"""Contained model exercises, no live registry reads or credentials.""" import copy import json import subprocess import sys import unittest from pathlib import Path from unittest.mock import patch ROOT = Path(__file__).resolve().parents[1] sys.path.insert(0, str(ROOT / "scripts")) import cadence_receiver_custody as lane # noqa: E402 class PacketContracts(unittest.TestCase): def test_proposed_refuses_before_native_calls(self): module = lane.credential_module() ccr, errors, warnings = module.validate_ccr(lane.CCR) ccr = copy.deepcopy(ccr) ccr["status"] = "proposed" with ( patch.object(lane, "credential_module", return_value=module), patch.object(module, "validate_ccr", return_value=(ccr, errors, warnings)), patch.object(lane, "bao", side_effect=AssertionError("no native call")), ): with self.assertRaisesRegex(lane.LaneError, "approved_ccr_required"): lane.contracts(approved=True) def test_exact_namespace_path_policy_and_projection(self): contract = lane.contracts() self.assertEqual(contract["namespace"], "rapp-qonto") self.assertEqual(contract["name"], "rapp-qonto-collector") objects = list(lane.yaml.safe_load_all(lane.MANIFEST.read_text())) self.assertEqual( objects[0]["spec"]["conditions"], [{"namespaces": ["rapp-qonto"]}] ) self.assertEqual( objects[1]["spec"]["data"], [ { "secretKey": "bearer", "remoteRef": { "key": "workloads/rapp-qonto/audit-sender", "property": "AUDIT_TOKEN", "conversionStrategy": "Default", "decodingStrategy": "None", "metadataPolicy": "None", }, } ], ) self.assertEqual( contract["hcl"], 'path "platform/data/workloads/rapp-qonto/audit-sender" {\n capabilities = ["read"]\n}\n', ) def test_offline_plan_contains_hashes_but_no_credentials(self): result = lane.packet() self.assertEqual(len(result["sha256"]), 64) self.assertIn( "audit-core/audit_core/cadence_registration.py", result["source_sha256"] ) self.assertFalse(result["credential_values_emitted"]) self.assertNotIn("tokens", json.dumps(result)) def test_receiver_compatibility_probe_against_actual_source(self): result = subprocess.run( [ str(lane.WORKSPACE / "audit-core/.venv/bin/python"), "-c", lane.COMPATIBILITY, ], cwd=lane.WORKSPACE / "audit-core", capture_output=True, input=json.dumps(lane.proposal_metadata()).encode(), check=True, ) self.assertTrue(all(json.loads(result.stdout).values())) class FakeCustody(unittest.TestCase): def setUp(self): self.contract = lane.contracts() self.kv = None self.version = 7 self.rows = [ dict( name="approval-engine", tokens=["a" * 64], sources=["approval-engine"], tenants=["tenant:platform"], may_write=True, may_read=False, evidence_kind="load-bearing", secret_policy="redact", ), dict( name="reader", tokens=["b" * 64], sources=["*"], tenants=["*"], may_write=False, may_read=True, secret_policy="reject", ), ] self.body = {"senders.json": json.dumps(self.rows), "other": "keep"} self.writes = [] self.saves = [] self.receipt = {} self.fail_registry = False self.snapshot_patch = patch.object(lane, "snapshot", side_effect=self.snapshot) self.optional_patch = patch.object( lane, "read_optional", side_effect=self.metadata ) self.bao_patch = patch.object(lane, "bao", side_effect=self.bao) for p in [self.snapshot_patch, self.optional_patch, self.bao_patch]: p.start() self.addCleanup(p.stop) def snapshot(self): rows = json.loads(self.body["senders.json"]) return ( self.version, copy.deepcopy(self.body), rows, {t for r in rows for t in r["tokens"]}, ) def metadata(self, path): self.assertEqual(path, self.contract["metadata"]) return ( None if self.kv is None else {"current_version": 1, "versions": {"1": {}}} ) def bao(self, args, *, payload=None): if args[0] == "read": self.assertEqual(args[2], self.contract["kv"]) result = {"data": {"metadata": {"version": 1}, "data": self.kv}} elif args[2] == self.contract["kv"]: self.assertIsNone(self.kv) self.assertEqual(payload["options"], {"cas": 0}) self.kv = copy.deepcopy(payload["data"]) self.writes.append("custody") result = {"data": {"version": 1}, "request_id": "test-custody"} else: self.assertEqual(args[2], lane.REGISTRY) if self.fail_registry: raise lane.LaneError("simulated_registry_conflict") self.assertEqual(payload["options"]["cas"], self.version) self.body = copy.deepcopy(payload["data"]) self.version += 1 self.writes.append("registry") result = {"data": {"version": self.version}, "request_id": "test-registry"} return subprocess.CompletedProcess([], 0, json.dumps(result).encode(), b"") def run_merge(self, resume=False): return lane.merge_and_seed( self.contract, self.receipt, lambda: self.saves.append(copy.deepcopy(self.receipt)), resume=resume, ) def test_first_provision_preserves_all_other_credentials_and_fields(self): token, updated = self.run_merge() rows = json.loads(updated["senders.json"]) self.assertEqual(rows[0]["tokens"], ["a" * 64]) self.assertEqual(rows[1], self.rows[1]) self.assertEqual(rows[2]["tokens"], [token]) self.assertEqual(rows[2]["heartbeat_classes"], {"audit.deny": 7200}) self.assertEqual(updated["other"], "keep") self.assertNotIn(token, json.dumps(self.saves)) self.assertEqual(self.writes, ["custody", "registry"]) def test_idempotent_resume_reuses_version1_and_no_registry_write(self): token, _ = self.run_merge() prior = list(self.writes) resumed, _ = self.run_merge(resume=True) self.assertEqual(resumed, token) self.assertEqual(self.writes, prior) with self.assertRaisesRegex( lane.LaneError, "reviewed_version1_resume_required" ): self.run_merge() def test_partial_failure_after_cas0_resumes_without_rotation(self): self.fail_registry = True with self.assertRaisesRegex(lane.LaneError, "simulated_registry_conflict"): self.run_merge() token = self.kv["AUDIT_TOKEN"] self.assertEqual(self.writes, ["custody"]) self.fail_registry = False actual, _ = self.run_merge(resume=True) self.assertEqual(actual, token) self.assertEqual(self.writes, ["custody", "registry"]) def test_conflicting_custody_provenance_refuses(self): self.run_merge() self.kv["CUSTODY_REQUEST"] = "OTHER" with self.assertRaisesRegex(lane.LaneError, "custody_provenance_mismatch"): self.run_merge(resume=True) def test_registered_scope_drift_refuses(self): self.run_merge() rows = json.loads(self.body["senders.json"]) rows[-1]["tenants"] = ["wrong"] self.body["senders.json"] = json.dumps(rows) with self.assertRaisesRegex(lane.LaneError, "registered_sender_drift"): self.run_merge(resume=True) def test_orphan_registry_sender_refuses_without_custody_write(self): rows = json.loads(self.body["senders.json"]) rows.append(dict(lane.proposal_metadata(), tokens=["c" * 64])) self.body["senders.json"] = json.dumps(rows) with self.assertRaisesRegex(lane.LaneError, "registry_sender_without_custody"): self.run_merge() self.assertEqual(self.writes, []) def test_custody_preflight_refuses_bad_provenance_before_grant_writes(self): self.run_merge() self.kv["CUSTODY_REQUEST"] = "unknown-owner" with patch.object( lane, "prepare_metadata", side_effect=AssertionError("no grants") ): with self.assertRaisesRegex(lane.LaneError, "custody_provenance_mismatch"): lane.preflight_custody(self.contract, resume=True) class ProjectionResume(unittest.TestCase): def test_exact_metadata_template_is_resumable(self): objects = list(lane.yaml.safe_load_all(lane.MANIFEST.read_text())) responses = [ subprocess.CompletedProcess([], 0, json.dumps(o).encode(), b"") for o in objects ] with patch.object(lane, "command", side_effect=responses): lane.preflight_projection(["kubectl"], objects) def test_extra_template_payload_is_refused(self): objects = list(lane.yaml.safe_load_all(lane.MANIFEST.read_text())) actual = copy.deepcopy(objects) actual[1]["spec"]["target"]["template"]["data"] = {"injected": "payload"} responses = [ subprocess.CompletedProcess([], 0, json.dumps(o).encode(), b"") for o in actual ] with patch.object(lane, "command", side_effect=responses): with self.assertRaisesRegex(lane.LaneError, "existing_projection_drift"): lane.preflight_projection(["kubectl"], objects) if __name__ == "__main__": unittest.main()