feat(iwooos): expose Wazuh owner evidence preflight

apps/api/tests/test_iwooos_runtime_security_readback.py

@@ -20,8 +20,8 @@ def test_iwooos_runtime_security_readback_preserves_zero_runtime_gates() -> None
 
     assert payload["schema_version"] == "iwooos_runtime_security_readback_v1"
     assert payload["status"] == "blocked_waiting_owner_evidence_and_runtime_gates"
-    assert payload["summary"]["source_snapshot_count"] == 9
-    assert payload["summary"]["p0_lane_count"] == 8
+    assert payload["summary"]["source_snapshot_count"] == 10
+    assert payload["summary"]["p0_lane_count"] == 9
     assert payload["summary"]["runtime_gate_count"] == 0
     assert payload["summary"]["owner_response_received_count"] == 0
     assert payload["summary"]["owner_response_accepted_count"] == 0
@@ -36,6 +36,16 @@ def test_iwooos_runtime_security_readback_preserves_zero_runtime_gates() -> None
     assert payload["summary"]["wazuh_live_metadata_gate_readonly_scope_accepted_count"] == 0
     assert payload["summary"]["wazuh_live_metadata_gate_post_enable_readback_count"] == 0
     assert payload["summary"]["wazuh_live_metadata_gate_live_query_authorized_count"] == 0
+    assert payload["summary"]["wazuh_owner_evidence_required_field_count"] == 28
+    assert payload["summary"]["wazuh_owner_evidence_reviewer_check_count"] == 15
+    assert payload["summary"]["wazuh_owner_evidence_outcome_lane_count"] == 8
+    assert payload["summary"]["wazuh_owner_evidence_forbidden_payload_count"] == 22
+    assert payload["summary"]["wazuh_owner_evidence_expected_alias_count"] == 6
+    assert payload["summary"]["wazuh_owner_evidence_registry_export_received_count"] == 0
+    assert payload["summary"]["wazuh_owner_evidence_registry_export_accepted_count"] == 0
+    assert payload["summary"]["wazuh_owner_evidence_received_count"] == 0
+    assert payload["summary"]["wazuh_owner_evidence_accepted_count"] == 0
+    assert payload["summary"]["wazuh_owner_evidence_runtime_gate_count"] == 0
     assert payload["summary"]["kali_active_scan_authorized_count"] == 0
     assert payload["summary"]["kali_execute_authorized_count"] == 0
     assert payload["summary"]["alert_receipt_runtime_send_count"] == 0
@@ -53,6 +63,7 @@ def test_iwooos_runtime_security_readback_lanes_are_candidate_only() -> None:
         "wazuh_registry",
         "wazuh_live_route",
         "wazuh_live_metadata_gate",
+        "wazuh_owner_evidence_preflight",
         "wazuh_dashboard_api",
         "kali_intake",
         "alert_readability",
@@ -66,6 +77,7 @@ def test_iwooos_runtime_security_readback_lanes_are_candidate_only() -> None:
     assert all(lane["lane_id"] != "wazuh_registry" or lane["completion_percent"] == 0 for lane in payload["lanes"])
     assert all(lane["lane_id"] != "wazuh_live_route" or lane["metrics"]["route_degraded"] == 1 for lane in payload["lanes"])
     assert all(lane["lane_id"] != "wazuh_live_metadata_gate" or lane["completion_percent"] == 0 for lane in payload["lanes"])
+    assert all(lane["lane_id"] != "wazuh_owner_evidence_preflight" or lane["metrics"]["owner_accepted"] == 0 for lane in payload["lanes"])
 
 
 def test_iwooos_runtime_security_readback_api_is_public_safe(monkeypatch) -> None:
@@ -85,6 +97,8 @@ def test_iwooos_runtime_security_readback_api_is_public_safe(monkeypatch) -> Non
     assert data["summary"]["wazuh_live_route_degraded_count"] == 1
     assert data["summary"]["wazuh_live_metadata_available_count"] == 0
     assert data["summary"]["wazuh_live_metadata_gate_live_query_authorized_count"] == 0
+    assert data["summary"]["wazuh_owner_evidence_accepted_count"] == 0
+    assert data["summary"]["wazuh_owner_evidence_runtime_gate_count"] == 0
     assert data["boundaries"]["secret_value_collection_allowed"] is False
     assert "192.168.0." not in response.text
     assert "工作視窗" not in response.text
@@ -169,3 +183,44 @@ def test_iwooos_wazuh_live_metadata_gate_api_is_public_safe(monkeypatch) -> None
     assert "工作視窗" not in response.text
     assert "批准！繼續" not in response.text
     assert "WAZUH_API_PASSWORD" not in response.text
+
+
+def test_iwooos_wazuh_owner_evidence_preflight_api_is_public_safe(monkeypatch) -> None:
+    monkeypatch.delenv("IWOOOS_WAZUH_READONLY_ENABLED", raising=False)
+    monkeypatch.delenv("WAZUH_API_BASE_URL", raising=False)
+    monkeypatch.delenv("WAZUH_API_USERNAME", raising=False)
+    monkeypatch.delenv("WAZUH_API_PASSWORD", raising=False)
+
+    response = _client().get("/api/v1/iwooos/wazuh-owner-evidence-preflight")
+
+    assert response.status_code == 200
+    data = response.json()
+    assert data["schema_version"] == "iwooos_wazuh_owner_evidence_preflight_readback_v1"
+    assert data["status"] == "owner_evidence_preflight_ready_no_runtime_action"
+    assert data["summary"]["required_field_count"] == 28
+    assert data["summary"]["reviewer_check_count"] == 15
+    assert data["summary"]["outcome_lane_count"] == 8
+    assert data["summary"]["forbidden_payload_count"] == 22
+    assert data["summary"]["expected_scope_alias_count"] == 6
+    assert data["summary"]["per_host_required_field_count"] == 9
+    assert data["summary"]["registry_export_received_count"] == 0
+    assert data["summary"]["registry_export_accepted_count"] == 0
+    assert data["summary"]["owner_evidence_received_count"] == 0
+    assert data["summary"]["owner_evidence_accepted_count"] == 0
+    assert data["summary"]["runtime_gate_count"] == 0
+    assert data["summary"]["wazuh_api_live_query_authorized_count"] == 0
+    assert data["summary"]["active_response_authorized_count"] == 0
+    assert data["summary"]["host_write_authorized_count"] == 0
+    assert data["summary"]["secret_value_collection_allowed_count"] == 0
+    assert data["boundaries"]["wazuh_api_live_query_authorized"] is False
+    assert data["boundaries"]["wazuh_active_response_authorized"] is False
+    assert data["boundaries"]["host_write_authorized"] is False
+    assert data["boundaries"]["runtime_execution_authorized"] is False
+    assert data["boundaries"]["not_authorization"] is True
+    assert len(data["items"]) == 8
+    assert any(marker == "必要欄位=28" for marker in data["boundary_markers"])
+    assert any(rule.startswith("負責人證據預檢 ready") for rule in data["no_false_green_rules"])
+    assert "192.168.0." not in response.text
+    assert "工作視窗" not in response.text
+    assert "批准！繼續" not in response.text
+    assert "WAZUH_API_PASSWORD" not in response.text