61c6082ea8
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa
57 lines
1.9 KiB
Python
57 lines
1.9 KiB
Python
from __future__ import annotations
|
|
|
|
import importlib.util
|
|
import copy
|
|
import unittest
|
|
from pathlib import Path
|
|
|
|
ROOT = Path(__file__).resolve().parents[1]
|
|
SPEC = importlib.util.spec_from_file_location("reef_exposure", ROOT / "scripts" / "validate-reef-exposure.py")
|
|
assert SPEC and SPEC.loader
|
|
module = importlib.util.module_from_spec(SPEC)
|
|
SPEC.loader.exec_module(module)
|
|
GrantError = module.GrantError
|
|
validate = module.validate
|
|
|
|
|
|
VALID = {
|
|
"kind": "substrate-reef",
|
|
"reef_id": "reef-example",
|
|
"primary_rail": "rail-kubernetes",
|
|
"exposure": {
|
|
"posture": "public",
|
|
"grants": [
|
|
{"port": 80, "reason": "redirect", "approved_on": "2026-08-22", "residual_risk_owner": "infra"},
|
|
{"port": 443, "reason": "tls", "approved_on": "2026-08-22", "residual_risk_owner": "infra"},
|
|
],
|
|
},
|
|
}
|
|
|
|
|
|
class ReefExposureTests(unittest.TestCase):
|
|
def test_valid_public_web_grants(self) -> None:
|
|
self.assertEqual([80, 443], validate(VALID, [80, 443])["validated_ports"])
|
|
|
|
def test_private_reef_fails(self) -> None:
|
|
payload = {**VALID, "exposure": {"posture": "private"}}
|
|
with self.assertRaisesRegex(GrantError, "must be public"):
|
|
validate(payload, [443])
|
|
|
|
def test_missing_port_fails(self) -> None:
|
|
payload = copy.deepcopy(VALID)
|
|
payload["exposure"]["grants"] = payload["exposure"]["grants"][:1]
|
|
with self.assertRaisesRegex(GrantError, "port 443"):
|
|
validate(payload, [443])
|
|
|
|
def test_kubernetes_api_is_never_grantable(self) -> None:
|
|
with self.assertRaisesRegex(GrantError, "operator-only"):
|
|
validate(VALID, [6443])
|
|
|
|
def test_provider_delegated_reef_fails(self) -> None:
|
|
payload = {key: value for key, value in VALID.items() if key != "primary_rail"}
|
|
with self.assertRaisesRegex(GrantError, "provider-delegated"):
|
|
validate(payload, [443])
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|