coulomb/qonto-assistant
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(audit): publish sequenced heartbeat and reconciliation evidence

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ec5-7e2b-7743-ac08-719e1b0f42e2
This commit is contained in:
tegwick 2026-09-05 01:39:48 +02:00
parent fce60099c4
commit b9349782f4
32 changed files with 839 additions and 111 deletions
Download patch file Download diff file Expand all files Collapse all files

20
tests/test_policy.py
View file

@ -5,7 +5,9 @@ import pytest
from qonto_assistant.contracts import ActorClaims, CapabilityRequest
from qonto_assistant.policy import PolicyEngine
POLICY_FILE = Path(__file__).resolve().parents[1] / "src" / "qonto_assistant" / "policy" / "qonto-v1.yaml"
POLICY_FILE = (
Path(__file__).resolve().parents[1] / "src" / "qonto_assistant" / "policy" / "qonto-v1.yaml"
)
def _policy(*, enforce_scope: bool = False) -> PolicyEngine:
@ -55,21 +57,31 @@ def test_policy_denies_cross_tenant_requests() -> None:
def test_policy_denies_excessive_page_size() -> None:
decision = _policy().decide(_request("list_transactions", page=1, page_size=101, window_days=31))
decision = _policy().decide(
_request("list_transactions", page=1, page_size=101, window_days=31)
)
assert decision.allowed is False
assert decision.reason == "arg_constraint"
def test_policy_denies_volume_cost_shaped_requests() -> None:
decision = _policy().decide(
_request("list_transactions", page=1, page_size=50, window_days=31, operation_type="card_operation")
_request(
"list_transactions",
page=1,
page_size=50,
window_days=31,
operation_type="card_operation",
)
)
assert decision.allowed is False
assert decision.reason == "volume_cost"
def test_policy_denies_credential_exfiltration_flags() -> None:
decision = _policy().decide(_request("list_transactions", page=1, page_size=50, window_days=31, include_full_iban=True))
decision = _policy().decide(
_request("list_transactions", page=1, page_size=50, window_days=31, include_full_iban=True)
)
assert decision.allowed is False
assert decision.reason == "credential_exfil"