525664efa3
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
47 lines
2.3 KiB
Python
47 lines
2.3 KiB
Python
import importlib.util
|
|
import json
|
|
import tempfile
|
|
import unittest
|
|
from pathlib import Path
|
|
from unittest.mock import patch
|
|
|
|
ROOT=Path(__file__).resolve().parents[1]
|
|
def load(name, filename):
|
|
spec=importlib.util.spec_from_file_location(name, ROOT/'scripts'/filename)
|
|
module=importlib.util.module_from_spec(spec); spec.loader.exec_module(module)
|
|
return module
|
|
reader=load('reader','approval-client-reader-preflight.py')
|
|
delivery=load('delivery','approval-client-delivery-check.py')
|
|
|
|
class ReaderBoundary(unittest.TestCase):
|
|
def test_additive_identity_admin_policy_is_refused(self):
|
|
base={'policies':[reader.POLICY,'default'],'entity_id':'fixture','ttl':899}
|
|
reader.validate_identity(base)
|
|
for change in ({'identity_policies':['platform-admin']},{'policies':['default']},{'ttl':901},{'entity_id':''}):
|
|
with self.subTest(change=change), self.assertRaises(ValueError):
|
|
reader.validate_identity(base|change)
|
|
|
|
def test_refused_preflight_never_fetches_credentials(self):
|
|
with tempfile.TemporaryDirectory() as directory:
|
|
receipt=Path(directory)/'receipt.json'
|
|
with patch.object(delivery,'RECEIPT',receipt), patch.object(delivery.preflight,'main',side_effect=ValueError('fixture refusal')), patch.object(delivery,'transport') as transport:
|
|
with self.assertRaises(ValueError): delivery.main()
|
|
transport.assert_not_called()
|
|
recorded=json.loads(receipt.read_text())
|
|
self.assertEqual(recorded['status'],'refused')
|
|
self.assertTrue(recorded['cleanup'])
|
|
self.assertNotIn('fixture refusal',receipt.read_text())
|
|
|
|
def test_private_file_refuses_symlink_and_group_read(self):
|
|
with tempfile.TemporaryDirectory() as directory:
|
|
path=Path(directory)/'secret'; path.write_text('synthetic'); path.chmod(0o600)
|
|
delivery.private(path,0o600)
|
|
link=Path(directory)/'link'; link.symlink_to(path)
|
|
with self.assertRaises(ValueError): delivery.private(link,0o600)
|
|
path.chmod(0o640)
|
|
with self.assertRaises(ValueError): delivery.private(path,0o600)
|
|
|
|
def test_credential_redirect_is_refused(self):
|
|
self.assertIsNone(delivery.NoRedirect().redirect_request(None,None,302,'redirect',{},'https://unrelated.invalid'))
|
|
|
|
if __name__=='__main__': unittest.main()
|