test_fail_closed.py
file-level
1
files
1
commits
0
hotspots
0
🧊 dead
0
💥 blast risk
| 1 | """Security tests — fail-closed read behavior.""" |
| 2 | |
| 3 | from __future__ import annotations |
| 4 | |
| 5 | from adapters.errors import ReadError |
| 6 | from tests.support import adapter_for, fail, make_runner, ok |
| 7 | |
| 8 | |
| 9 | def test_git_status_error_surfaces_exact_command(git_only_config, repo_root) -> None: |
| 10 | runner = make_runner( |
| 11 | { |
| 12 | "git rev-parse": ok("main"), |
| 13 | "git status": fail("permission denied", 128), |
| 14 | } |
| 15 | ) |
| 16 | adapter = adapter_for(git_only_config, repo_root, runner) |
| 17 | result = adapter.status() |
| 18 | assert isinstance(result, ReadError) |
| 19 | assert "git status" in result.command |
| 20 | assert result.exit_code == 128 |
| 21 | |
| 22 | |
| 23 | def test_muse_read_head_never_fabricates_sha(muse_only_config, repo_root) -> None: |
| 24 | root = str(repo_root) |
| 25 | runner = make_runner({f"muse -C {root} rev-parse main": fail("ref missing")}) |
| 26 | adapter = adapter_for(muse_only_config, repo_root, runner) |
| 27 | result = adapter.read_head("muse:main") |
| 28 | assert isinstance(result, ReadError) |
| 29 | |
| 30 | |
| 31 | def test_muse_git_mirror_realign_missing_anchor_is_read_error( |
| 32 | muse_git_mirror_config, |
| 33 | repo_root, |
| 34 | ) -> None: |
| 35 | adapter = adapter_for(muse_git_mirror_config, repo_root, make_runner({})) |
| 36 | result = adapter.realign(dry_run=True, max_commits=50) |
| 37 | assert isinstance(result, ReadError) |
| 38 | |
| 39 | |
| 40 | def test_mirror_git_import_failure_propagates(muse_git_mirror_config, repo_root) -> None: |
| 41 | bridge = repo_root / ".muse" |
| 42 | bridge.mkdir(parents=True) |
| 43 | (bridge / "git-bridge.toml").write_text( |
| 44 | '[last_import]\ngit_sha = "abc"\n', |
| 45 | encoding="utf-8", |
| 46 | ) |
| 47 | root = str(repo_root) |
| 48 | runner = make_runner( |
| 49 | { |
| 50 | "git rev-parse": ok("def"), |
| 51 | "git rev-list": ok("1"), |
| 52 | f"muse -C {root} bridge": fail("import failed"), |
| 53 | } |
| 54 | ) |
| 55 | adapter = adapter_for(muse_git_mirror_config, repo_root, runner) |
| 56 | result = adapter.realign(dry_run=False, max_commits=50) |
| 57 | assert isinstance(result, ReadError) |