tegwick
3295b715c5
Land the sanitized WH-ENG-20260822-AUDIT-E2-03 report, mark the engagement completed and terminal, and close the applicable E2 harness and risk-nexus delivery tasks. flex-auth stays pending; tenant-engine stays not_applicable. Assistant: grok Assistant-Session: 01a02670-3345-76f2-a014-70fde8e2a2bb
277 lines
11 KiB
Python
277 lines
11 KiB
Python
import json
|
|
from pathlib import Path
|
|
|
|
import pytest
|
|
|
|
from whitehat_security.cli import main
|
|
from whitehat_security.plane import ReceiptBroker
|
|
|
|
|
|
def test_validate_engagement_reports_clean_denial(tmp_path, capsys):
|
|
path = tmp_path / "pending.json"
|
|
path.write_text(json.dumps({}), encoding="utf-8")
|
|
with pytest.raises(SystemExit) as stopped:
|
|
main(["validate-engagement", str(path)])
|
|
assert stopped.value.code == 2
|
|
assert capsys.readouterr().err.startswith("not authorized:")
|
|
|
|
|
|
def test_validate_targets_accepts_catalog(capsys):
|
|
main(["validate-targets", "targets"])
|
|
assert capsys.readouterr().out.startswith("validated 8 target registrations")
|
|
|
|
|
|
def test_kill_switch_is_clear_by_default(capsys):
|
|
main(["kill-switch"])
|
|
assert capsys.readouterr().out.strip() == "clear"
|
|
|
|
|
|
def test_validate_engagement_refuses_elapsed_window(capsys):
|
|
with pytest.raises(SystemExit) as stopped:
|
|
main(["validate-engagement", "engagements/2026-08-22-audit-core-e2.json"])
|
|
assert stopped.value.code == 2
|
|
err = capsys.readouterr().err
|
|
assert err.startswith("not authorized:")
|
|
assert "elapsed" in err
|
|
|
|
|
|
def test_admit_plane_refuses_elapsed_window(capsys):
|
|
with pytest.raises(SystemExit) as stopped:
|
|
main([
|
|
"admit-plane",
|
|
"engagements/2026-08-22-audit-core-e2.json",
|
|
"targets/audit-core-e2.json",
|
|
])
|
|
assert stopped.value.code == 2
|
|
err = capsys.readouterr().err
|
|
assert "not authorized:" in err
|
|
assert "elapsed" in err
|
|
|
|
|
|
def test_admit_plane_refuses_cancelled_engagement(capsys):
|
|
with pytest.raises(SystemExit) as stopped:
|
|
main([
|
|
"admit-plane",
|
|
"engagements/2026-08-21-audit-core-e2.json",
|
|
"targets/audit-core-e2.json",
|
|
])
|
|
assert stopped.value.code == 2
|
|
assert "not authorized:" in capsys.readouterr().err
|
|
|
|
|
|
def _live_e2_record():
|
|
return {
|
|
"engagement_id": "WH-ENG-CLI-RECEIPT",
|
|
"authorization_id": "auth-cli",
|
|
"authorizer": "operator",
|
|
"approved_at": "2026-08-22T00:00:00Z",
|
|
"expires_at": "2099-01-01T00:00:00Z",
|
|
"target": "https://fixture.invalid",
|
|
"target_id": "audit-core",
|
|
"target_owner": "audit-core",
|
|
"environment": "build",
|
|
"source": "runner",
|
|
"approval_class": "live-e2",
|
|
"plane_namespace": "whitehat",
|
|
"runner_image_digest": "sha256:abc",
|
|
"routes": ["POST /v1/events"],
|
|
"fixture_ids": ["object-a", "object-b"],
|
|
"credential_lane": "receipt",
|
|
"credential_role": "runtime",
|
|
"credential_max_ttl_seconds": 900,
|
|
"techniques": ["e2-differential"],
|
|
"prohibited_techniques": ["saturation"],
|
|
"rate_limit_per_minute": 10,
|
|
"max_concurrency": 1,
|
|
"maximum_requests": 8,
|
|
"window_start": "2026-08-22T00:00:00Z",
|
|
"window_end": "2099-01-01T00:00:00Z",
|
|
"operator_contact": "operator",
|
|
"abort_contact": "operator",
|
|
"posture_claim": "E2",
|
|
"attacker_model": "E2-authenticated-tenant-a",
|
|
"finding_destination": "risk-nexus",
|
|
"target_owner_acknowledged_at": "2026-08-22T00:01:00Z",
|
|
}
|
|
|
|
|
|
def _receipt(**overrides):
|
|
data = {
|
|
"engagement_id": "WH-ENG-CLI-RECEIPT",
|
|
"projected_at": "2026-08-22T19:17:54Z",
|
|
"expires_at": "2099-01-01T00:00:00Z",
|
|
"identities": ["whitehat-e2-a-example", "whitehat-e2-b-example"],
|
|
"mounted_secret": "whitehat/whitehat-e2-audit-credentials",
|
|
"mounted_keys": ["token-a", "token-b"],
|
|
"target_ready": True,
|
|
"secret_values_observed": False,
|
|
}
|
|
data.update(overrides)
|
|
return data
|
|
|
|
|
|
def test_admit_plane_without_receipt_still_fails_closed(tmp_path, capsys):
|
|
path = tmp_path / "engagement.json"
|
|
path.write_text(json.dumps(_live_e2_record()), encoding="utf-8")
|
|
with pytest.raises(SystemExit) as stopped:
|
|
main(["admit-plane", str(path), "targets/audit-core-e2.json"])
|
|
assert stopped.value.code == 2
|
|
assert "no credential was requested" in capsys.readouterr().err
|
|
|
|
|
|
def test_admit_plane_receipt_issues_lease(tmp_path, capsys):
|
|
engagement = tmp_path / "engagement.json"
|
|
receipt = tmp_path / "receipt.json"
|
|
engagement.write_text(json.dumps(_live_e2_record()), encoding="utf-8")
|
|
receipt.write_text(json.dumps(_receipt()), encoding="utf-8")
|
|
main(["admit-plane", str(engagement), "targets/audit-core-e2.json", "--receipt", str(receipt)])
|
|
out = capsys.readouterr().out
|
|
assert out.startswith("admitted: WH-ENG-CLI-RECEIPT")
|
|
|
|
|
|
def test_admit_plane_receipt_refuses_secret_material(tmp_path, capsys):
|
|
engagement = tmp_path / "engagement.json"
|
|
receipt = tmp_path / "receipt.json"
|
|
engagement.write_text(json.dumps(_live_e2_record()), encoding="utf-8")
|
|
receipt.write_text(json.dumps(_receipt(token="must-not-appear")), encoding="utf-8")
|
|
with pytest.raises(SystemExit) as stopped:
|
|
main(["admit-plane", str(engagement), "targets/audit-core-e2.json", "--receipt", str(receipt)])
|
|
assert stopped.value.code == 2
|
|
assert "secret material" in capsys.readouterr().err
|
|
|
|
|
|
def test_example_projection_receipt_is_value_safe():
|
|
broker = ReceiptBroker.load("engagements/receipts/example-projection-receipt.json")
|
|
assert broker.receipt["engagement_id"] == "WH-ENG-EXAMPLE"
|
|
assert broker.receipt["secret_values_observed"] is False
|
|
assert broker.receipt["mounted_keys"] == ["token-a", "token-b"]
|
|
|
|
|
|
def test_admit_plane_wp0025_receipt_requires_contract(tmp_path, capsys):
|
|
engagement = tmp_path / "engagement.json"
|
|
receipt = tmp_path / "receipt.json"
|
|
engagement.write_text(json.dumps(_live_e2_record()), encoding="utf-8")
|
|
receipt.write_text(json.dumps({
|
|
"interface": "railiance.custody-projection-receipt",
|
|
"version": 1,
|
|
"engagement_id": "WH-ENG-CLI-RECEIPT",
|
|
"secret_values_observed": False,
|
|
}), encoding="utf-8")
|
|
with pytest.raises(SystemExit) as stopped:
|
|
main(["admit-plane", str(engagement), "targets/audit-core-e2.json",
|
|
"--receipt", str(receipt)])
|
|
assert stopped.value.code == 2
|
|
assert "requires a bound contract" in capsys.readouterr().err
|
|
|
|
|
|
def test_admit_plane_wp0025_receipt_requires_broker_receipt(tmp_path, capsys):
|
|
engagement = tmp_path / "engagement.json"
|
|
receipt = tmp_path / "receipt.json"
|
|
contract = tmp_path / "contract.json"
|
|
engagement.write_text(json.dumps(_live_e2_record()), encoding="utf-8")
|
|
receipt.write_text(json.dumps({
|
|
"interface": "railiance.custody-projection-receipt",
|
|
"version": 1,
|
|
"engagement_id": "WH-ENG-CLI-RECEIPT",
|
|
"secret_values_observed": False,
|
|
}), encoding="utf-8")
|
|
contract.write_text(json.dumps({
|
|
"interface": "railiance.custody-projection-contract",
|
|
"version": 1,
|
|
}), encoding="utf-8")
|
|
with pytest.raises(SystemExit) as stopped:
|
|
main(["admit-plane", str(engagement), "targets/audit-core-e2.json",
|
|
"--receipt", str(receipt), "--contract", str(contract)])
|
|
assert stopped.value.code == 2
|
|
assert "requires a bound broker receipt" in capsys.readouterr().err
|
|
|
|
|
|
def test_admit_plane_wp0025_mismatched_broker_receipt(tmp_path, capsys):
|
|
from test_platform_custody_adapter import (
|
|
broker_readiness, contract, digest, projection_receipt,
|
|
)
|
|
|
|
bound = contract()
|
|
receipt_doc = projection_receipt(bound)
|
|
receipt_doc["broker_receipt_digest"] = "0" * 64
|
|
receipt_doc["receipt_id"] = "sha256:" + digest(
|
|
{key: value for key, value in receipt_doc.items() if key != "receipt_id"}
|
|
)
|
|
engagement = tmp_path / "engagement.json"
|
|
receipt = tmp_path / "receipt.json"
|
|
contract_path = tmp_path / "contract.json"
|
|
broker_path = tmp_path / "broker.json"
|
|
engagement.write_text(json.dumps(_live_e2_record()), encoding="utf-8")
|
|
receipt.write_text(json.dumps(receipt_doc), encoding="utf-8")
|
|
contract_path.write_text(json.dumps(bound), encoding="utf-8")
|
|
broker_path.write_text(json.dumps(broker_readiness(bound)), encoding="utf-8")
|
|
with pytest.raises(SystemExit) as stopped:
|
|
main([
|
|
"admit-plane", str(engagement), "targets/audit-core-e2.json",
|
|
"--receipt", str(receipt),
|
|
"--contract", str(contract_path),
|
|
"--broker-receipt", str(broker_path),
|
|
])
|
|
assert stopped.value.code == 2
|
|
assert "broker digest" in capsys.readouterr().err
|
|
|
|
|
|
def test_deliver_queues_target_pass_without_severity(tmp_path, capsys):
|
|
report = json.loads(
|
|
Path("evidence/WH-ENG-20260822-AUDIT-E2-03.json").read_text(encoding="utf-8")
|
|
)
|
|
assert report["outcome"] == "pass"
|
|
assert report["evidence_class"] == "target"
|
|
main(["deliver", "evidence/WH-ENG-20260822-AUDIT-E2-03.json",
|
|
"--outbox", str(tmp_path / "outbox")])
|
|
queued = (tmp_path / "outbox" / f"{report['run_id']}.md").read_text(encoding="utf-8")
|
|
assert capsys.readouterr().out.startswith("queued:")
|
|
assert "pass" in queued
|
|
assert "Severity" not in queued
|
|
assert report["engagement_id"] in queued
|
|
|
|
|
|
def test_admit_plane_refuses_completed_engagement(capsys):
|
|
with pytest.raises(SystemExit) as stopped:
|
|
main([
|
|
"admit-plane",
|
|
"engagements/2026-08-22-audit-core-e2-03.json",
|
|
"targets/audit-core-e2.json",
|
|
])
|
|
assert stopped.value.code == 2
|
|
err = capsys.readouterr().err
|
|
assert "not authorized:" in err
|
|
assert "completed" in err
|
|
|
|
|
|
def test_deliver_queues_abort_without_calling_it_target_assurance(tmp_path, capsys):
|
|
report = json.loads(
|
|
Path("evidence/WH-ENG-20260822-AUDIT-E2-02-abort.json").read_text(encoding="utf-8")
|
|
)
|
|
path = tmp_path / "abort.json"
|
|
path.write_text(json.dumps(report), encoding="utf-8")
|
|
main(["deliver", str(path), "--outbox", str(tmp_path / "outbox")])
|
|
queued = (tmp_path / "outbox" / f"{report['run_id']}.md").read_text(encoding="utf-8")
|
|
assert capsys.readouterr().out.startswith("queued:")
|
|
assert "abort" in queued
|
|
assert "not target assurance" in queued
|
|
assert "Severity" not in queued
|
|
|
|
|
|
def test_deliver_refuses_fixture_calibration(tmp_path, capsys):
|
|
report = tmp_path / "fixture.json"
|
|
report.write_text(json.dumps({
|
|
"schema_version": "whitehat-run/v1", "run_id": "run-1",
|
|
"evidence_class": "fixture", "engagement_id": "eng",
|
|
"authorization_id": "auth", "target": "fixture-e2",
|
|
"target_revision": "local", "posture_claim": "E2",
|
|
"attacker_model": "E2", "started_at": "2026-08-22T00:00:00Z",
|
|
"ended_at": "2026-08-22T00:01:00Z", "outcome": "pass",
|
|
"attempted_operations": 1, "cleanup": "n/a",
|
|
"credential_revocation": "n/a", "probes": [], "limitations": [],
|
|
"assurance_statement": "not proof",
|
|
}), encoding="utf-8")
|
|
with pytest.raises(SystemExit) as stopped:
|
|
main(["deliver", str(report), "--outbox", str(tmp_path / "outbox")])
|
|
assert stopped.value.code == 2
|
|
assert "fixture evidence" in capsys.readouterr().err
|