tegwick
481ed6add5
Meantime polish while live E2 waits on a new trial. Example receipts carry handles only. admit-plane --receipt is tested. Aborts can be queued without being target assurance. Assistant: grok Assistant-Session: 01a02670-3345-76f2-a014-70fde8e2a2bb
180 lines
6.9 KiB
Python
180 lines
6.9 KiB
Python
import json
|
|
from pathlib import Path
|
|
|
|
import pytest
|
|
|
|
from whitehat_security.cli import main
|
|
from whitehat_security.plane import ReceiptBroker
|
|
|
|
|
|
def test_validate_engagement_reports_clean_denial(tmp_path, capsys):
|
|
path = tmp_path / "pending.json"
|
|
path.write_text(json.dumps({}), encoding="utf-8")
|
|
with pytest.raises(SystemExit) as stopped:
|
|
main(["validate-engagement", str(path)])
|
|
assert stopped.value.code == 2
|
|
assert capsys.readouterr().err.startswith("not authorized:")
|
|
|
|
|
|
def test_validate_targets_accepts_catalog(capsys):
|
|
main(["validate-targets", "targets"])
|
|
assert capsys.readouterr().out.startswith("validated 8 target registrations")
|
|
|
|
|
|
def test_kill_switch_is_clear_by_default(capsys):
|
|
main(["kill-switch"])
|
|
assert capsys.readouterr().out.strip() == "clear"
|
|
|
|
|
|
def test_validate_engagement_refuses_elapsed_window(capsys):
|
|
with pytest.raises(SystemExit) as stopped:
|
|
main(["validate-engagement", "engagements/2026-08-22-audit-core-e2.json"])
|
|
assert stopped.value.code == 2
|
|
err = capsys.readouterr().err
|
|
assert err.startswith("not authorized:")
|
|
assert "elapsed" in err
|
|
|
|
|
|
def test_admit_plane_refuses_elapsed_window(capsys):
|
|
with pytest.raises(SystemExit) as stopped:
|
|
main([
|
|
"admit-plane",
|
|
"engagements/2026-08-22-audit-core-e2.json",
|
|
"targets/audit-core-e2.json",
|
|
])
|
|
assert stopped.value.code == 2
|
|
err = capsys.readouterr().err
|
|
assert "not authorized:" in err
|
|
assert "elapsed" in err
|
|
|
|
|
|
def test_admit_plane_refuses_cancelled_engagement(capsys):
|
|
with pytest.raises(SystemExit) as stopped:
|
|
main([
|
|
"admit-plane",
|
|
"engagements/2026-08-21-audit-core-e2.json",
|
|
"targets/audit-core-e2.json",
|
|
])
|
|
assert stopped.value.code == 2
|
|
assert "not authorized:" in capsys.readouterr().err
|
|
|
|
|
|
def _live_e2_record():
|
|
return {
|
|
"engagement_id": "WH-ENG-CLI-RECEIPT",
|
|
"authorization_id": "auth-cli",
|
|
"authorizer": "operator",
|
|
"approved_at": "2026-08-22T00:00:00Z",
|
|
"expires_at": "2099-01-01T00:00:00Z",
|
|
"target": "https://fixture.invalid",
|
|
"target_id": "audit-core",
|
|
"target_owner": "audit-core",
|
|
"environment": "build",
|
|
"source": "runner",
|
|
"approval_class": "live-e2",
|
|
"plane_namespace": "whitehat",
|
|
"runner_image_digest": "sha256:abc",
|
|
"routes": ["POST /v1/events"],
|
|
"fixture_ids": ["object-a", "object-b"],
|
|
"credential_lane": "receipt",
|
|
"credential_role": "runtime",
|
|
"credential_max_ttl_seconds": 900,
|
|
"techniques": ["e2-differential"],
|
|
"prohibited_techniques": ["saturation"],
|
|
"rate_limit_per_minute": 10,
|
|
"max_concurrency": 1,
|
|
"maximum_requests": 8,
|
|
"window_start": "2026-08-22T00:00:00Z",
|
|
"window_end": "2099-01-01T00:00:00Z",
|
|
"operator_contact": "operator",
|
|
"abort_contact": "operator",
|
|
"posture_claim": "E2",
|
|
"attacker_model": "E2-authenticated-tenant-a",
|
|
"finding_destination": "risk-nexus",
|
|
"target_owner_acknowledged_at": "2026-08-22T00:01:00Z",
|
|
}
|
|
|
|
|
|
def _receipt(**overrides):
|
|
data = {
|
|
"engagement_id": "WH-ENG-CLI-RECEIPT",
|
|
"projected_at": "2026-08-22T19:17:54Z",
|
|
"expires_at": "2099-01-01T00:00:00Z",
|
|
"identities": ["whitehat-e2-a-example", "whitehat-e2-b-example"],
|
|
"mounted_secret": "whitehat/whitehat-e2-audit-credentials",
|
|
"mounted_keys": ["token-a", "token-b"],
|
|
"target_ready": True,
|
|
"secret_values_observed": False,
|
|
}
|
|
data.update(overrides)
|
|
return data
|
|
|
|
|
|
def test_admit_plane_without_receipt_still_fails_closed(tmp_path, capsys):
|
|
path = tmp_path / "engagement.json"
|
|
path.write_text(json.dumps(_live_e2_record()), encoding="utf-8")
|
|
with pytest.raises(SystemExit) as stopped:
|
|
main(["admit-plane", str(path), "targets/audit-core-e2.json"])
|
|
assert stopped.value.code == 2
|
|
assert "no credential was requested" in capsys.readouterr().err
|
|
|
|
|
|
def test_admit_plane_receipt_issues_lease(tmp_path, capsys):
|
|
engagement = tmp_path / "engagement.json"
|
|
receipt = tmp_path / "receipt.json"
|
|
engagement.write_text(json.dumps(_live_e2_record()), encoding="utf-8")
|
|
receipt.write_text(json.dumps(_receipt()), encoding="utf-8")
|
|
main(["admit-plane", str(engagement), "targets/audit-core-e2.json", "--receipt", str(receipt)])
|
|
out = capsys.readouterr().out
|
|
assert out.startswith("admitted: WH-ENG-CLI-RECEIPT")
|
|
|
|
|
|
def test_admit_plane_receipt_refuses_secret_material(tmp_path, capsys):
|
|
engagement = tmp_path / "engagement.json"
|
|
receipt = tmp_path / "receipt.json"
|
|
engagement.write_text(json.dumps(_live_e2_record()), encoding="utf-8")
|
|
receipt.write_text(json.dumps(_receipt(token="must-not-appear")), encoding="utf-8")
|
|
with pytest.raises(SystemExit) as stopped:
|
|
main(["admit-plane", str(engagement), "targets/audit-core-e2.json", "--receipt", str(receipt)])
|
|
assert stopped.value.code == 2
|
|
assert "secret material" in capsys.readouterr().err
|
|
|
|
|
|
def test_example_projection_receipt_is_value_safe():
|
|
broker = ReceiptBroker.load("engagements/receipts/example-projection-receipt.json")
|
|
assert broker.receipt["engagement_id"] == "WH-ENG-EXAMPLE"
|
|
assert broker.receipt["secret_values_observed"] is False
|
|
assert broker.receipt["mounted_keys"] == ["token-a", "token-b"]
|
|
|
|
|
|
def test_deliver_queues_abort_without_calling_it_target_assurance(tmp_path, capsys):
|
|
report = json.loads(
|
|
Path("evidence/WH-ENG-20260822-AUDIT-E2-02-abort.json").read_text(encoding="utf-8")
|
|
)
|
|
path = tmp_path / "abort.json"
|
|
path.write_text(json.dumps(report), encoding="utf-8")
|
|
main(["deliver", str(path), "--outbox", str(tmp_path / "outbox")])
|
|
queued = (tmp_path / "outbox" / f"{report['run_id']}.md").read_text(encoding="utf-8")
|
|
assert capsys.readouterr().out.startswith("queued:")
|
|
assert "abort" in queued
|
|
assert "not target assurance" in queued
|
|
assert "Severity" not in queued
|
|
|
|
|
|
def test_deliver_refuses_fixture_calibration(tmp_path, capsys):
|
|
report = tmp_path / "fixture.json"
|
|
report.write_text(json.dumps({
|
|
"schema_version": "whitehat-run/v1", "run_id": "run-1",
|
|
"evidence_class": "fixture", "engagement_id": "eng",
|
|
"authorization_id": "auth", "target": "fixture-e2",
|
|
"target_revision": "local", "posture_claim": "E2",
|
|
"attacker_model": "E2", "started_at": "2026-08-22T00:00:00Z",
|
|
"ended_at": "2026-08-22T00:01:00Z", "outcome": "pass",
|
|
"attempted_operations": 1, "cleanup": "n/a",
|
|
"credential_revocation": "n/a", "probes": [], "limitations": [],
|
|
"assurance_statement": "not proof",
|
|
}), encoding="utf-8")
|
|
with pytest.raises(SystemExit) as stopped:
|
|
main(["deliver", str(report), "--outbox", str(tmp_path / "outbox")])
|
|
assert stopped.value.code == 2
|
|
assert "fixture evidence" in capsys.readouterr().err
|