tegwick
b971403dad
Promote railiance-backup-offsite-lane to active/resolvable after capabilities-safe re-verify. Add catalog risk=high, agent read-boundary (exit 7 + OpenBao policy companion), EXPOSED taint via warden taint, and close WP-0026.
70 lines
1.9 KiB
Python
70 lines
1.9 KiB
Python
"""Tests for EXPOSED taint convention (WARDEN-WP-0026 T05)."""
|
|
from __future__ import annotations
|
|
|
|
import json
|
|
from pathlib import Path
|
|
|
|
import pytest
|
|
from typer.testing import CliRunner
|
|
|
|
from warden.cli import app
|
|
from warden.taint import (
|
|
EXPOSED_AT,
|
|
TaintStatus,
|
|
parse_custom_metadata,
|
|
kv_metadata_path,
|
|
)
|
|
|
|
runner = CliRunner()
|
|
|
|
|
|
def test_parse_custom_metadata_tainted():
|
|
status = parse_custom_metadata({
|
|
"custom_metadata": {
|
|
EXPOSED_AT: "2026-07-16T00:00:00Z",
|
|
"exposed_version": "2",
|
|
"exposed_reason": "test",
|
|
"exposed_ref": "history/x.md",
|
|
},
|
|
"current_version": 2,
|
|
})
|
|
assert status.tainted is True
|
|
assert status.exposed_at == "2026-07-16T00:00:00Z"
|
|
assert status.exposed_version == "2"
|
|
assert status.current_version == 2
|
|
|
|
|
|
def test_parse_custom_metadata_clean():
|
|
status = parse_custom_metadata({"custom_metadata": None, "current_version": 1})
|
|
assert status.tainted is False
|
|
assert status.exposed_at is None
|
|
|
|
|
|
def test_parse_empty_exposed_at_not_tainted():
|
|
status = parse_custom_metadata({"custom_metadata": {EXPOSED_AT: " "}, "current_version": 1})
|
|
assert status.tainted is False
|
|
|
|
|
|
def test_kv_metadata_path_strips():
|
|
assert kv_metadata_path(" platform/workloads/x ") == "platform/workloads/x"
|
|
|
|
|
|
def test_taint_status_to_dict():
|
|
s = TaintStatus(
|
|
lane_id="x", path="p", tainted=True,
|
|
exposed_at="t", exposed_version="1", current_version=1,
|
|
)
|
|
d = s.to_dict()
|
|
assert d["tainted"] is True
|
|
assert d["id"] == "x"
|
|
|
|
|
|
def test_taint_cli_unknown_id():
|
|
result = runner.invoke(app, ["taint", "no-such-lane-xyz"])
|
|
assert result.exit_code == 1
|
|
|
|
|
|
def test_taint_cli_template_lane_errors():
|
|
"""openbao-api-key has <placeholders> — cannot query taint."""
|
|
result = runner.invoke(app, ["taint", "openbao-api-key", "--json"])
|
|
assert result.exit_code == 2
|