learningcircuit--local-deep-research/tests/security/test_ldr_db_hook.py

"""
Tests for the check-ldr-db pre-commit hook.

Ensures the hook detects any reference to the deprecated shared database,
forcing all data storage through per-user encrypted databases.
"""

import sys
from importlib import import_module
from pathlib import Path


HOOKS_DIR = Path(__file__).parent.parent.parent / ".pre-commit-hooks"
sys.path.insert(0, str(HOOKS_DIR))

hook_module = import_module("check-ldr-db")
check_file_fn = hook_module.check_file_for_ldr_db

# Build the deprecated DB name dynamically so this test file itself
# is not flagged by the check-ldr-db pre-commit hook.
_DEPRECATED_DB = "ldr" + ".db"


def _write_and_check(tmp_path, code: str, filename: str = "module.py"):
    p = tmp_path / filename
    p.write_text(code, encoding="utf-8")
    return check_file_fn(str(p))


class TestDetectsLdrDbUsage:
    """Ensures references to the deprecated shared DB are caught."""

    def test_detects_sqlite_connect(self, tmp_path):
        code = f'conn = sqlite3.connect("{_DEPRECATED_DB}")\n'
        matches = _write_and_check(tmp_path, code)
        assert len(matches) >= 1

    def test_detects_in_path(self, tmp_path):
        code = f'db_path = "/data/{_DEPRECATED_DB}"\n'
        matches = _write_and_check(tmp_path, code)
        assert len(matches) >= 1

    def test_detects_case_insensitive(self, tmp_path):
        code = f'path = "{_DEPRECATED_DB.upper()}"\n'
        matches = _write_and_check(tmp_path, code)
        assert len(matches) >= 1

    def test_detects_in_f_string(self, tmp_path):
        code = f'path = f"{{base}}/{_DEPRECATED_DB}"\n'
        matches = _write_and_check(tmp_path, code)
        assert len(matches) >= 1


class TestAllowsSafePatterns:
    """Ensures comments and safe code are not flagged."""

    def test_allows_comment(self, tmp_path):
        code = f"# The old {_DEPRECATED_DB} is deprecated\n"
        matches = _write_and_check(tmp_path, code)
        assert len(matches) == 0

    def test_allows_docstring_style(self, tmp_path):
        code = f'"""See {_DEPRECATED_DB} migration guide"""\n'
        matches = _write_and_check(tmp_path, code)
        assert len(matches) == 0

    def test_allows_normal_code(self, tmp_path):
        code = """
from database.session_context import get_user_db_session
with get_user_db_session(username) as session:
    pass
"""
        matches = _write_and_check(tmp_path, code)
        assert len(matches) == 0