wehub-resource-sync
89 lines
2.8 KiB
Python
89 lines
2.8 KiB
Python
from __future__ import annotations
|
|
|
|
import json
|
|
import tomllib
|
|
from pathlib import Path
|
|
|
|
from typer.testing import CliRunner
|
|
|
|
from opensquilla.cli.main import app
|
|
from opensquilla.onboarding.config_store import load_config
|
|
|
|
runner = CliRunner()
|
|
|
|
|
|
def _invoke(config_path: Path, *args: str):
|
|
return runner.invoke(app, ["sandbox", *args, "--config", str(config_path)])
|
|
|
|
|
|
def test_sandbox_trust_keeps_runtime_sandbox_enabled(tmp_path: Path) -> None:
|
|
config_path = tmp_path / "config.toml"
|
|
|
|
result = _invoke(config_path, "trust")
|
|
|
|
assert result.exit_code == 0, result.output
|
|
cfg = load_config(config_path)
|
|
assert cfg.sandbox.run_mode == "trusted"
|
|
assert cfg.sandbox.sandbox is True
|
|
assert cfg.sandbox.security_grading is True
|
|
assert cfg.permissions.default_mode == "off"
|
|
|
|
|
|
def test_sandbox_bypass_fails_without_changing_config(tmp_path: Path) -> None:
|
|
config_path = tmp_path / "config.toml"
|
|
before = _invoke(config_path, "on")
|
|
assert before.exit_code == 0, before.output
|
|
|
|
result = _invoke(config_path, "bypass")
|
|
|
|
assert result.exit_code != 0
|
|
assert "removed" in result.output.lower()
|
|
assert "sandbox trust" in result.output
|
|
cfg = load_config(config_path)
|
|
assert cfg.sandbox.run_mode == "trusted"
|
|
assert cfg.sandbox.sandbox is True
|
|
|
|
|
|
def test_sandbox_on_restores_trusted_sandbox_default(tmp_path: Path) -> None:
|
|
config_path = tmp_path / "config.toml"
|
|
assert _invoke(config_path, "full").exit_code == 0
|
|
|
|
result = _invoke(config_path, "on")
|
|
|
|
assert result.exit_code == 0, result.output
|
|
cfg = load_config(config_path)
|
|
assert cfg.sandbox.run_mode == "trusted"
|
|
assert cfg.sandbox.sandbox is True
|
|
assert cfg.sandbox.security_grading is True
|
|
assert cfg.permissions.default_mode == "off"
|
|
|
|
|
|
def test_sandbox_reset_restores_full_host_access_default(tmp_path: Path) -> None:
|
|
config_path = tmp_path / "config.toml"
|
|
assert _invoke(config_path, "full").exit_code == 0
|
|
|
|
reset = _invoke(config_path, "reset")
|
|
|
|
assert reset.exit_code == 0, reset.output
|
|
cfg = load_config(config_path)
|
|
assert cfg.sandbox.run_mode == "full"
|
|
assert cfg.sandbox.sandbox is False
|
|
assert cfg.sandbox.security_grading is False
|
|
assert cfg.permissions.default_mode == "full"
|
|
|
|
|
|
def test_sandbox_status_reports_run_mode(tmp_path: Path) -> None:
|
|
config_path = tmp_path / "config.toml"
|
|
assert _invoke(config_path, "trust").exit_code == 0
|
|
|
|
result = runner.invoke(app, ["sandbox", "status", "--config", str(config_path), "--json"])
|
|
|
|
assert result.exit_code == 0, result.output
|
|
payload = json.loads(result.output)
|
|
assert payload["run_mode"] == "trusted"
|
|
assert payload["run_mode_label"] == "Managed Execution"
|
|
assert payload["execution_target"] == "sandbox"
|
|
|
|
data = tomllib.loads(config_path.read_text(encoding="utf-8"))
|
|
assert data["sandbox"]["run_mode"] == "trusted"
|