7ec54d59e0
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2
255 lines
9.9 KiB
Python
255 lines
9.9 KiB
Python
"""Contained model exercises, no live registry reads or credentials."""
|
|
|
|
import copy
|
|
import json
|
|
import subprocess
|
|
import sys
|
|
import unittest
|
|
from pathlib import Path
|
|
from unittest.mock import patch
|
|
|
|
ROOT = Path(__file__).resolve().parents[1]
|
|
sys.path.insert(0, str(ROOT / "scripts"))
|
|
import cadence_receiver_custody as lane # noqa: E402
|
|
|
|
|
|
class PacketContracts(unittest.TestCase):
|
|
def test_proposed_refuses_before_native_calls(self):
|
|
module = lane.credential_module()
|
|
ccr, errors, warnings = module.validate_ccr(lane.CCR)
|
|
ccr = copy.deepcopy(ccr)
|
|
ccr["status"] = "proposed"
|
|
with (
|
|
patch.object(lane, "credential_module", return_value=module),
|
|
patch.object(module, "validate_ccr", return_value=(ccr, errors, warnings)),
|
|
patch.object(lane, "bao", side_effect=AssertionError("no native call")),
|
|
):
|
|
with self.assertRaisesRegex(lane.LaneError, "approved_ccr_required"):
|
|
lane.contracts(approved=True)
|
|
|
|
def test_exact_namespace_path_policy_and_projection(self):
|
|
contract = lane.contracts()
|
|
self.assertEqual(contract["namespace"], "rapp-qonto")
|
|
self.assertEqual(contract["name"], "rapp-qonto-collector")
|
|
objects = list(lane.yaml.safe_load_all(lane.MANIFEST.read_text()))
|
|
self.assertEqual(
|
|
objects[0]["spec"]["conditions"], [{"namespaces": ["rapp-qonto"]}]
|
|
)
|
|
self.assertEqual(
|
|
objects[1]["spec"]["data"],
|
|
[
|
|
{
|
|
"secretKey": "bearer",
|
|
"remoteRef": {
|
|
"key": "workloads/rapp-qonto/audit-sender",
|
|
"property": "AUDIT_TOKEN",
|
|
"conversionStrategy": "Default",
|
|
"decodingStrategy": "None",
|
|
"metadataPolicy": "None",
|
|
},
|
|
}
|
|
],
|
|
)
|
|
self.assertEqual(
|
|
contract["hcl"],
|
|
'path "platform/data/workloads/rapp-qonto/audit-sender" {\n capabilities = ["read"]\n}\n',
|
|
)
|
|
|
|
def test_offline_plan_contains_hashes_but_no_credentials(self):
|
|
result = lane.packet()
|
|
self.assertEqual(len(result["sha256"]), 64)
|
|
self.assertIn(
|
|
"audit-core/audit_core/cadence_registration.py", result["source_sha256"]
|
|
)
|
|
self.assertFalse(result["credential_values_emitted"])
|
|
self.assertNotIn("tokens", json.dumps(result))
|
|
|
|
def test_receiver_compatibility_probe_against_actual_source(self):
|
|
result = subprocess.run(
|
|
[
|
|
str(lane.WORKSPACE / "audit-core/.venv/bin/python"),
|
|
"-c",
|
|
lane.COMPATIBILITY,
|
|
],
|
|
cwd=lane.WORKSPACE / "audit-core",
|
|
capture_output=True,
|
|
input=json.dumps(lane.proposal_metadata()).encode(),
|
|
check=True,
|
|
)
|
|
self.assertTrue(all(json.loads(result.stdout).values()))
|
|
|
|
|
|
class FakeCustody(unittest.TestCase):
|
|
def setUp(self):
|
|
self.contract = lane.contracts()
|
|
self.kv = None
|
|
self.version = 7
|
|
self.rows = [
|
|
dict(
|
|
name="approval-engine",
|
|
tokens=["a" * 64],
|
|
sources=["approval-engine"],
|
|
tenants=["tenant:platform"],
|
|
may_write=True,
|
|
may_read=False,
|
|
evidence_kind="load-bearing",
|
|
secret_policy="redact",
|
|
),
|
|
dict(
|
|
name="reader",
|
|
tokens=["b" * 64],
|
|
sources=["*"],
|
|
tenants=["*"],
|
|
may_write=False,
|
|
may_read=True,
|
|
secret_policy="reject",
|
|
),
|
|
]
|
|
self.body = {"senders.json": json.dumps(self.rows), "other": "keep"}
|
|
self.writes = []
|
|
self.saves = []
|
|
self.receipt = {}
|
|
self.fail_registry = False
|
|
self.snapshot_patch = patch.object(lane, "snapshot", side_effect=self.snapshot)
|
|
self.optional_patch = patch.object(
|
|
lane, "read_optional", side_effect=self.metadata
|
|
)
|
|
self.bao_patch = patch.object(lane, "bao", side_effect=self.bao)
|
|
for p in [self.snapshot_patch, self.optional_patch, self.bao_patch]:
|
|
p.start()
|
|
self.addCleanup(p.stop)
|
|
|
|
def snapshot(self):
|
|
rows = json.loads(self.body["senders.json"])
|
|
return (
|
|
self.version,
|
|
copy.deepcopy(self.body),
|
|
rows,
|
|
{t for r in rows for t in r["tokens"]},
|
|
)
|
|
|
|
def metadata(self, path):
|
|
self.assertEqual(path, self.contract["metadata"])
|
|
return (
|
|
None if self.kv is None else {"current_version": 1, "versions": {"1": {}}}
|
|
)
|
|
|
|
def bao(self, args, *, payload=None):
|
|
if args[0] == "read":
|
|
self.assertEqual(args[2], self.contract["kv"])
|
|
result = {"data": {"metadata": {"version": 1}, "data": self.kv}}
|
|
elif args[2] == self.contract["kv"]:
|
|
self.assertIsNone(self.kv)
|
|
self.assertEqual(payload["options"], {"cas": 0})
|
|
self.kv = copy.deepcopy(payload["data"])
|
|
self.writes.append("custody")
|
|
result = {"data": {"version": 1}, "request_id": "test-custody"}
|
|
else:
|
|
self.assertEqual(args[2], lane.REGISTRY)
|
|
if self.fail_registry:
|
|
raise lane.LaneError("simulated_registry_conflict")
|
|
self.assertEqual(payload["options"]["cas"], self.version)
|
|
self.body = copy.deepcopy(payload["data"])
|
|
self.version += 1
|
|
self.writes.append("registry")
|
|
result = {"data": {"version": self.version}, "request_id": "test-registry"}
|
|
return subprocess.CompletedProcess([], 0, json.dumps(result).encode(), b"")
|
|
|
|
def run_merge(self, resume=False):
|
|
return lane.merge_and_seed(
|
|
self.contract,
|
|
self.receipt,
|
|
lambda: self.saves.append(copy.deepcopy(self.receipt)),
|
|
resume=resume,
|
|
)
|
|
|
|
def test_first_provision_preserves_all_other_credentials_and_fields(self):
|
|
token, updated = self.run_merge()
|
|
rows = json.loads(updated["senders.json"])
|
|
self.assertEqual(rows[0]["tokens"], ["a" * 64])
|
|
self.assertEqual(rows[1], self.rows[1])
|
|
self.assertEqual(rows[2]["tokens"], [token])
|
|
self.assertEqual(rows[2]["heartbeat_classes"], {"audit.deny": 7200})
|
|
self.assertEqual(updated["other"], "keep")
|
|
self.assertNotIn(token, json.dumps(self.saves))
|
|
self.assertEqual(self.writes, ["custody", "registry"])
|
|
|
|
def test_idempotent_resume_reuses_version1_and_no_registry_write(self):
|
|
token, _ = self.run_merge()
|
|
prior = list(self.writes)
|
|
resumed, _ = self.run_merge(resume=True)
|
|
self.assertEqual(resumed, token)
|
|
self.assertEqual(self.writes, prior)
|
|
with self.assertRaisesRegex(
|
|
lane.LaneError, "reviewed_version1_resume_required"
|
|
):
|
|
self.run_merge()
|
|
|
|
def test_partial_failure_after_cas0_resumes_without_rotation(self):
|
|
self.fail_registry = True
|
|
with self.assertRaisesRegex(lane.LaneError, "simulated_registry_conflict"):
|
|
self.run_merge()
|
|
token = self.kv["AUDIT_TOKEN"]
|
|
self.assertEqual(self.writes, ["custody"])
|
|
self.fail_registry = False
|
|
actual, _ = self.run_merge(resume=True)
|
|
self.assertEqual(actual, token)
|
|
self.assertEqual(self.writes, ["custody", "registry"])
|
|
|
|
def test_conflicting_custody_provenance_refuses(self):
|
|
self.run_merge()
|
|
self.kv["CUSTODY_REQUEST"] = "OTHER"
|
|
with self.assertRaisesRegex(lane.LaneError, "custody_provenance_mismatch"):
|
|
self.run_merge(resume=True)
|
|
|
|
def test_registered_scope_drift_refuses(self):
|
|
self.run_merge()
|
|
rows = json.loads(self.body["senders.json"])
|
|
rows[-1]["tenants"] = ["wrong"]
|
|
self.body["senders.json"] = json.dumps(rows)
|
|
with self.assertRaisesRegex(lane.LaneError, "registered_sender_drift"):
|
|
self.run_merge(resume=True)
|
|
|
|
def test_orphan_registry_sender_refuses_without_custody_write(self):
|
|
rows = json.loads(self.body["senders.json"])
|
|
rows.append(dict(lane.proposal_metadata(), tokens=["c" * 64]))
|
|
self.body["senders.json"] = json.dumps(rows)
|
|
with self.assertRaisesRegex(lane.LaneError, "registry_sender_without_custody"):
|
|
self.run_merge()
|
|
self.assertEqual(self.writes, [])
|
|
|
|
def test_custody_preflight_refuses_bad_provenance_before_grant_writes(self):
|
|
self.run_merge()
|
|
self.kv["CUSTODY_REQUEST"] = "unknown-owner"
|
|
with patch.object(
|
|
lane, "prepare_metadata", side_effect=AssertionError("no grants")
|
|
):
|
|
with self.assertRaisesRegex(lane.LaneError, "custody_provenance_mismatch"):
|
|
lane.preflight_custody(self.contract, resume=True)
|
|
|
|
|
|
class ProjectionResume(unittest.TestCase):
|
|
def test_exact_metadata_template_is_resumable(self):
|
|
objects = list(lane.yaml.safe_load_all(lane.MANIFEST.read_text()))
|
|
responses = [
|
|
subprocess.CompletedProcess([], 0, json.dumps(o).encode(), b"")
|
|
for o in objects
|
|
]
|
|
with patch.object(lane, "command", side_effect=responses):
|
|
lane.preflight_projection(["kubectl"], objects)
|
|
|
|
def test_extra_template_payload_is_refused(self):
|
|
objects = list(lane.yaml.safe_load_all(lane.MANIFEST.read_text()))
|
|
actual = copy.deepcopy(objects)
|
|
actual[1]["spec"]["target"]["template"]["data"] = {"injected": "payload"}
|
|
responses = [
|
|
subprocess.CompletedProcess([], 0, json.dumps(o).encode(), b"")
|
|
for o in actual
|
|
]
|
|
with patch.object(lane, "command", side_effect=responses):
|
|
with self.assertRaisesRegex(lane.LaneError, "existing_projection_drift"):
|
|
lane.preflight_projection(["kubectl"], objects)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|