wehub-resource-sync
69 lines
2.0 KiB
Python
69 lines
2.0 KiB
Python
from pathlib import Path
|
|
|
|
from nanobot.security.workspace_access import workspace_sandbox_status
|
|
|
|
|
|
def test_workspace_sandbox_disabled(tmp_path: Path) -> None:
|
|
status = workspace_sandbox_status(
|
|
restrict_to_workspace=False,
|
|
workspace=tmp_path,
|
|
environ={},
|
|
)
|
|
|
|
assert status.level == "off"
|
|
assert status.enforced is False
|
|
assert status.provider == "none"
|
|
assert status.as_dict()["workspace_root"] == str(tmp_path.resolve())
|
|
|
|
|
|
def test_workspace_sandbox_application_guard(tmp_path: Path) -> None:
|
|
status = workspace_sandbox_status(
|
|
restrict_to_workspace=True,
|
|
workspace=tmp_path,
|
|
environ={},
|
|
)
|
|
|
|
assert status.level == "application"
|
|
assert status.enforced is False
|
|
assert status.provider == "none"
|
|
assert "application-level" in status.summary
|
|
|
|
|
|
def test_workspace_sandbox_system_provider_from_compact_env(tmp_path: Path) -> None:
|
|
status = workspace_sandbox_status(
|
|
restrict_to_workspace=True,
|
|
workspace=tmp_path,
|
|
environ={"NANOBOT_SANDBOX_ENFORCED": "macos_app_sandbox"},
|
|
)
|
|
|
|
assert status.level == "system"
|
|
assert status.enforced is True
|
|
assert status.provider == "macos_app_sandbox"
|
|
assert status.provider_label == "macOS App Sandbox"
|
|
|
|
|
|
def test_workspace_sandbox_system_provider_from_boolean_env(tmp_path: Path) -> None:
|
|
status = workspace_sandbox_status(
|
|
restrict_to_workspace=True,
|
|
workspace=tmp_path,
|
|
environ={
|
|
"NANOBOT_WORKSPACE_SANDBOX_ENFORCED": "true",
|
|
"NANOBOT_WORKSPACE_SANDBOX_PROVIDER": "macOS App Sandbox",
|
|
},
|
|
)
|
|
|
|
assert status.level == "system"
|
|
assert status.enforced is True
|
|
assert status.provider == "macos_app_sandbox"
|
|
|
|
|
|
def test_workspace_sandbox_false_env_does_not_enforce(tmp_path: Path) -> None:
|
|
status = workspace_sandbox_status(
|
|
restrict_to_workspace=True,
|
|
workspace=tmp_path,
|
|
environ={"NANOBOT_WORKSPACE_SANDBOX_ENFORCED": "false"},
|
|
)
|
|
|
|
assert status.level == "application"
|
|
assert status.enforced is False
|