tegwick
31e9963933
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06e89-93a2-7aa2-82b3-ce5ccd2682e6
56 lines
2.2 KiB
Python
56 lines
2.2 KiB
Python
from helpers import load_pilot, observation_from_fixture
|
|
|
|
from kings_guard.contracts import PostureLevel, SecurityGenome, as_jsonable
|
|
from kings_guard.posture import PostureEvaluator
|
|
|
|
|
|
def test_qonto_fixture_loads_a_normalized_genome() -> None:
|
|
fixture = load_pilot()
|
|
|
|
assert isinstance(fixture.genome, SecurityGenome)
|
|
assert fixture.genome.genome_id == "kg:genome:qonto-assistant"
|
|
assert fixture.genome.tenant_id == "binky"
|
|
assert "finance.qonto.read" in fixture.genome.permitted_capabilities
|
|
assert fixture.normalization_hints["identity_binding"] == "self_asserted"
|
|
|
|
|
|
def test_qonto_audit_event_normalizes_to_immune_observation() -> None:
|
|
observation = observation_from_fixture()
|
|
|
|
assert observation.source_system == "qonto-assistant"
|
|
assert observation.capability == "finance.qonto.read"
|
|
assert observation.resource_scope == "org_summary"
|
|
assert observation.protocol == "mcp"
|
|
assert observation.decision.value == "deny"
|
|
assert observation.deny_reason == "credential_exfil"
|
|
|
|
|
|
def test_qonto_source_identity_and_egress_override_legacy_mapping_hints() -> None:
|
|
fixture = load_pilot()
|
|
event = dict(fixture.audit_event)
|
|
event["identity_binding"] = "key_cape_jwt"
|
|
event["egress_destination"] = "qonto-proxy"
|
|
|
|
observation = observation_from_fixture(fixture, event)
|
|
|
|
assert observation.identity_binding == "key_cape_jwt"
|
|
assert observation.egress_destination == "qonto-proxy"
|
|
|
|
|
|
def test_posture_evaluation_is_jsonable() -> None:
|
|
fixture = load_pilot()
|
|
observation = observation_from_fixture(fixture)
|
|
evaluation = PostureEvaluator().evaluate(fixture.genome, observation)
|
|
payload = as_jsonable(evaluation)
|
|
|
|
assert payload["assessment"]["posture"] == PostureLevel.INFLAMED.value
|
|
assert payload["signals"][0]["signal_kind"] == "posture_hint"
|
|
assert payload["assessment"]["stream_completeness"] == "unknown"
|
|
|
|
|
|
def test_explicitly_missing_source_context_does_not_recover_legacy_hints() -> None:
|
|
fixture = load_pilot()
|
|
event = dict(fixture.audit_event, identity_binding=None, egress_destination=None)
|
|
observation = observation_from_fixture(fixture, event)
|
|
assert observation.identity_binding is None
|
|
assert observation.egress_destination is None
|