tegwick
c96b0c6d88
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
59 lines
2.7 KiB
Python
59 lines
2.7 KiB
Python
"""Synthetic source negatives only; never calls real provider or credentials."""
|
|
import copy
|
|
import json
|
|
import pytest
|
|
import probe
|
|
from test_policy_client import envelope
|
|
|
|
|
|
class Fixture:
|
|
def __init__(self, defect=None):
|
|
self.calls = 0
|
|
self.defect = defect
|
|
def request(self, method, url, *, headers=None, body=None):
|
|
self.calls += 1
|
|
req = json.loads(body)
|
|
data = envelope(req)
|
|
data["effect"] = "deny"
|
|
data["matched_policy_version"] = "v2"
|
|
data["provenance"].update(policy_package=probe.PIN["package"], policy_version="v2",
|
|
policy_package_digest=probe.PIN["package_digest"])
|
|
if self.defect == "allow": data["effect"] = "allow"
|
|
elif self.defect == "wrong-pin": data["provenance"]["policy_package_digest"] = "sha256:" + "0" * 64
|
|
elif self.defect == "advisory": data["binding"]["purpose"] = "readback"
|
|
elif self.defect == "wrong-subject": data["binding"]["subject"]["id"] = "someone-else"
|
|
elif self.defect == "bad-purpose": data["binding"]["purpose"] = False
|
|
return (403 if self.defect == "auth-refusal" else 503 if self.defect == "unavailable" else 200), data
|
|
|
|
|
|
def test_truthful_service_uses_supported_collection_search_with_no_imported_claims():
|
|
request = probe.request()
|
|
assert request["subject"]["id"] == "system:serviceaccount:informed-decision:review"
|
|
assert request["subject"]["type"] == "service"
|
|
assert request["subject"]["attributes"] == {}
|
|
assert request["action"] == "lifecycle.search"
|
|
assert request["resource"]["type"] == "decision-collection"
|
|
|
|
|
|
def test_one_captured_denial_and_ten_in_memory_copies_have_closed_metadata():
|
|
transport = Fixture()
|
|
receipt = probe.prove(lambda: "synthetic-secret-sentinel", transport)
|
|
assert transport.calls == 1
|
|
assert receipt["transformed_noncanonical_purposes_refused"] == 10
|
|
assert receipt["actual_provider_effect"] == "deny"
|
|
assert receipt["provider_allow_proven"] is False
|
|
assert receipt["provider_emitted_advisory_proven"] is False
|
|
assert receipt["full_T04_native_lifecycle_acceptance"] is False
|
|
assert "synthetic-secret-sentinel" not in json.dumps(receipt)
|
|
|
|
|
|
@pytest.mark.parametrize("defect", ["allow", "wrong-pin", "advisory", "wrong-subject", "bad-purpose", "auth-refusal", "unavailable"])
|
|
def test_unknown_or_incorrect_baseline_refuses_without_additional_network(defect):
|
|
transport = Fixture(defect)
|
|
with pytest.raises(ValueError):
|
|
probe.prove(lambda: "synthetic-secret-sentinel", transport)
|
|
assert transport.calls == 1
|
|
|
|
|
|
def test_request_identity_changes_between_probes():
|
|
assert probe.request()["id"] != probe.request()["id"]
|