tegwick
75deaf073f
Reassess the T-06 blocker against the secrets-engine consume client. Gate House cited 3cd9955; approval_consume.py first appears at 4b4d556. An in-process CAS disables different-digest conflict for known-bad and drives consume_approval through a mock opener. No network or OpenBao. Live asm-t06 stays pending. Assistant: grok Assistant-Session: 01a05e32-c776-72a3-86ec-c490e027aca9
47 lines
1.8 KiB
Python
47 lines
1.8 KiB
Python
import json
|
|
|
|
import pytest
|
|
|
|
from whitehat_security.asm import t06_calibration, t06_results
|
|
from whitehat_security.cli import main
|
|
|
|
|
|
def test_t06_enforcing_rejects_different_digest_without_openbao():
|
|
results = {item.probe_id: item for item in t06_results(enforce=True)}
|
|
assert results["t06-exact-consume"].outcome == "pass"
|
|
assert results["t06-different-digest-replay"].outcome == "pass"
|
|
assert results["t06-different-digest-replay"].openbao_calls == 0
|
|
|
|
|
|
def test_t06_known_bad_accepts_different_digest_and_calls_openbao():
|
|
results = {item.probe_id: item for item in t06_results(enforce=False)}
|
|
assert results["t06-different-digest-replay"].outcome == "finding"
|
|
assert results["t06-different-digest-replay"].openbao_calls == 1
|
|
|
|
|
|
def test_t06_calibration_detects_known_bad_and_keeps_token_out():
|
|
report = t06_calibration()
|
|
assert report["outcome"] == "pass"
|
|
assert report["evidence_class"] == "fixture"
|
|
assert report["test_id"] == "T-06"
|
|
rendered = json.dumps(report)
|
|
assert "whitehat-t06-synthetic" not in rendered
|
|
assert "Bearer" not in rendered
|
|
bad = {item["probe_id"]: item for item in report["known_bad"]}
|
|
assert bad["t06-different-digest-replay"]["outcome"] == "finding"
|
|
|
|
|
|
def test_asm_fixtures_cli_writes_t06(tmp_path):
|
|
output = tmp_path / "offline-asm-t06-calibration.json"
|
|
with pytest.raises(SystemExit) as stopped:
|
|
main(["asm-fixtures", "--test-id", "T-06", "--output", str(output)])
|
|
assert stopped.value.code == 0
|
|
report = json.loads(output.read_text(encoding="utf-8"))
|
|
assert report["outcome"] == "pass"
|
|
assert report["test_id"] == "T-06"
|
|
|
|
|
|
def test_asm_fixtures_cli_refuses_unterminated_test():
|
|
with pytest.raises(SystemExit) as stopped:
|
|
main(["asm-fixtures", "--test-id", "T-01"])
|
|
assert stopped.value.code == 2
|