coulomb/whitehat-security
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Cover WH-ENG-20260822-AUDIT-E2-02 fixtures and window gates

Browse source 
The retry record is distinct from the expired -01 identifiers and is only
authorized inside 19:15Z-19:30Z.

Assistant: grok
Assistant-Session: 01a02670-3345-76f2-a014-70fde8e2a2bb
This commit is contained in:
tegwick 2026-08-22 20:56:35 +02:00
parent e1f9f81d15
commit b6c1806680
2 changed files with 32 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

22
tests/test_audit_core_runner.py
View file

@ -62,3 +62,25 @@ def test_invocation_fixture_set_is_declared_by_current_engagement():
)
assert runner.invocation_fixture_ids(args) <= set(engagement["fixture_ids"])
def test_retry_invocation_fixture_set_is_declared_and_distinct():
previous = json.loads(
Path("engagements/2026-08-22-audit-core-e2.json").read_text()
)
engagement = json.loads(
Path("engagements/2026-08-22-audit-core-e2-02.json").read_text()
)
args = Namespace(
tenant_a="tenant:trial:whitehat-a-20260822-02",
tenant_b="tenant:trial:whitehat-b-20260822-02",
event_a="whitehat-e2-event-a-20260822-02",
event_b="whitehat-e2-event-b-20260822-02",
absent_event="whitehat-e2-absent-20260822-02",
forged_event="whitehat-e2-forged-b-20260822-02",
correlation="whitehat-e2-correlation-20260822-02",
)
fixtures = runner.invocation_fixture_ids(args)
assert fixtures <= set(engagement["fixture_ids"])
assert fixtures.isdisjoint(previous["fixture_ids"])
assert engagement["engagement_id"] != previous["engagement_id"]

10
tests/test_engagement.py
View file

@ -63,6 +63,16 @@ def test_pending_owner_acknowledgement_fails_closed(tmp_path):
load(tmp_path, data)
def test_retry_record_is_authorized_only_inside_its_window():
path = "engagements/2026-08-22-audit-core-e2-02.json"
with pytest.raises(AuthorizationError, match="has not started"):
Engagement.load(path, now=datetime(2026, 8, 22, 19, 14, tzinfo=UTC))
engagement = Engagement.load(path, now=datetime(2026, 8, 22, 19, 15, tzinfo=UTC))
assert engagement.raw["engagement_id"] == "WH-ENG-20260822-AUDIT-E2-02"
with pytest.raises(AuthorizationError, match="outside"):
Engagement.load(path, now=datetime(2026, 8, 22, 19, 31, tzinfo=UTC))
def test_elapsed_record_fails_closed_even_inside_old_window(tmp_path):
data = record()
data["status"] = "expired"