aaronrene / overseer-kit public
test_least_privilege.py python
48 lines 1.7 KB
Raw
sha256:a78e7e5a8740e03315f325d19edeb3aa1b306b3337d04abbaa9a9e0f3bbeb7a1 docs: MuseHub-first before ISR #74 — staging solidify NEXT Human 12 hours ago
1 """Security tests — least-privilege regime enforcement."""
2
3 from __future__ import annotations
4
5 from adapters.errors import ReadError
6 from tests.support import adapter_for, make_runner, ok
7
8
9 def test_muse_only_never_invokes_git(muse_only_config, repo_root) -> None:
10 runner = make_runner({})
11 adapter = adapter_for(muse_only_config, repo_root, runner)
12 adapter.mirror(dry_run=False)
13 adapter.read_head("origin/main")
14 assert all("git " not in call[0] for call in runner.calls)
15
16
17 def test_git_only_rejects_muse_refs_without_subprocess(git_only_config, repo_root) -> None:
18 runner = make_runner({})
19 adapter = adapter_for(git_only_config, repo_root, runner)
20 result = adapter.read_head("muse:main")
21 assert isinstance(result, ReadError)
22 assert runner.calls == []
23
24
25 def test_muse_git_mirror_uses_absolute_repo_root(muse_git_mirror_config, repo_root) -> None:
26 root = str(repo_root.resolve())
27 runner = make_runner(
28 {
29 f"muse -C {root} rev-parse --abbrev-ref HEAD": ok("main"),
30 f"muse -C {root} status --porcelain": ok(""),
31 "git rev-parse --abbrev-ref HEAD": ok("main"),
32 "git status --porcelain": ok(""),
33 }
34 )
35 adapter = adapter_for(muse_git_mirror_config, repo_root, runner)
36 adapter.status()
37 muse_calls = [c for c in runner.calls if c[0].startswith("muse -C")]
38 assert muse_calls
39 for command, _cwd in muse_calls:
40 assert root in command
41 assert "muse -C ." not in command
42
43
44 def test_muse_only_mirror_never_pushes(muse_only_config, repo_root) -> None:
45 runner = make_runner({})
46 adapter = adapter_for(muse_only_config, repo_root, runner)
47 result = adapter.mirror(dry_run=False)
48 assert result.pushed is False
File History 2 commits
sha256:a78e7e5a8740e03315f325d19edeb3aa1b306b3337d04abbaa9a9e0f3bbeb7a1 docs: MuseHub-first before ISR #74 — staging solidify NEXT Human 12 hours ago
sha256:4671b7f787ddbe63ced31c895b688c77ab495653b65a730b423329f26b3c1439 feat: K1-P1 complete — agent provenance, build-verification… Sonnet 4.6 patch 52 days ago