test_least_privilege.py
file-level
1
files
1
commits
0
hotspots
0
🧊 dead
0
💥 blast risk
| 1 | """Security tests — least-privilege regime enforcement.""" |
| 2 | |
| 3 | from __future__ import annotations |
| 4 | |
| 5 | from adapters.errors import ReadError |
| 6 | from tests.support import adapter_for, make_runner, ok |
| 7 | |
| 8 | |
| 9 | def test_muse_only_never_invokes_git(muse_only_config, repo_root) -> None: |
| 10 | runner = make_runner({}) |
| 11 | adapter = adapter_for(muse_only_config, repo_root, runner) |
| 12 | adapter.mirror(dry_run=False) |
| 13 | adapter.read_head("origin/main") |
| 14 | assert all("git " not in call[0] for call in runner.calls) |
| 15 | |
| 16 | |
| 17 | def test_git_only_rejects_muse_refs_without_subprocess(git_only_config, repo_root) -> None: |
| 18 | runner = make_runner({}) |
| 19 | adapter = adapter_for(git_only_config, repo_root, runner) |
| 20 | result = adapter.read_head("muse:main") |
| 21 | assert isinstance(result, ReadError) |
| 22 | assert runner.calls == [] |
| 23 | |
| 24 | |
| 25 | def test_muse_git_mirror_uses_absolute_repo_root(muse_git_mirror_config, repo_root) -> None: |
| 26 | root = str(repo_root.resolve()) |
| 27 | runner = make_runner( |
| 28 | { |
| 29 | f"muse -C {root} rev-parse --abbrev-ref HEAD": ok("main"), |
| 30 | f"muse -C {root} status --porcelain": ok(""), |
| 31 | "git rev-parse --abbrev-ref HEAD": ok("main"), |
| 32 | "git status --porcelain": ok(""), |
| 33 | } |
| 34 | ) |
| 35 | adapter = adapter_for(muse_git_mirror_config, repo_root, runner) |
| 36 | adapter.status() |
| 37 | muse_calls = [c for c in runner.calls if c[0].startswith("muse -C")] |
| 38 | assert muse_calls |
| 39 | for command, _cwd in muse_calls: |
| 40 | assert root in command |
| 41 | assert "muse -C ." not in command |
| 42 | |
| 43 | |
| 44 | def test_muse_only_mirror_never_pushes(muse_only_config, repo_root) -> None: |
| 45 | runner = make_runner({}) |
| 46 | adapter = adapter_for(muse_only_config, repo_root, runner) |
| 47 | result = adapter.mirror(dry_run=False) |
| 48 | assert result.pushed is False |