Merge remote-tracking branch 'gitea/main' into codex/github-redacted-evidence-validator-20260627

2026-06-27 23:01:11 +08:00
parent 82e9d780bb 48b192fab7
commit d4fcce4170
11 changed files with 583 additions and 18 deletions
--- a/apps/api/tests/test_iwooos_wazuh_manager_registry_reviewer_validation.py
+++ b/apps/api/tests/test_iwooos_wazuh_manager_registry_reviewer_validation.py
@@ -6,6 +6,7 @@ from fastapi.testclient import TestClient
 from src.api.v1.iwooos import router
 from src.services.iwooos_wazuh_manager_registry_reviewer_validation import (
    load_latest_iwooos_wazuh_manager_registry_reviewer_validation,
+    validate_iwooos_wazuh_manager_registry_acceptance_evidence,
    validate_iwooos_wazuh_manager_registry_owner_export,
 )

@@ -78,18 +79,42 @@ def _valid_owner_export() -> dict:
    }


+def _valid_acceptance_evidence() -> dict:
+    return {
+        "acceptance_reviewer_role": "IwoooS reviewer",
+        "acceptance_decision": "accept_manager_registry_evidence_for_review",
+        "acceptance_decision_reason": "脫敏 manager registry evidence 與六個公開別名 scope parity 一致，可進 commit review。",
+        "accepted_scope_aliases": EXPECTED_ALIASES,
+        "accepted_agent_total": 6,
+        "accepted_agent_active": 2,
+        "accepted_agent_disconnected": 3,
+        "accepted_agent_never_connected": 1,
+        "manager_registry_acceptance_evidence_refs": [
+            "evidence-ref-registry-summary",
+            "evidence-ref-scope-parity",
+            "evidence-ref-post-enable-readback",
+        ],
+        "post_enable_readback_ref": "evidence-ref-post-enable-readback",
+        "product_scope_parity_ref": "evidence-ref-scope-parity",
+        "reviewed_at": "2026-06-27T22:10:00+08:00",
+        "followup_owner": "IwoooS reviewer",
+        "rollback_owner": "IwoooS runtime owner",
+        "post_acceptance_verifier_plan": "commit_readback_without_runtime_action",
+    }
+
+
 def test_iwooos_wazuh_manager_registry_reviewer_validation_contract_has_passed_redacted_export() -> None:
    payload = load_latest_iwooos_wazuh_manager_registry_reviewer_validation()

    assert payload["schema_version"] == "iwooos_wazuh_manager_registry_reviewer_validation_readback_v1"
    assert payload["source_schema_version"] == "wazuh_manager_registry_reviewer_validation_v1"
-    assert payload["status"] == "post_enable_iwooos_readback_passed_no_runtime_no_secret_collection"
-    assert payload["mode"] == "committed_post_enable_iwooos_readback_passed_no_runtime_no_secret_collection"
+    assert payload["status"] == "manager_registry_acceptance_evidence_intake_ready_no_runtime_no_secret_collection"
+    assert payload["mode"] == "committed_manager_registry_acceptance_evidence_intake_ready_no_runtime_no_secret_collection"
    assert payload["summary"]["expected_scope_alias_count"] == 6
    assert payload["summary"]["required_owner_field_count"] == 28
    assert payload["summary"]["per_host_required_field_count"] == 9
-    assert payload["summary"]["reviewer_validation_check_count"] == 10
-    assert payload["summary"]["outcome_lane_count"] == 14
+    assert payload["summary"]["reviewer_validation_check_count"] == 11
+    assert payload["summary"]["outcome_lane_count"] == 17
    assert payload["summary"]["evidence_slot_count"] == 6
    assert payload["summary"]["forbidden_payload_count"] == 27
    assert payload["summary"]["owner_registry_export_received_count"] == 1
@@ -99,6 +124,9 @@ def test_iwooos_wazuh_manager_registry_reviewer_validation_contract_has_passed_r
    assert payload["summary"]["post_enable_readback_passed_count"] == 1
    assert payload["summary"]["reviewer_validation_quarantined_count"] == 0
    assert payload["summary"]["manager_registry_accepted_count"] == 0
+    assert payload["summary"]["manager_registry_acceptance_intake_endpoint_available_count"] == 1
+    assert payload["summary"]["manager_registry_acceptance_evidence_received_count"] == 0
+    assert payload["summary"]["manager_registry_acceptance_evidence_review_ready_count"] == 0
    assert payload["summary"]["runtime_gate_count"] == 0


@@ -132,8 +160,11 @@ def test_iwooos_wazuh_manager_registry_reviewer_validation_api_is_public_safe()
    assert data["summary"]["reviewer_validation_passed_count"] == 1
    assert data["summary"]["post_enable_readback_passed_count"] == 1
    assert data["summary"]["manager_registry_accepted_count"] == 0
+    assert data["summary"]["manager_registry_acceptance_intake_endpoint_available_count"] == 1
+    assert data["summary"]["manager_registry_acceptance_evidence_received_count"] == 0
+    assert data["summary"]["manager_registry_acceptance_evidence_review_ready_count"] == 0
    assert data["summary"]["runtime_gate_count"] == 0
-    assert len(data["reviewer_validation_checks"]) == 10
+    assert len(data["reviewer_validation_checks"]) == 11
    assert len(data["evidence_slots"]) == 6
    assert any(
        marker == "wazuh_manager_registry_reviewer_validation_owner_registry_export_received_count=1"
@@ -155,6 +186,18 @@ def test_iwooos_wazuh_manager_registry_reviewer_validation_api_is_public_safe()
        marker == "wazuh_manager_registry_reviewer_validation_manager_registry_accepted_count=0"
        for marker in data["boundary_markers"]
    )
+    assert any(
+        marker == "wazuh_manager_registry_acceptance_validation_api_available=true"
+        for marker in data["boundary_markers"]
+    )
+    assert any(
+        marker == "wazuh_manager_registry_acceptance_evidence_received_count=0"
+        for marker in data["boundary_markers"]
+    )
+    assert any(
+        marker == "wazuh_manager_registry_acceptance_evidence_review_ready_count=0"
+        for marker in data["boundary_markers"]
+    )
    assert any(
        marker == "wazuh_manager_registry_reviewer_validation_runtime_gate_count=0"
        for marker in data["boundary_markers"]
@@ -251,3 +294,82 @@ def test_iwooos_wazuh_manager_registry_owner_export_validation_rejects_runtime_a
    assert payload["summary"]["owner_registry_export_accepted_count"] == 0
    assert payload["summary"]["runtime_gate_count"] == 0
    assert any(finding["check_id"] == "RV-09" for finding in payload["validation_findings"])
+
+
+def test_iwooos_wazuh_manager_registry_acceptance_evidence_validation_accepts_redacted_packet_for_review_only() -> None:
+    payload = validate_iwooos_wazuh_manager_registry_acceptance_evidence(_valid_acceptance_evidence())
+
+    assert payload["schema_version"] == "iwooos_wazuh_manager_registry_acceptance_evidence_validation_result_v1"
+    assert payload["status"] == "accepted_for_manager_registry_acceptance_review_only"
+    assert payload["mode"] == "no_persist_acceptance_evidence_review_no_runtime_no_secret_collection"
+    assert payload["accepted_for_manager_registry_acceptance_review_only"] is True
+    assert payload["summary"]["manager_registry_acceptance_evidence_received_count"] == 1
+    assert payload["summary"]["manager_registry_acceptance_evidence_review_ready_count"] == 1
+    assert payload["summary"]["manager_registry_accepted_count"] == 0
+    assert payload["summary"]["runtime_gate_count"] == 0
+    assert payload["boundaries"]["payload_persisted"] is False
+    assert payload["boundaries"]["manager_registry_accepted_updated"] is False
+    assert payload["boundaries"]["runtime_execution_authorized"] is False
+    assert payload["next_gate"] == "commit_manager_registry_accepted_readback_evidence"
+
+
+def test_iwooos_wazuh_manager_registry_acceptance_evidence_api_does_not_persist_or_open_runtime() -> None:
+    client = _client()
+    response = client.post(
+        "/api/v1/iwooos/wazuh-manager-registry-reviewer-validation/validate-manager-registry-acceptance",
+        json=_valid_acceptance_evidence(),
+    )
+
+    assert response.status_code == 200
+    result = response.json()
+    assert result["status"] == "accepted_for_manager_registry_acceptance_review_only"
+    assert result["summary"]["manager_registry_acceptance_evidence_review_ready_count"] == 1
+    assert result["summary"]["manager_registry_accepted_count"] == 0
+    assert result["summary"]["runtime_gate_count"] == 0
+
+    readback = client.get("/api/v1/iwooos/wazuh-manager-registry-reviewer-validation").json()
+    assert readback["summary"]["manager_registry_acceptance_evidence_received_count"] == 0
+    assert readback["summary"]["manager_registry_acceptance_evidence_review_ready_count"] == 0
+    assert readback["summary"]["manager_registry_accepted_count"] == 0
+    assert readback["summary"]["runtime_gate_count"] == 0
+
+
+def test_iwooos_wazuh_manager_registry_acceptance_evidence_validation_requests_missing_fields() -> None:
+    candidate = _valid_acceptance_evidence()
+    candidate.pop("product_scope_parity_ref")
+
+    payload = validate_iwooos_wazuh_manager_registry_acceptance_evidence(candidate)
+
+    assert payload["status"] == "request_manager_registry_acceptance_evidence_supplement"
+    assert payload["accepted_for_manager_registry_acceptance_review_only"] is False
+    assert payload["summary"]["manager_registry_acceptance_evidence_supplement_required_count"] == 1
+    assert payload["summary"]["manager_registry_accepted_count"] == 0
+    assert any("product_scope_parity_ref" in finding["field_paths"] for finding in payload["validation_findings"])
+
+
+def test_iwooos_wazuh_manager_registry_acceptance_evidence_validation_quarantines_sensitive_payload() -> None:
+    candidate = _valid_acceptance_evidence()
+    candidate["post_enable_readback_ref"] = "post enable accidentally included 10.250.250.250"
+
+    payload = validate_iwooos_wazuh_manager_registry_acceptance_evidence(candidate)
+
+    assert payload["status"] == "quarantine_sensitive_payload"
+    assert payload["quarantined"] is True
+    assert payload["summary"]["manager_registry_acceptance_evidence_quarantined_count"] == 1
+    assert payload["summary"]["manager_registry_accepted_count"] == 0
+    assert "10.250.250.250" not in str(payload)
+    assert any(finding["check_id"] == "MRA-04" for finding in payload["validation_findings"])
+
+
+def test_iwooos_wazuh_manager_registry_acceptance_evidence_validation_rejects_runtime_action_request() -> None:
+    candidate = _valid_acceptance_evidence()
+    candidate["requested_actions"] = ["wazuh_active_response"]
+
+    payload = validate_iwooos_wazuh_manager_registry_acceptance_evidence(candidate)
+
+    assert payload["status"] == "reject_runtime_action_request"
+    assert payload["runtime_action_rejected"] is True
+    assert payload["summary"]["manager_registry_acceptance_runtime_action_rejected_count"] == 1
+    assert payload["summary"]["manager_registry_accepted_count"] == 0
+    assert payload["summary"]["runtime_gate_count"] == 0
+    assert any(finding["check_id"] == "MRA-05" for finding in payload["validation_findings"])