aaronrene / overseer-kit public
test_k7_bridge_security.py python
104 lines 3.5 KB
Raw
sha256:0e9549ec7b463911bc08b7d586dc320b1ac9b1f5c943ee7e3865dcc6cb0f6f83 chore(governance): sync handover+roadmap to 84db8c8 (drift:… Human 2 days ago
1 """Security tests for K7 bridge footprint (§K7.8 security tier)."""
2
3 from __future__ import annotations
4
5 import re
6 from pathlib import Path
7
8 from adapters.templating import render_template
9 from cli.footprint import MUSE_BRIDGE_DEPLOY_DEST
10 from cli.kit_root import kit_root
11 from tests.support import FIXTURES, git_status_runner, muse_mirror_status_runner, ok, run_cli
12
13
14 def test_git_only_init_sync_never_invokes_muse(tmp_path: Path) -> None:
15 runner = git_status_runner()
16 runner.responses.update(
17 {
18 "git rev-parse origin/main": ok("c" * 40),
19 "gh pr list --state merged --limit 5 --json number,title,mergeCommit,mergedAt": ok("[]"),
20 }
21 )
22 assert run_cli(
23 ["init", "--regime", "git-only", "--non-interactive"],
24 cwd=tmp_path,
25 runner=runner,
26 ) == 0
27 assert run_cli(["sync", "-y"], cwd=tmp_path, runner=runner) == 0
28 assert run_cli(["status"], cwd=tmp_path, runner=runner) == 0
29 assert run_cli(
30 ["governance-sync", "--dry-run"],
31 cwd=tmp_path,
32 runner=runner,
33 ) == 0
34 assert not (tmp_path / "MUSE-BRIDGE-WORKFLOW.md").exists()
35 assert all(not call[0].startswith("muse ") for call in runner.calls)
36
37
38 def test_muse_only_still_forbids_git_mirror_push(muse_only_config, repo_root) -> None:
39 from tests.support import adapter_for, make_runner
40
41 runner = make_runner({})
42 adapter = adapter_for(muse_only_config, repo_root, runner)
43 result = adapter.mirror(dry_run=False)
44 assert result.pushed is False
45 assert all("git push" not in call[0] for call in runner.calls)
46
47
48 def test_rendered_templates_contain_no_secrets_or_home_paths(muse_git_mirror_config) -> None:
49 templates_dir = kit_root() / "templates"
50 for name in (
51 "MUSE-BRIDGE-WORKFLOW.template.md",
52 "scripts/muse-bridge-deploy.sh.template",
53 ):
54 rendered = render_template(templates_dir / name, muse_git_mirror_config)
55 assert "/Users/" not in rendered
56 assert "AKIA" not in rendered
57 assert "sha256:" not in rendered
58 assert "password" not in rendered.lower()
59
60
61 def test_deploy_script_tokens_double_quoted_after_render(muse_git_mirror_config) -> None:
62 script = render_template(
63 kit_root() / "templates" / "scripts" / "muse-bridge-deploy.sh.template",
64 muse_git_mirror_config,
65 )
66 # Remote/branch vars must be assigned from double-quoted literals (S11).
67 assert 'GIT_REMOTE="origin"' in script or 'GIT_REMOTE="{{vcs.git.remote}}"' not in script
68 assert re.search(r'MIRROR_BRANCH="[^"]+"', script)
69 assert re.search(r'MAIN_BRANCH="[^"]+"', script)
70
71
72 def test_bridge_script_destination_confined_under_install_root(tmp_path: Path) -> None:
73 assert (
74 run_cli(
75 [
76 "init",
77 "--from-config",
78 str(FIXTURES / "config-muse-git-mirror.yaml"),
79 "--non-interactive",
80 ],
81 cwd=tmp_path,
82 runner=muse_mirror_status_runner(tmp_path),
83 )
84 == 0
85 )
86 script = tmp_path / MUSE_BRIDGE_DEPLOY_DEST
87 assert script.is_file()
88 assert script.resolve().is_relative_to(tmp_path.resolve())
89
90
91 def test_no_live_git_export_in_k7_tests(tmp_path: Path) -> None:
92 runner = muse_mirror_status_runner(tmp_path)
93 run_cli(
94 [
95 "init",
96 "--from-config",
97 str(FIXTURES / "config-overseer-kit-dogfood.yaml"),
98 "--non-interactive",
99 ],
100 cwd=tmp_path,
101 runner=runner,
102 )
103 export_calls = [c for c in runner.calls if "git-export" in c[0]]
104 assert export_calls == []
File History 1 commit
sha256:6abcf1fa82a7a621ccbc945f19acdba5bc0db54569599404a1452fb4a096a199 fix(ISR): default require_independent_second_reviewer to require Human minor ⚠ 2 days ago