixture'))
+    before=len(transport.calls)
+    response=call(app,'/review',query='memo_id=not-assigned-in-fixture',cookie=SESSION_COOKIE+'=fixture-session')
+    assert response['status']==403 and 'private-brief-sentinel' not in response['body']
+    assert len(transport.calls)==before and controller.store.evidence()==[]