74 lines
2.6 KiB
Python
74 lines
2.6 KiB
Python
|
"""Crystallized regression test — generated, do not edit by hand.
|
||
|
|
|
||
|
|
Lineage
|
||
|
|
-------
|
||
|
|
ancestor asset : va-grant-via-browser
|
||
|
|
ancestor maturity: T1
|
||
|
|
descendant : va-grant-crystallized (T5 Deterministic)
|
||
|
|
frozen from : 4 identical realizations
|
||
|
|
surface version: lab-0.2.0-baseline
|
||
|
|
generated : 2026-08-22
|
||
|
|
|
||
|
|
Why this file exists
|
||
|
|
--------------------
|
||
|
|
An agent discovered this path 4 times running and it did not change. The
|
||
|
|
search is now waste, so it has been frozen. **No model is involved in running
|
||
|
|
this test.**
|
||
|
|
|
||
|
|
The realization below is plain HTTP with no framework dependency. The assertions
|
||
|
|
are imported from the originating use case rather than restated — a generated
|
||
|
|
test that paraphrases its assertions creates a second, unverified statement of
|
||
|
|
intent, and drift between the two would be silent. See F-0007 for what that
|
||
|
|
costs.
|
||
|
|
|
||
|
|
If this test starts failing, the correct first response is **not** to update the
|
||
|
|
selectors. Re-run the agentic ancestor: if it recovers, the surface moved and
|
||
|
|
this file should be regenerated; if it does not, the behaviour changed and that
|
||
|
|
is a finding.
|
||
|
|
"""
|
||
|
|
|
||
|
|
from __future__ import annotations
|
||
|
|
|
||
|
|
import urllib.error
|
||
|
|
import urllib.parse
|
||
|
|
import urllib.request
|
||
|
|
|
||
|
|
from scenarios.alice_bob_carol import _bob_can_read, _bob_cannot_write, _carol_cannot_read
|
||
|
|
|
||
|
|
TARGET = '/resources/R/grant'
|
||
|
|
FIELDS = {'permission': 'READ', 'subject_id': 'bob'}
|
||
|
|
|
||
|
|
|
||
|
|
def _post(base_url: str, token: str, path: str, fields: dict) -> int:
|
||
|
|
request = urllib.request.Request(
|
||
|
|
urllib.parse.urljoin(base_url, path),
|
||
|
|
data=urllib.parse.urlencode(fields).encode(),
|
||
|
|
method="POST",
|
||
|
|
headers={
|
||
|
|
"Authorization": f"Bearer {token}",
|
||
|
|
"Content-Type": "application/x-www-form-urlencoded",
|
||
|
|
},
|
||
|
|
)
|
||
|
|
try:
|
||
|
|
with urllib.request.urlopen(request, timeout=10) as response:
|
||
|
|
return response.status
|
||
|
|
except urllib.error.HTTPError as error:
|
||
|
|
return error.code
|
||
|
|
|
||
|
|
|
||
|
|
def realize(base_url: str, token: str) -> int:
|
||
|
|
"""Perform grant_access deterministically, exactly as the agent learned to."""
|
||
|
|
return _post(base_url, token, TARGET, FIELDS)
|
||
|
|
|
||
|
|
|
||
|
|
def test_grant_access(crystallized_world):
|
||
|
|
"""grant_access still works, and the claims it protects still hold."""
|
||
|
|
base_url, token, observe = crystallized_world
|
||
|
|
|
||
|
|
assert realize(base_url, token) < 400, "the frozen realization no longer works"
|
||
|
|
|
||
|
|
snapshot = observe()
|
||
|
|
assert _bob_can_read(snapshot), 'Bob can read R after the grant'
|
||
|
|
assert _carol_cannot_read(snapshot), 'Carol can never read R'
|
||
|
|
assert _bob_cannot_write(snapshot), 'A READ grant does not let Bob write R'
|