test_cli_least_privilege.py
python
sha256:8d7f41aafae41deee70035a92f93602ef1722a290153597451e5932af503a42c
docs: queue board-identity follow-ups so they survive the session
Human
22 hours ago
| 1 | """Security tests — CLI least privilege (read-only VCS).""" |
| 2 | |
| 3 | from __future__ import annotations |
| 4 | |
| 5 | from pathlib import Path |
| 6 | |
| 7 | from tests.support import git_status_runner, muse_status_runner, run_cli |
| 8 | |
| 9 | WRITE_VERBS = ("commit", "push", "checkout", "add", "mirror", "realign") |
| 10 | |
| 11 | |
| 12 | def test_init_sync_status_never_invoke_write_verbs(tmp_path: Path) -> None: |
| 13 | runner = git_status_runner() |
| 14 | run_cli(["init", "--regime", "git-only", "--non-interactive"], cwd=tmp_path, runner=runner) |
| 15 | run_cli(["sync", "-y"], cwd=tmp_path, runner=runner) |
| 16 | run_cli(["status"], cwd=tmp_path, runner=runner) |
| 17 | for command, _cwd in runner.calls: |
| 18 | for verb in WRITE_VERBS: |
| 19 | assert verb not in command.lower() |
| 20 | |
| 21 | |
| 22 | def test_muse_only_status_never_invokes_git(tmp_path: Path) -> None: |
| 23 | from tests.support import FIXTURES |
| 24 | |
| 25 | runner = muse_status_runner(tmp_path) |
| 26 | run_cli( |
| 27 | ["init", "--from-config", str(FIXTURES / "config-muse-only.yaml"), "--non-interactive"], |
| 28 | cwd=tmp_path, |
| 29 | runner=runner, |
| 30 | ) |
| 31 | run_cli(["status"], cwd=tmp_path, runner=runner) |
| 32 | assert all("git " not in call[0] for call in runner.calls) |
File History
1 commit
sha256:8d7f41aafae41deee70035a92f93602ef1722a290153597451e5932af503a42c
docs: queue board-identity follow-ups so they survive the session
Human
22 hours ago