tegwick
7ce58ae638
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1
66 lines
1.8 KiB
Python
66 lines
1.8 KiB
Python
"""Tests for EXPOSED taint convention (WARDEN-WP-0026 T05)."""
|
|
from __future__ import annotations
|
|
|
|
from typer.testing import CliRunner
|
|
|
|
from warden.cli import app
|
|
from warden.taint import (
|
|
EXPOSED_AT,
|
|
TaintStatus,
|
|
parse_custom_metadata,
|
|
kv_metadata_path,
|
|
)
|
|
|
|
runner = CliRunner()
|
|
|
|
|
|
def test_parse_custom_metadata_tainted():
|
|
status = parse_custom_metadata({
|
|
"custom_metadata": {
|
|
EXPOSED_AT: "2026-07-16T00:00:00Z",
|
|
"exposed_version": "2",
|
|
"exposed_reason": "test",
|
|
"exposed_ref": "history/x.md",
|
|
},
|
|
"current_version": 2,
|
|
})
|
|
assert status.tainted is True
|
|
assert status.exposed_at == "2026-07-16T00:00:00Z"
|
|
assert status.exposed_version == "2"
|
|
assert status.current_version == 2
|
|
|
|
|
|
def test_parse_custom_metadata_clean():
|
|
status = parse_custom_metadata({"custom_metadata": None, "current_version": 1})
|
|
assert status.tainted is False
|
|
assert status.exposed_at is None
|
|
|
|
|
|
def test_parse_empty_exposed_at_not_tainted():
|
|
status = parse_custom_metadata({"custom_metadata": {EXPOSED_AT: " "}, "current_version": 1})
|
|
assert status.tainted is False
|
|
|
|
|
|
def test_kv_metadata_path_strips():
|
|
assert kv_metadata_path(" platform/workloads/x ") == "platform/workloads/x"
|
|
|
|
|
|
def test_taint_status_to_dict():
|
|
s = TaintStatus(
|
|
lane_id="x", path="p", tainted=True,
|
|
exposed_at="t", exposed_version="1", current_version=1,
|
|
)
|
|
d = s.to_dict()
|
|
assert d["tainted"] is True
|
|
assert d["id"] == "x"
|
|
|
|
|
|
def test_taint_cli_unknown_id():
|
|
result = runner.invoke(app, ["taint", "no-such-lane-xyz"])
|
|
assert result.exit_code == 1
|
|
|
|
|
|
def test_taint_cli_template_lane_errors():
|
|
"""openbao-api-key has <placeholders> — cannot query taint."""
|
|
result = runner.invoke(app, ["taint", "openbao-api-key", "--json"])
|
|
assert result.exit_code == 2
|