tegwick
c4504c6de9
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a0217e-8c4c-7383-be6b-f50a6e485306
102 lines
3.2 KiB
Python
102 lines
3.2 KiB
Python
import json
|
|
import urllib.error
|
|
from pathlib import Path
|
|
from types import SimpleNamespace
|
|
|
|
from secrets_engine.audit import summarize_lane_evidence
|
|
from secrets_engine.cli import build_parser
|
|
from secrets_engine.evidence import EvidenceWriter
|
|
|
|
|
|
DECISION_ID = "e6381a56-3e55-4fac-b22c-63ee1c152ce8"
|
|
|
|
|
|
def test_lane_audit_summarizes_allowlisted_fields_and_cleanup(tmp_path, monkeypatch):
|
|
writer = EvidenceWriter(
|
|
evidence_dir=tmp_path,
|
|
hub_url="http://hub.invalid",
|
|
topic_id="topic-id",
|
|
)
|
|
monkeypatch.setattr(
|
|
"urllib.request.urlopen", lambda *_args, **_kwargs: SimpleNamespace(read=lambda: b"{}")
|
|
)
|
|
writer.record(
|
|
"exec",
|
|
result="exit-0",
|
|
catalog_id="test-lane",
|
|
stage="test",
|
|
decision_id=DECISION_ID,
|
|
detail={
|
|
"session": {
|
|
"session_handle": "safe-fingerprint",
|
|
"revocation_attempted": True,
|
|
"revocation_succeeded": True,
|
|
}
|
|
},
|
|
)
|
|
|
|
def offline(*_args, **_kwargs):
|
|
raise urllib.error.URLError("offline")
|
|
|
|
monkeypatch.setattr("urllib.request.urlopen", offline)
|
|
writer.record(
|
|
"verify",
|
|
result="positive-pass",
|
|
catalog_id="test-lane",
|
|
stage="test",
|
|
decision_id=DECISION_ID,
|
|
detail={
|
|
"session": {
|
|
"session_handle": "another-safe-fingerprint",
|
|
"revocation_attempted": True,
|
|
"revocation_succeeded": False,
|
|
}
|
|
},
|
|
)
|
|
|
|
path = next(tmp_path.glob("evidence-*.jsonl"))
|
|
with path.open("a", encoding="utf-8") as fh:
|
|
fh.write("not-json\n")
|
|
fh.write(
|
|
json.dumps(
|
|
{
|
|
"catalog_id": "test-lane",
|
|
"action": "fake-SUPER-SECRET-value",
|
|
"result": "fake-SUPER-SECRET-value",
|
|
"decision_id": "fake-SUPER-SECRET-value",
|
|
"ts": "not-a-time",
|
|
"detail": {"value": "fake-SUPER-SECRET-value"},
|
|
}
|
|
)
|
|
+ "\n"
|
|
)
|
|
|
|
summary = summarize_lane_evidence(tmp_path, "test-lane")
|
|
rendered = json.dumps(summary.to_json()) + summary.render()
|
|
|
|
assert summary.operation_records == 3
|
|
assert summary.malformed_records == 1
|
|
assert summary.actions == {"exec": 1, "invalid-label": 1, "verify": 1}
|
|
assert summary.results == {
|
|
"exit-0": 1,
|
|
"invalid-label": 1,
|
|
"positive-pass": 1,
|
|
}
|
|
assert summary.decision_refs == [DECISION_ID]
|
|
assert summary.session_cleanup == {"failed": 1, "succeeded": 1}
|
|
assert summary.hub_delivery == {"delivered": 1, "failed": 1}
|
|
assert "fake-SUPER-SECRET-value" not in rendered
|
|
assert "safe-fingerprint" not in rendered
|
|
|
|
|
|
def test_lane_audit_empty_directory_is_a_valid_empty_summary(tmp_path):
|
|
summary = summarize_lane_evidence(tmp_path, "test-lane")
|
|
assert summary.operation_records == 0
|
|
assert summary.actions == {}
|
|
assert summary.render().startswith("Lane audit summary for 'test-lane'")
|
|
|
|
|
|
def test_cli_parser_exposes_audit_json_command():
|
|
args = build_parser().parse_args(["audit", "test-lane", "--json"])
|
|
assert args.catalog_id == "test-lane"
|
|
assert args.json is True
|