secrets-engine/tests/test_audit.py

import json
import urllib.error
from pathlib import Path
from types import SimpleNamespace

from secrets_engine.audit import summarize_lane_evidence
from secrets_engine.cli import build_parser
from secrets_engine.evidence import EvidenceWriter


DECISION_ID = "e6381a56-3e55-4fac-b22c-63ee1c152ce8"


def test_lane_audit_summarizes_allowlisted_fields_and_cleanup(tmp_path, monkeypatch):
    writer = EvidenceWriter(
        evidence_dir=tmp_path,
        hub_url="http://hub.invalid",
        topic_id="topic-id",
    )
    monkeypatch.setattr(
        "urllib.request.urlopen", lambda *_args, **_kwargs: SimpleNamespace(read=lambda: b"{}")
    )
    writer.record(
        "exec",
        result="exit-0",
        catalog_id="test-lane",
        stage="test",
        decision_id=DECISION_ID,
        detail={
            "session": {
                "session_handle": "safe-fingerprint",
                "revocation_attempted": True,
                "revocation_succeeded": True,
            }
        },
    )

    def offline(*_args, **_kwargs):
        raise urllib.error.URLError("offline")

    monkeypatch.setattr("urllib.request.urlopen", offline)
    writer.record(
        "verify",
        result="positive-pass",
        catalog_id="test-lane",
        stage="test",
        decision_id=DECISION_ID,
        detail={
            "session": {
                "session_handle": "another-safe-fingerprint",
                "revocation_attempted": True,
                "revocation_succeeded": False,
            }
        },
    )

    path = next(tmp_path.glob("evidence-*.jsonl"))
    with path.open("a", encoding="utf-8") as fh:
        fh.write("not-json\n")
        fh.write(
            json.dumps(
                {
                    "catalog_id": "test-lane",
                    "action": "fake-SUPER-SECRET-value",
                    "result": "fake-SUPER-SECRET-value",
                    "decision_id": "fake-SUPER-SECRET-value",
                    "ts": "not-a-time",
                    "detail": {"value": "fake-SUPER-SECRET-value"},
                }
            )
            + "\n"
        )

    summary = summarize_lane_evidence(tmp_path, "test-lane")
    rendered = json.dumps(summary.to_json()) + summary.render()

    assert summary.operation_records == 3
    assert summary.malformed_records == 1
    assert summary.actions == {"exec": 1, "invalid-label": 1, "verify": 1}
    assert summary.results == {
        "exit-0": 1,
        "invalid-label": 1,
        "positive-pass": 1,
    }
    assert summary.decision_refs == [DECISION_ID]
    assert summary.session_cleanup == {"failed": 1, "succeeded": 1}
    assert summary.hub_delivery == {"delivered": 1, "failed": 1}
    assert "fake-SUPER-SECRET-value" not in rendered
    assert "safe-fingerprint" not in rendered


def test_lane_audit_empty_directory_is_a_valid_empty_summary(tmp_path):
    summary = summarize_lane_evidence(tmp_path, "test-lane")
    assert summary.operation_records == 0
    assert summary.actions == {}
    assert summary.render().startswith("Lane audit summary for 'test-lane'")


def test_lane_audit_counts_edge_queued_delivery(tmp_path):
    path = tmp_path / "evidence-2026-08-23.jsonl"
    path.write_text(
        json.dumps(
            {
                "catalog_id": "test-lane",
                "action": "evidence-delivery",
                "result": "queued",
                "detail": {"outbox_id": "3f12014e-47c1-48a5-9c8f-774c1dac1853"},
            }
        )
        + "\n",
        encoding="utf-8",
    )
    summary = summarize_lane_evidence(tmp_path, "test-lane")
    assert summary.hub_delivery == {"queued": 1}


def test_cli_parser_exposes_audit_json_command():
    args = build_parser().parse_args(["audit", "test-lane", "--json"])
    assert args.catalog_id == "test-lane"
    assert args.json is True