tegwick
916ba4b33e
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786
66 lines
2.8 KiB
Python
66 lines
2.8 KiB
Python
"""Opt-in real-checker boundary regressions; no production inputs or checker stub.
|
|
|
|
Set KEYCAPE_TEST_CHECKER_BINARY and KEYCAPE_TEST_CHECKER_SHA256 to an independently
|
|
built artifact. Ordinary helper-only runs skip this class when none is supplied.
|
|
"""
|
|
from contextlib import chdir
|
|
import hashlib
|
|
import os
|
|
from pathlib import Path
|
|
import tempfile
|
|
import unittest
|
|
from unittest.mock import patch
|
|
|
|
from test_keycape_client import kc
|
|
|
|
VALID = '''issuer: https://issuer.example.invalid
|
|
port: 8080
|
|
privateKeyPem: /nonexistent/synthetic-key.pem
|
|
clients:
|
|
- clientId: synthetic-client
|
|
displayName: Synthetic client
|
|
redirectUris: [https://client.example.invalid/cb]
|
|
allowedScopes: [openid]
|
|
grantTypes: [authorization_code]
|
|
clientType: public
|
|
'''
|
|
|
|
|
|
class RealCheckerEnvironmentTests(unittest.TestCase):
|
|
@classmethod
|
|
def setUpClass(cls):
|
|
source = os.environ.get('KEYCAPE_TEST_CHECKER_BINARY')
|
|
if not source:
|
|
raise unittest.SkipTest('exact real checker artifact not supplied')
|
|
data = Path(source).read_bytes()
|
|
expected = os.environ.get('KEYCAPE_TEST_CHECKER_SHA256')
|
|
if expected != 'sha256:' + hashlib.sha256(data).hexdigest():
|
|
raise ValueError('real checker artifact digest differs')
|
|
cls.directory = tempfile.TemporaryDirectory()
|
|
cls.addClassCleanup(cls.directory.cleanup)
|
|
cls.binary = Path(cls.directory.name) / 'keycape'
|
|
cls.binary.write_bytes(data)
|
|
cls.binary.chmod(0o700)
|
|
|
|
def check(self, raw, binary=None):
|
|
return kc.check_config(str(binary or self.binary), raw, [], False)
|
|
|
|
def test_ambient_overrides_cannot_reject_supplied_valid_config(self):
|
|
with patch.dict(os.environ, {'KEYCAPE_ACCOUNT_PORTAL_URL': 'http://polluted.example.invalid',
|
|
'KEYCAPE_BROWSER_LOGOUT_URL': 'http://polluted.example.invalid/logout'}):
|
|
self.assertTrue(self.check(VALID)['valid'])
|
|
|
|
def test_ambient_overrides_cannot_admit_supplied_invalid_config(self):
|
|
invalid = VALID + 'accountPortalURL: http://invalid.example.invalid\nbrowserLogoutURL: http://invalid.example.invalid/logout\n'
|
|
with patch.dict(os.environ, {'KEYCAPE_ACCOUNT_PORTAL_URL': 'https://polluted.example.invalid',
|
|
'KEYCAPE_BROWSER_LOGOUT_URL': 'https://polluted.example.invalid/logout'}):
|
|
self.assertFalse(self.check(invalid)['valid'])
|
|
|
|
def test_relative_selected_artifact_is_not_replaced_by_path_decoy(self):
|
|
decoy = Path(self.directory.name) / 'decoy'
|
|
decoy.mkdir()
|
|
trap = decoy / 'keycape'
|
|
trap.write_text('#!/bin/sh\nexit 27\n')
|
|
trap.chmod(0o700)
|
|
with chdir(self.directory.name), patch.dict(os.environ, {'PATH': str(decoy)}):
|
|
self.assertTrue(self.check(VALID, binary=Path('keycape'))['valid'])
|