the-custodian/docs/changes/CUST-WP-0073/interactive-launch-r2/test_probe_identity.py
codex 903616f2b7
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
CI Smoke / container-smoke (push) Successful in 10s
Reject generated-only commits / generated-commit-guard (push) Successful in 11s
Retain interactive isolation target and identity review
2026-10-19 14:47:02 +02:00

30 lines
1.2 KiB
Python

import unittest
from probe_identity import evaluate, ORIGIN_MACHINE
class IdentityTests(unittest.TestCase):
def test_old_identity_and_root_never_pass(self):
self.assertFalse(evaluate(0, 'a'*64, 0, 'a'*64)['identity_matches'])
self.assertFalse(evaluate(1000, ORIGIN_MACHINE, 1000, ORIGIN_MACHINE)['identity_matches'])
def test_same_uid_distinct_host_is_valid_partial_identity(self):
self.assertTrue(evaluate(1000, 'a'*64, 1000, 'a'*64)['identity_matches'])
def test_separate_uid_same_host_is_valid_partial_identity(self):
self.assertTrue(evaluate(1200, ORIGIN_MACHINE, 1200, ORIGIN_MACHINE)['identity_matches'])
def test_malformed_digest_refused(self):
self.assertFalse(evaluate(1200, 'z'*64, 1200, 'z'*64)['identity_matches'])
def test_wrong_host_or_user_fail(self):
self.assertFalse(evaluate(1200, 'a'*64, 1201, 'a'*64)['identity_matches'])
self.assertFalse(evaluate(1200, 'a'*64, 1200, 'b'*64)['identity_matches'])
def test_matching_child_is_never_assignment_admission(self):
result = evaluate(1200, 'a'*64, 1200, 'a'*64)
self.assertTrue(result['identity_matches'])
self.assertFalse(result['assignment_admitted'])
if __name__ == '__main__':
unittest.main()