tegwick
461554a749
Owner acknowledgement remains pending. Offline admission stays fail-closed. No credentials requested and no packets sent. Assistant: grok Assistant-Session: 01a02670-3345-76f2-a014-70fde8e2a2bb
76 lines
2.7 KiB
Python
76 lines
2.7 KiB
Python
import json
|
|
|
|
import pytest
|
|
|
|
from whitehat_security.cli import main
|
|
|
|
|
|
def test_validate_engagement_reports_clean_denial(tmp_path, capsys):
|
|
path = tmp_path / "pending.json"
|
|
path.write_text(json.dumps({}), encoding="utf-8")
|
|
with pytest.raises(SystemExit) as stopped:
|
|
main(["validate-engagement", str(path)])
|
|
assert stopped.value.code == 2
|
|
assert capsys.readouterr().err.startswith("not authorized:")
|
|
|
|
|
|
def test_validate_targets_accepts_catalog(capsys):
|
|
main(["validate-targets", "targets"])
|
|
assert capsys.readouterr().out.startswith("validated 8 target registrations")
|
|
|
|
|
|
def test_kill_switch_is_clear_by_default(capsys):
|
|
main(["kill-switch"])
|
|
assert capsys.readouterr().out.strip() == "clear"
|
|
|
|
|
|
def test_validate_engagement_refuses_unacknowledged_record(capsys):
|
|
with pytest.raises(SystemExit) as stopped:
|
|
main(["validate-engagement", "engagements/2026-08-22-audit-core-e2.json"])
|
|
assert stopped.value.code == 2
|
|
err = capsys.readouterr().err
|
|
assert err.startswith("not authorized:")
|
|
assert "acknowledgement is pending" in err
|
|
|
|
|
|
def test_admit_plane_refuses_unacknowledged_record(capsys):
|
|
with pytest.raises(SystemExit) as stopped:
|
|
main([
|
|
"admit-plane",
|
|
"engagements/2026-08-22-audit-core-e2.json",
|
|
"targets/audit-core-e2.json",
|
|
])
|
|
assert stopped.value.code == 2
|
|
err = capsys.readouterr().err
|
|
assert "not authorized:" in err
|
|
assert "acknowledgement is pending" in err
|
|
|
|
|
|
def test_admit_plane_refuses_cancelled_engagement(capsys):
|
|
with pytest.raises(SystemExit) as stopped:
|
|
main([
|
|
"admit-plane",
|
|
"engagements/2026-08-21-audit-core-e2.json",
|
|
"targets/audit-core-e2.json",
|
|
])
|
|
assert stopped.value.code == 2
|
|
assert "not authorized:" in capsys.readouterr().err
|
|
|
|
|
|
def test_deliver_refuses_fixture_calibration(tmp_path, capsys):
|
|
report = tmp_path / "fixture.json"
|
|
report.write_text(json.dumps({
|
|
"schema_version": "whitehat-run/v1", "run_id": "run-1",
|
|
"evidence_class": "fixture", "engagement_id": "eng",
|
|
"authorization_id": "auth", "target": "fixture-e2",
|
|
"target_revision": "local", "posture_claim": "E2",
|
|
"attacker_model": "E2", "started_at": "2026-08-22T00:00:00Z",
|
|
"ended_at": "2026-08-22T00:01:00Z", "outcome": "pass",
|
|
"attempted_operations": 1, "cleanup": "n/a",
|
|
"credential_revocation": "n/a", "probes": [], "limitations": [],
|
|
"assurance_statement": "not proof",
|
|
}), encoding="utf-8")
|
|
with pytest.raises(SystemExit) as stopped:
|
|
main(["deliver", str(report), "--outbox", str(tmp_path / "outbox")])
|
|
assert stopped.value.code == 2
|
|
assert "fixture evidence" in capsys.readouterr().err
|