whitehat-security/tests/test_asm.py

import json

import pytest

from whitehat_security.asm import CALIBRATORS, asm_calibration, t06_calibration, t06_results
from whitehat_security.cli import main


def test_t06_enforcing_rejects_different_digest_without_openbao():
    results = {item.probe_id: item for item in t06_results(enforce=True)}
    assert results["t06-exact-consume"].outcome == "pass"
    assert results["t06-different-digest-replay"].outcome == "pass"
    assert results["t06-different-digest-replay"].openbao_calls == 0


def test_t06_known_bad_accepts_different_digest_and_calls_openbao():
    results = {item.probe_id: item for item in t06_results(enforce=False)}
    assert results["t06-different-digest-replay"].outcome == "finding"
    assert results["t06-different-digest-replay"].openbao_calls == 1


def test_t06_calibration_detects_known_bad_and_keeps_token_out():
    report = t06_calibration()
    assert report["outcome"] == "pass"
    assert report["evidence_class"] == "fixture"
    assert report["test_id"] == "T-06"
    rendered = json.dumps(report)
    assert "whitehat-t06-synthetic" not in rendered
    assert "Bearer" not in rendered
    bad = {item["probe_id"]: item for item in report["known_bad"]}
    assert bad["t06-different-digest-replay"]["outcome"] == "finding"


def test_asm_fixtures_cli_writes_t06(tmp_path):
    output = tmp_path / "offline-asm-t06-calibration.json"
    with pytest.raises(SystemExit) as stopped:
        main(["asm-fixtures", "--test-id", "T-06", "--output", str(output)])
    assert stopped.value.code == 0
    report = json.loads(output.read_text(encoding="utf-8"))
    assert report["outcome"] == "pass"
    assert report["test_id"] == "T-06"


@pytest.mark.parametrize("test_id", [key for key in CALIBRATORS if key != "T-06"])
def test_remaining_asm_calibrations_fail_known_bad(test_id):
    report = asm_calibration(test_id)
    assert report["outcome"] == "pass"
    assert report["evidence_class"] == "fixture"
    assert report["test_id"] == test_id
    assert any(item["outcome"] == "finding" for item in report["known_bad"])
    assert all(item["outcome"] == "pass" for item in report["known_good"])
    blob = json.dumps(report)
    assert "sk-whitehat-t02-not-a-real-secret" not in blob
    assert "whitehat-t06-synthetic" not in blob


def test_asm_fixtures_cli_refuses_unknown_test():
    with pytest.raises(SystemExit) as stopped:
        main(["asm-fixtures", "--test-id", "T-99"])
    assert stopped.value.code == 2