wehub-resource-sync
133 lines
4.8 KiB
Python
133 lines
4.8 KiB
Python
from __future__ import annotations
|
|
|
|
import json
|
|
import tomllib
|
|
from pathlib import Path
|
|
|
|
from typer.testing import CliRunner
|
|
|
|
from opensquilla.cli.main import app
|
|
from opensquilla.onboarding.config_store import load_config, persist_config
|
|
|
|
runner = CliRunner()
|
|
|
|
|
|
def _invoke(config_path: Path, *args: str):
|
|
return runner.invoke(app, ["sandbox", *args, "--config", str(config_path)])
|
|
|
|
|
|
def test_sandbox_status_reports_default_full_host_access(tmp_path: Path) -> None:
|
|
config_path = tmp_path / "config.toml"
|
|
|
|
result = runner.invoke(
|
|
app,
|
|
["sandbox", "status", "--config", str(config_path), "--json"],
|
|
)
|
|
|
|
assert result.exit_code == 0, result.output
|
|
payload = json.loads(result.output)
|
|
assert payload["run_mode"] == "full"
|
|
assert payload["run_mode_label"] == "Full Host Access"
|
|
assert payload["execution_target"] == "host"
|
|
assert payload["posture"] == "full"
|
|
assert payload["sandbox"]["sandbox"] is False
|
|
assert payload["sandbox"]["security_grading"] is False
|
|
assert payload["permissions"]["default_mode"] == "full"
|
|
assert payload["restart_required"] is False
|
|
|
|
|
|
def test_sandbox_trust_persists_trusted_run_mode(tmp_path: Path) -> None:
|
|
config_path = tmp_path / "config.toml"
|
|
|
|
result = _invoke(config_path, "trust")
|
|
|
|
assert result.exit_code == 0, result.output
|
|
cfg = load_config(config_path)
|
|
assert cfg.sandbox.run_mode == "trusted"
|
|
assert cfg.sandbox.sandbox is True
|
|
assert cfg.sandbox.security_grading is True
|
|
assert cfg.sandbox.network_default == "proxy_allowlist"
|
|
assert cfg.permissions.default_mode == "off"
|
|
data = tomllib.loads(config_path.read_text(encoding="utf-8"))
|
|
assert data["sandbox"]["run_mode"] == "trusted"
|
|
# Sparse persistence omits values equal to the built-in defaults
|
|
# (sandbox on, grading on, proxy allowlist, permissions off); the
|
|
# effective posture is asserted via load_config above. Any value that
|
|
# is written must match the trusted posture.
|
|
assert data["sandbox"].get("sandbox", True) is True
|
|
assert data["sandbox"].get("security_grading", True) is True
|
|
assert data["sandbox"].get("network_default", "proxy_allowlist") == "proxy_allowlist"
|
|
assert data.get("permissions", {}).get("default_mode", "off") == "off"
|
|
assert "restart" in result.output.lower()
|
|
|
|
|
|
def test_sandbox_trust_repairs_legacy_disabled_network_default(tmp_path: Path) -> None:
|
|
config_path = tmp_path / "config.toml"
|
|
full = _invoke(config_path, "full")
|
|
assert full.exit_code == 0, full.output
|
|
cfg = load_config(config_path)
|
|
cfg.sandbox.network_default = "none"
|
|
persist_config(cfg, path=config_path)
|
|
|
|
result = _invoke(config_path, "trust")
|
|
|
|
assert result.exit_code == 0, result.output
|
|
cfg = load_config(config_path)
|
|
assert cfg.sandbox.run_mode == "trusted"
|
|
assert cfg.sandbox.network_default == "proxy_allowlist"
|
|
|
|
|
|
def test_sandbox_bypass_fails_without_mutating_config(tmp_path: Path) -> None:
|
|
config_path = tmp_path / "config.toml"
|
|
before = _invoke(config_path, "on")
|
|
assert before.exit_code == 0, before.output
|
|
|
|
result = _invoke(config_path, "bypass")
|
|
|
|
assert result.exit_code != 0
|
|
assert "removed" in result.output.lower()
|
|
assert "sandbox trust" in result.output
|
|
cfg = load_config(config_path)
|
|
assert cfg.sandbox.run_mode == "trusted"
|
|
assert cfg.sandbox.sandbox is True
|
|
assert cfg.sandbox.security_grading is True
|
|
assert cfg.permissions.default_mode == "off"
|
|
|
|
|
|
def test_sandbox_full_and_on_are_reversible(tmp_path: Path) -> None:
|
|
config_path = tmp_path / "config.toml"
|
|
|
|
full = _invoke(config_path, "full")
|
|
assert full.exit_code == 0, full.output
|
|
cfg = load_config(config_path)
|
|
assert cfg.sandbox.run_mode == "full"
|
|
assert cfg.sandbox.sandbox is False
|
|
assert cfg.sandbox.security_grading is False
|
|
assert cfg.sandbox.network_default == "none"
|
|
assert cfg.permissions.default_mode == "full"
|
|
|
|
on = _invoke(config_path, "on")
|
|
assert on.exit_code == 0, on.output
|
|
cfg = load_config(config_path)
|
|
assert cfg.sandbox.run_mode == "trusted"
|
|
assert cfg.sandbox.sandbox is True
|
|
assert cfg.sandbox.security_grading is True
|
|
assert cfg.sandbox.network_default == "proxy_allowlist"
|
|
assert cfg.permissions.default_mode == "off"
|
|
|
|
|
|
def test_sandbox_reset_restores_full_host_access(tmp_path: Path) -> None:
|
|
config_path = tmp_path / "config.toml"
|
|
|
|
full = _invoke(config_path, "full")
|
|
reset = _invoke(config_path, "reset")
|
|
|
|
assert full.exit_code == 0, full.output
|
|
assert reset.exit_code == 0, reset.output
|
|
cfg = load_config(config_path)
|
|
assert cfg.sandbox.run_mode == "full"
|
|
assert cfg.sandbox.sandbox is False
|
|
assert cfg.sandbox.security_grading is False
|
|
assert cfg.sandbox.network_default == "none"
|
|
assert cfg.permissions.default_mode == "full"
|