tegwick
95129d7a35
Encode fail-closed admission, target registrations, and a credential broker that never returns secret values. Calibrate audit-core shaped probes in-process. Send no packets and request no live credentials. Assistant: grok Assistant-Session: 01a02670-3345-76f2-a014-70fde8e2a2bb
54 lines
2 KiB
Python
54 lines
2 KiB
Python
import json
|
|
|
|
import pytest
|
|
|
|
from whitehat_security.cli import main
|
|
|
|
|
|
def test_validate_engagement_reports_clean_denial(tmp_path, capsys):
|
|
path = tmp_path / "pending.json"
|
|
path.write_text(json.dumps({}), encoding="utf-8")
|
|
with pytest.raises(SystemExit) as stopped:
|
|
main(["validate-engagement", str(path)])
|
|
assert stopped.value.code == 2
|
|
assert capsys.readouterr().err.startswith("not authorized:")
|
|
|
|
|
|
def test_validate_targets_accepts_catalog(capsys):
|
|
main(["validate-targets", "targets"])
|
|
assert capsys.readouterr().out.startswith("validated 4 target registrations")
|
|
|
|
|
|
def test_kill_switch_is_clear_by_default(capsys):
|
|
main(["kill-switch"])
|
|
assert capsys.readouterr().out.strip() == "clear"
|
|
|
|
|
|
def test_admit_plane_refuses_cancelled_engagement(capsys):
|
|
with pytest.raises(SystemExit) as stopped:
|
|
main([
|
|
"admit-plane",
|
|
"engagements/2026-08-21-audit-core-e2.json",
|
|
"targets/audit-core-e2.json",
|
|
])
|
|
assert stopped.value.code == 2
|
|
assert "not authorized:" in capsys.readouterr().err
|
|
|
|
|
|
def test_deliver_refuses_fixture_calibration(tmp_path, capsys):
|
|
report = tmp_path / "fixture.json"
|
|
report.write_text(json.dumps({
|
|
"schema_version": "whitehat-run/v1", "run_id": "run-1",
|
|
"evidence_class": "fixture", "engagement_id": "eng",
|
|
"authorization_id": "auth", "target": "fixture-e2",
|
|
"target_revision": "local", "posture_claim": "E2",
|
|
"attacker_model": "E2", "started_at": "2026-08-22T00:00:00Z",
|
|
"ended_at": "2026-08-22T00:01:00Z", "outcome": "pass",
|
|
"attempted_operations": 1, "cleanup": "n/a",
|
|
"credential_revocation": "n/a", "probes": [], "limitations": [],
|
|
"assurance_statement": "not proof",
|
|
}), encoding="utf-8")
|
|
with pytest.raises(SystemExit) as stopped:
|
|
main(["deliver", str(report), "--outbox", str(tmp_path / "outbox")])
|
|
assert stopped.value.code == 2
|
|
assert "fixture evidence" in capsys.readouterr().err
|