aaronrene / overseer-kit public
test_review_least_privilege.py python
62 lines 1.8 KB
Raw
sha256:a78e7e5a8740e03315f325d19edeb3aa1b306b3337d04abbaa9a9e0f3bbeb7a1 docs: MuseHub-first before ISR #74 — staging solidify NEXT Human 3 days ago
1 """Security tests — review least privilege (§K5.12)."""
2
3 from __future__ import annotations
4
5 from pathlib import Path
6
7 from cli.kit_root import kit_root
8 from tests.support import (
9 FIXTURES,
10 git_status_runner,
11 muse_status_runner,
12 pass_provider_factory,
13 run_cli,
14 seed_freeze_repo,
15 )
16
17 WRITE_VERBS = ("commit", "push", "checkout", "add", "mirror", "realign")
18
19
20 def test_review_never_invokes_write_verbs(tmp_path: Path) -> None:
21 artifact = seed_freeze_repo(tmp_path)
22 rel = artifact.relative_to(tmp_path).as_posix()
23 runner = git_status_runner()
24 run_cli(
25 ["review", "--freeze", rel, "--dry-run"],
26 cwd=tmp_path,
27 runner=runner,
28 kit=kit_root(),
29 review_provider_factory=pass_provider_factory(),
30 )
31 for command, _cwd in runner.calls:
32 for verb in WRITE_VERBS:
33 assert verb not in command.lower()
34
35
36 def test_muse_only_review_never_invokes_git(tmp_path: Path) -> None:
37 from tests.support import write_config
38
39 write_config(tmp_path, "config-muse-only.yaml")
40 artifact = tmp_path / "docs" / "FREEZE.md"
41 artifact.parent.mkdir(parents=True)
42 artifact.write_text((FIXTURES / "freeze-artifact.md").read_text(encoding="utf-8"), encoding="utf-8")
43 runner = muse_status_runner(tmp_path)
44 run_cli(
45 ["review", "--freeze", artifact.relative_to(tmp_path).as_posix()],
46 cwd=tmp_path,
47 runner=runner,
48 kit=kit_root(),
49 review_provider_factory=pass_provider_factory(),
50 )
51 assert all("git " not in call[0] for call in runner.calls)
52
53
54 def test_traversal_refused(tmp_path: Path) -> None:
55 seed_freeze_repo(tmp_path)
56 code = run_cli(
57 ["review", "--freeze", "../../etc/passwd"],
58 cwd=tmp_path,
59 runner=git_status_runner(),
60 kit=kit_root(),
61 )
62 assert code == 4
File History 2 commits
sha256:a78e7e5a8740e03315f325d19edeb3aa1b306b3337d04abbaa9a9e0f3bbeb7a1 docs: MuseHub-first before ISR #74 — staging solidify NEXT Human 3 days ago
sha256:4671b7f787ddbe63ced31c895b688c77ab495653b65a730b423329f26b3c1439 feat: K1-P1 complete — agent provenance, build-verification… Sonnet 4.6 patch 54 days ago