b93af8cc78
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02994-7685-7940-bf34-3555b8256018
62 lines
2.1 KiB
Python
62 lines
2.1 KiB
Python
from __future__ import annotations
|
|
|
|
import copy
|
|
import json
|
|
import subprocess
|
|
import sys
|
|
import unittest
|
|
from pathlib import Path
|
|
|
|
ROOT = Path(__file__).resolve().parents[1]
|
|
sys.path.insert(0, str(ROOT / "scripts"))
|
|
|
|
from baseline_contract import ( # noqa: E402
|
|
BaselineError,
|
|
load_spec,
|
|
profile_hostvars,
|
|
validate_repo_consumers,
|
|
validate_spec,
|
|
)
|
|
|
|
|
|
class BaselineContractTests(unittest.TestCase):
|
|
def setUp(self) -> None:
|
|
self.payload = load_spec(ROOT / "spec" / "server-baseline.yaml")
|
|
|
|
def test_profiles_resolve_distinct_firewall_controls(self) -> None:
|
|
managed = profile_hostvars(self.payload, "ufw-managed")
|
|
external = profile_hostvars(self.payload, "external-firewall")
|
|
self.assertTrue(managed["ufw_manage"])
|
|
self.assertIn("ufw", managed["baseline_required_services"])
|
|
self.assertFalse(external["ufw_manage"])
|
|
self.assertNotIn("ufw", external["baseline_required_services"])
|
|
self.assertIn("replacement_control", external["baseline_firewall"])
|
|
|
|
def test_governed_package_mismatch_fails(self) -> None:
|
|
broken = copy.deepcopy(self.payload)
|
|
broken["defaults"]["packages"].remove("htop")
|
|
with self.assertRaisesRegex(BaselineError, "htop"):
|
|
validate_spec(broken)
|
|
|
|
def test_governed_ssh_weakening_fails(self) -> None:
|
|
broken = copy.deepcopy(self.payload)
|
|
broken["defaults"]["ssh_directives"]["PermitRootLogin"] = "yes"
|
|
with self.assertRaisesRegex(BaselineError, "SSH"):
|
|
validate_spec(broken)
|
|
|
|
def test_ansible_and_goss_consume_shared_variables(self) -> None:
|
|
validate_repo_consumers(ROOT)
|
|
|
|
def test_dynamic_inventory_resolves_each_host_profile(self) -> None:
|
|
raw = subprocess.check_output(
|
|
[sys.executable, str(ROOT / "ansible" / "inventory_from_yaml.py")],
|
|
text=True,
|
|
cwd=ROOT,
|
|
)
|
|
hostvars = json.loads(raw)["_meta"]["hostvars"]
|
|
self.assertEqual("external-firewall", hostvars["CoulombCore"]["baseline_profile"])
|
|
self.assertEqual("ufw-managed", hostvars["Railiance01"]["baseline_profile"])
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|