from __future__ import annotations # ruff: noqa: E402, I001 import asyncio import copy import json import os from datetime import UTC, datetime, timedelta from types import SimpleNamespace os.environ.setdefault("DATABASE_URL", "postgresql+asyncpg://test:test@localhost/test") from fastapi import FastAPI from fastapi.testclient import TestClient from src.api.v1.iwooos import router from src.services.iwooos_security_asset_control_plane import ( IwoooSSecurityAssetControlPlaneService, _read_public_source, build_iwooos_security_asset_control_plane, build_unavailable_iwooos_security_asset_control_plane, ) from src.services.ai_automation_runtime_contract import ( AI_AUTOMATION_REQUIRED_LOOP_STAGES, AI_AUTOMATION_RUNTIME_CONTRACT_SCHEMA_VERSION, ) def _row(**values): return SimpleNamespace(**values) def _closed_strict_runtime() -> dict: return { "schema_version": "ai_agent_strict_runtime_completion_v2", "runtime_contract_schema_version": ( AI_AUTOMATION_RUNTIME_CONTRACT_SCHEMA_VERSION ), "completion_percent": 100, "required_stage_count": len(AI_AUTOMATION_REQUIRED_LOOP_STAGES), "present_stage_count": len(AI_AUTOMATION_REQUIRED_LOOP_STAGES), "missing_stage_ids": [], "latest_flow_closed": True, "latest_loop_closed": True, "execution_loop_closed": True, "same_run_correlation": True, "full_trace_same_run_correlation_proven": True, "automation_run_id": "internal-run-identity", "run_id_mismatch_stage_ids": [], "uncorrelated_stage_ids": [], "stage_contracts": [ { "stage_id": stage_id, "evidence_present": True, "same_run_correlation_proven": True, "completion_eligible": True, "evidence_source": "same_run_runtime_stage_receipt", } for stage_id in AI_AUTOMATION_REQUIRED_LOOP_STAGES ], "closed": True, "same_run_correlation_required": True, "metadata_only_counts_as_completion": False, "historical_aggregate_fallback_allowed": False, } def _closed_wazuh_runtime_lanes() -> dict: return { "posture": { "summary": { "service_log_evidence_receipt_count": 1, "independent_post_verifier_passed_count": 1, "telegram_provider_send_count": 1, "telegram_notification_suppressed_count": 0, "same_run_present_stage_count": 18, "same_run_required_stage_count": 18, "runtime_closed_count": 1, }, "trace": { "source_recurrence_verified": True, "identity_chain_verified": True, }, "asset_identity": { "canonical_asset_ref": "service:wazuh-manager", "linked_identity_kinds": [ "manager", "agent", "host", "service", "event", ], "linked_identity_kind_count": 5, "required_identity_kind_count": 5, "all_required_identity_kinds_linked": True, "raw_identity_returned": False, }, "incident": { "incident_ref": "IWZ-POSTURE-2026072205", "status": "resolved", "ledger_closure_verified": True, "raw_event_payload_returned": False, }, "verifier": { "status": "passed", "receipt_ref": "verifier-wazuh-2205", }, "recipient_receipt": { "status": "recipient_visible", "receipt_ref": "telegram-wazuh-2205", "provider_message_ref": "2205", }, }, "ingress": { "boundaries": { "critical_break_glass_required": True, }, }, } def _ready_payload( source_health: list[dict] | None = None, *, discovery_status: str = "success", discovery_error: str | None = None, coverage_rows: list[SimpleNamespace] | None = None, compliance_rows: list[SimpleNamespace] | None = None, automation_rows: list[SimpleNamespace] | None = None, runtime_receipt_counts: dict[str, int] | None = None, strict_runtime: dict | None = None, wazuh_asset_row: SimpleNamespace | None = None, wazuh_runtime: dict | None = None, ) -> dict: now = datetime(2026, 7, 11, 4, 0, tzinfo=UTC) discovery = _row( latest_status=discovery_status, latest_scan_depth="full", latest_started_at=now - timedelta(minutes=31), latest_ended_at=now - timedelta(minutes=30), latest_success_ended_at=now - timedelta(minutes=30), latest_total_assets=24, latest_new_assets=2, latest_modified_assets=1, latest_disappeared_assets=0, latest_error=discovery_error, ) inventory = [ _row(asset_type="host", cnt=3, unowned_count=1, stale_count=0), _row(asset_type="k8s_workload", cnt=5, unowned_count=0, stale_count=1), _row(asset_type="website", cnt=2, unowned_count=0, stale_count=0), _row(asset_type="api_endpoint", cnt=4, unowned_count=0, stale_count=0), _row(asset_type="database", cnt=2, unowned_count=0, stale_count=0), _row(asset_type="log_stream", cnt=4, unowned_count=0, stale_count=0), _row(asset_type="monitoring_target", cnt=3, unowned_count=0, stale_count=0), _row(asset_type="ai_agent", cnt=1, unowned_count=0, stale_count=0), ] coverage = ( coverage_rows if coverage_rows is not None else [ _row(dimension=dimension, status="green", cnt=20) for dimension in ( "auto_monitoring", "auto_alerting", "auto_rule_creation", "auto_rule_matching", "auto_playbook", "auto_remediation", "auto_km_creation", ) ] ) compliance = ( compliance_rows if compliance_rows is not None else [ _row(dimension=dimension, status="compliant", cnt=20) for dimension in ( "ssl_cert_valid", "cve_scan", "secret_rotated", "backup_tested", "audit_log_enabled", "access_reviewed", "encryption_at_rest", ) ] ) automation = ( automation_rows if automation_rows is not None else [ _row(operation_type="asset_discovered", status="success", cnt=1), _row(operation_type="rule_matched", status="success", cnt=3), _row(operation_type="rule_created", status="success", cnt=2), _row( operation_type="ansible_check_mode_executed", status="dry_run", cnt=2, ), _row(operation_type="ansible_apply_executed", status="success", cnt=1), _row(operation_type="remediation_verified", status="success", cnt=1), _row(operation_type="km_created", status="success", cnt=1), _row(operation_type="ansible_apply_executed", status="failed", cnt=1), ] ) runtime_counts = runtime_receipt_counts or {} return build_iwooos_security_asset_control_plane( discovery_row=discovery, inventory_rows=inventory, coverage_rows=coverage, relationship_row=_row(relationship_count=21, orphan_asset_count=3), compliance_rows=compliance, automation_rows=automation, ai_trace_row=_row(trace_count=4, accepted_trace_count=3), siem_row=_row( rule_total=12, approved_rule_count=10, fired_rule_count=8, noisy_rule_count=1, ai_generated_rule_count=3, incident_total_24h=5, open_incident_count_24h=2, resolved_incident_count_24h=3, decision_chain_count_24h=5, normalized_event_count_24h=18, correlated_controlled_route_count_24h=runtime_counts.get("correlate", 0), independent_verifier_pass_count_24h=runtime_counts.get("verify", 0), learning_writeback_count_24h=runtime_counts.get("learn", 0), mttr_minutes_24h=14.25, ), strict_runtime_row=strict_runtime, wazuh_asset_row=wazuh_asset_row, wazuh_runtime_row=wazuh_runtime, audit_row=_row( k8s_audit_count_24h=2, k8s_audit_failure_count_24h=0, mcp_audit_count_24h=11, mcp_audit_failure_count_24h=1, asset_change_count_24h=4, asset_change_ai_analysis_count_24h=3, ), source_health=source_health, generated_at=now, ) def test_builds_live_asset_siem_audit_and_ai_control_plane_without_false_closure() -> ( None ): payload = _ready_payload() assert payload["schema_version"] == "iwooos_security_asset_control_plane_v1" assert payload["status"] == "ready" assert payload["source_status"] == "live_database_aggregate" assert payload["summary"]["managed_asset_count"] == 24 assert payload["summary"]["present_asset_type_count"] == 8 assert payload["summary"]["siem_stage_coverage_percent"] == 100 assert payload["summary"]["ai_loop_stage_coverage_percent"] == 100 assert payload["summary"]["verified_remediation_receipt_count_24h"] == 1 expected_completion = round( sum( payload["summary"][field] for field in ( "asset_type_coverage_percent", "nist_controlled_percent", "security_program_controlled_percent", "siem_stage_coverage_percent", "ai_loop_stage_coverage_percent", ) ) / 6 ) assert payload["summary"]["overall_security_completion_percent"] == ( expected_completion ) assert payload["completion"]["overall_percent"] == expected_completion assert payload["completion"]["strict_runtime_closure_percent"] == 0 assert payload["completion"]["dimension_count"] == 6 assert payload["discovery"]["fresh"] is True assert payload["discovery"]["failure_reason_code"] is None assert payload["discovery"]["failed_collector_count"] == 0 assert payload["discovery"]["failed_collector_ids"] == [] assert payload["discovery"]["raw_error_returned"] is False assert payload["ai_automation"]["same_run_closed_loop_proven"] is False assert payload["ai_automation"]["same_run_closed_loop_count"] == 0 assert len(payload["nist_csf_functions"]) == 6 assert payload["summary"]["security_program_domain_count"] == 16 assert len(payload["security_program_domains"]) == 16 domain_by_id = { domain["domain_id"]: domain for domain in payload["security_program_domains"] } assert domain_by_id["endpoint_xdr_wazuh"]["status"] == "not_evidenced" assert domain_by_id["siem_soc_threat_intel"]["controlled_percent"] == 50 work_item_by_control = {item["control_id"]: item for item in payload["work_items"]} assert work_item_by_control["endpoint_xdr_wazuh"]["priority"] == "P0" assert work_item_by_control["endpoint_xdr_wazuh"]["gap_count"] == 1 assert work_item_by_control["endpoint_xdr_wazuh"]["gap_percent"] == 100 assert payload["work_items"][0]["order"] <= payload["work_items"][1]["order"] assert len(payload["siem"]["pipeline"]) == 8 assert payload["security_audit"]["mcp_tool_audit_count_24h"] == 11 assert payload["summary"]["package_digest_unpinned_count"] == 0 assert payload["summary"]["forbidden_github_supply_chain_asset_count"] == 0 assert payload["supply_chain"]["package_inventory_evidenced"] is False assert payload["supply_chain"]["github_freeze_compliant"] is False assert payload["supply_chain"]["runtime_image_policy_compliant"] is False assert payload["supply_chain"]["raw_image_identity_returned"] is False assert payload["supply_chain"]["registry_api_called"] is False assert payload["supply_chain"]["github_api_used"] is False assert payload["certificate_inventory"]["live_tls_health_proven"] is False assert payload["certificate_inventory"]["private_key_material_read"] is False assert any( item["work_item_id"] == "AIA-P0-006-02" for item in payload["work_items"] ) assert any( item["work_item_id"] == "AIA-P1-001-01" for item in payload["work_items"] ) assert any( item["work_item_id"] == "AIA-P0-008-01" for item in payload["work_items"] ) public_text = json.dumps(payload, ensure_ascii=False) assert "192.168." not in public_text assert "postgresql://" not in public_text assert "target_resource" not in public_text assert '"event_payload":' not in public_text assert 'secret_value_collection_allowed": true' not in public_text.lower() def test_projects_one_closed_wazuh_soc_slice_without_claiming_global_coverage() -> ( None ): coverage_rows = [ _row(dimension=dimension, status="green", cnt=20) for dimension in ( "auto_rule_creation", "auto_rule_matching", "auto_playbook", "auto_remediation", "auto_km_creation", ) ] coverage_rows.extend( [ _row(dimension="auto_monitoring", status="green", cnt=19), _row(dimension="auto_monitoring", status="unknown", cnt=1), _row(dimension="auto_alerting", status="green", cnt=19), _row(dimension="auto_alerting", status="unknown", cnt=1), ] ) payload = _ready_payload( coverage_rows=coverage_rows, wazuh_asset_row=_row( canonical_asset_count=1, canonical_asset_ref="service:wazuh-manager", owner_resolved_asset_count=1, owner_verified_asset_count=1, monitoring_coverage_status="unknown", alerting_coverage_status="unknown", ), wazuh_runtime=_closed_wazuh_runtime_lanes(), ) wazuh = payload["wazuh_soc_slice"] assert wazuh["status"] == "same_run_closed_recipient_visible" assert wazuh["protected_asset_count"] == 1 assert wazuh["protected_asset_ref"] == "service:wazuh-manager" assert wazuh["asset_graph_joined"] is True assert wazuh["owner_verified_asset_count"] == 1 assert wazuh["telemetry_covered_asset_count"] == 1 assert wazuh["identity_kind_count"] == 5 assert wazuh["incident_ref"] == "IWZ-POSTURE-2026072205" assert wazuh["verifier_status"] == "passed" assert wazuh["verifier_receipt_ref"] == "verifier-wazuh-2205" assert wazuh["recipient_receipt_status"] == "recipient_visible" assert wazuh["recipient_receipt_ref"] == "telegram-wazuh-2205" assert wazuh["recipient_provider_message_ref"] == "2205" assert wazuh["same_run_present_stage_count"] == 18 assert wazuh["same_run_closed"] is True assert wazuh["coverage_overlay_applied_count"] == 2 assert wazuh["critical_break_glass_required"] is True assert "wazuh_critical_ingress_break_glass_pending" in ( wazuh["remaining_gap_codes"] ) assert "global_wazuh_asset_coverage_not_proven" in ( wazuh["remaining_gap_codes"] ) assert payload["summary"]["automation_coverage_unknown_count"] == 0 domains = { domain["domain_id"]: domain for domain in payload["security_program_domains"] } assert domains["endpoint_xdr_wazuh"]["controlled_percent"] == 70 assert domains["endpoint_xdr_wazuh"]["status"] == "partial" assert domains["endpoint_xdr_wazuh"]["gap_code"] == ( "wazuh_bounded_slice_closed_global_coverage_open" ) assert payload["boundaries"]["wazuh_slice_is_global_coverage_claim"] is False assert wazuh["raw_identity_returned"] is False assert wazuh["raw_event_payload_returned"] is False assert wazuh["secret_value_read"] is False def test_wazuh_slice_refuses_coverage_overlay_when_runtime_asset_does_not_join() -> ( None ): runtime = _closed_wazuh_runtime_lanes() runtime["posture"]["asset_identity"]["canonical_asset_ref"] = ( "service:wazuh-shadow" ) payload = _ready_payload( coverage_rows=[ _row(dimension="auto_monitoring", status="unknown", cnt=1), _row(dimension="auto_alerting", status="unknown", cnt=1), ], wazuh_asset_row=_row( canonical_asset_count=1, canonical_asset_ref="service:wazuh-manager", owner_resolved_asset_count=1, owner_verified_asset_count=1, monitoring_coverage_status="unknown", alerting_coverage_status="unknown", ), wazuh_runtime=runtime, ) wazuh = payload["wazuh_soc_slice"] assert wazuh["asset_graph_joined"] is False assert wazuh["protected_asset_count"] == 0 assert wazuh["telemetry_covered_asset_count"] == 0 assert wazuh["coverage_overlay_applied_count"] == 0 assert "wazuh_runtime_asset_graph_join_missing" in ( wazuh["remaining_gap_codes"] ) def test_uncovered_security_domains_are_explicit_ordered_p0_work_items() -> None: payload = _ready_payload(coverage_rows=[], compliance_rows=[]) work_item_by_control = {item["control_id"]: item for item in payload["work_items"]} for control_id in ( "endpoint_xdr_wazuh", "incident_response_soar", "identity_zero_trust", "data_secrets_privacy", "vulnerability_exposure", "telemetry_detection", "backup_dr_resilience", "siem_soc_threat_intel", ): assert work_item_by_control[control_id]["priority"] == "P0" p0_orders = [ item["order"] for item in payload["work_items"] if item["priority"] == "P0" ] assert p0_orders == sorted(p0_orders) assert all(item["order"] < 999 for item in payload["work_items"]) assert [item["control_id"] for item in payload["work_items"][:5]] == [ "asset_scope", "asset_ownership", "automation_coverage", "telemetry_detection", "endpoint_xdr_wazuh", ] def test_projects_canonical_runtime_receipts_without_false_same_run_closure() -> None: payload = _ready_payload( automation_rows=[ _row(operation_type="asset_discovered", status="success", cnt=1), _row(operation_type="rule_matched", status="success", cnt=2), _row(operation_type="rule_created", status="success", cnt=2), _row( operation_type="ansible_check_mode_executed", status="dry_run", cnt=2, ), _row(operation_type="ansible_apply_executed", status="success", cnt=1), _row(operation_type="remediation_verified", status="success", cnt=2), _row(operation_type="km_created", status="success", cnt=2), ], runtime_receipt_counts={"correlate": 7, "verify": 5, "learn": 4}, ) ai_stages = { stage["stage_id"]: stage for stage in payload["ai_automation"]["stages"] } assert ai_stages["correlate"]["receipt_count_24h"] == 7 assert ai_stages["verify"]["receipt_count_24h"] == 5 assert ai_stages["learn"]["receipt_count_24h"] == 4 assert payload["summary"]["verified_remediation_receipt_count_24h"] == 5 assert payload["summary"]["siem_stage_coverage_percent"] == 100 assert payload["summary"]["ai_loop_stage_coverage_percent"] == 100 assert payload["completion"]["strict_runtime_closure_percent"] == 0 assert payload["ai_automation"]["same_run_closed_loop_proven"] is False work_items = {item["work_item_id"]: item for item in payload["work_items"]} assert "AIA-P0-007-01" not in work_items assert work_items["AIA-P0-008-01"]["gap_count"] == 1 def test_projects_exact_authoritative_same_run_runtime_closure() -> None: payload = _ready_payload(strict_runtime=_closed_strict_runtime()) strict = payload["ai_automation"]["strict_runtime_completion"] assert strict == { "schema_version": "ai_agent_strict_runtime_completion_v2", "runtime_contract_schema_version": ( AI_AUTOMATION_RUNTIME_CONTRACT_SCHEMA_VERSION ), "contract_compatible": True, "completion_percent": 100, "required_stage_count": len(AI_AUTOMATION_REQUIRED_LOOP_STAGES), "present_stage_count": len(AI_AUTOMATION_REQUIRED_LOOP_STAGES), "missing_stage_count": 0, "same_run_correlation": True, "full_trace_same_run_correlation_proven": True, "execution_loop_closed": True, "closed": True, "reason_code": None, "cache_fallback_active": False, "raw_run_identity_returned": False, "raw_stage_receipts_returned": False, } assert payload["completion"]["strict_runtime_closure_percent"] == 100 assert payload["ai_automation"]["same_run_closed_loop_proven"] is True assert payload["ai_automation"]["same_run_closed_loop_count"] == 1 assert all( item["work_item_id"] != "AIA-P0-008-01" for item in payload["work_items"] ) assert payload["completion"]["overall_percent"] == round( sum( dimension["completion_percent"] for dimension in payload["completion"]["dimensions"] ) / payload["completion"]["dimension_count"] ) public_text = json.dumps(payload, ensure_ascii=False) assert "internal-run-identity" not in public_text assert '"automation_run_id"' not in public_text assert '"stage_contracts"' not in public_text def test_strict_runtime_projection_fails_closed_on_contract_or_receipt_drift() -> None: variants: list[dict] = [] bad_schema = _closed_strict_runtime() bad_schema["schema_version"] = "ai_agent_strict_runtime_completion_v1" variants.append(bad_schema) missing_stage = _closed_strict_runtime() missing_stage["present_stage_count"] -= 1 missing_stage["missing_stage_ids"] = [AI_AUTOMATION_REQUIRED_LOOP_STAGES[-1]] variants.append(missing_stage) cross_run = _closed_strict_runtime() cross_run["same_run_correlation"] = False cross_run["run_id_mismatch_stage_ids"] = ["telegram_receipt"] variants.append(cross_run) no_run_identity = _closed_strict_runtime() no_run_identity["automation_run_id"] = "" variants.append(no_run_identity) metadata_only = _closed_strict_runtime() metadata_only["metadata_only_counts_as_completion"] = True variants.append(metadata_only) invalid_stage_contract = copy.deepcopy(_closed_strict_runtime()) invalid_stage_contract["stage_contracts"][0]["completion_eligible"] = False variants.append(invalid_stage_contract) for strict_runtime in variants: payload = _ready_payload(strict_runtime=strict_runtime) strict = payload["ai_automation"]["strict_runtime_completion"] assert strict["closed"] is False assert strict["completion_percent"] == 0 assert payload["completion"]["strict_runtime_closure_percent"] == 0 assert payload["ai_automation"]["same_run_closed_loop_proven"] is False assert any( item["work_item_id"] == "AIA-P0-008-01" for item in payload["work_items"] ) def test_discovery_failure_exposes_only_allowlisted_collector_ids() -> None: raw_error = ( "RuntimeError: asset_collector_failures=domain_tls_inventory," "prometheus_targets,postgresql://operator:raw-secret@private-host/runtime" ) payload = _ready_payload( discovery_status="failed", discovery_error=raw_error, ) assert payload["discovery"]["failure_reason_code"] == "asset_collector_failures" assert payload["discovery"]["failed_collector_count"] == 2 assert payload["discovery"]["failed_collector_ids"] == [ "domain_tls_inventory", "prometheus_targets", ] assert payload["discovery"]["raw_error_returned"] is False assert payload["boundaries"]["raw_discovery_error_returned"] is False public_text = json.dumps(payload, ensure_ascii=False) assert "raw-secret" not in public_text assert "private-host" not in public_text assert "postgresql://" not in public_text def test_discovery_failure_fails_closed_for_unknown_raw_error() -> None: payload = _ready_payload( discovery_status="failed", discovery_error="RuntimeError: /private/path leaked provider detail", ) assert payload["discovery"]["failure_reason_code"] == ( "asset_scan_failed_public_details_unavailable" ) assert payload["discovery"]["failed_collector_count"] == 0 assert payload["discovery"]["failed_collector_ids"] == [] assert "/private/path" not in json.dumps(payload) def test_runtime_image_policy_gaps_are_visible_and_never_false_green() -> None: now = datetime(2026, 7, 11, 4, 0, tzinfo=UTC) payload = build_iwooos_security_asset_control_plane( discovery_row=_row( latest_status="success", latest_scan_depth="full", latest_started_at=now - timedelta(minutes=10), latest_ended_at=now - timedelta(minutes=9), latest_success_ended_at=now - timedelta(minutes=9), latest_total_assets=31, ), inventory_rows=[ _row( asset_type="package", cnt=31, unowned_count=0, stale_count=0, forbidden_github_source_count=3, unpinned_package_count=31, ), ], coverage_rows=[], relationship_row=_row(relationship_count=31, orphan_asset_count=0), compliance_rows=[], automation_rows=[], ai_trace_row=_row(trace_count=0, accepted_trace_count=0), siem_row=_row(), audit_row=_row(), generated_at=now, ) assert payload["summary"]["package_digest_unpinned_count"] == 31 assert payload["summary"]["forbidden_github_supply_chain_asset_count"] == 3 assert payload["supply_chain"] == { "package_asset_count": 31, "package_inventory_evidenced": True, "package_digest_pinned_count": 0, "package_digest_unpinned_count": 31, "forbidden_github_supply_chain_asset_count": 3, "github_freeze_compliant": False, "runtime_image_policy_compliant": False, "raw_image_identity_returned": False, "registry_api_called": False, "github_api_used": False, } work_item = next( item for item in payload["work_items"] if item["work_item_id"] == "AIA-P0-006-02A" ) assert work_item["gap_count"] == 34 assert work_item["status"] == "open" domains = { domain["domain_id"]: domain for domain in payload["security_program_domains"] } assert domains["software_supply_chain"]["gap_code"] == ( "forbidden_github_supply_chain_source_detected" ) assert domains["software_supply_chain"]["status"] != "controlled" public_text = json.dumps(payload, ensure_ascii=False).lower() assert "ghcr.io/" not in public_text assert "raw.githubusercontent.com/" not in public_text def test_unknown_coverage_and_compliance_create_p0_work_items() -> None: now = datetime(2026, 7, 11, 4, 0, tzinfo=UTC) payload = build_iwooos_security_asset_control_plane( discovery_row=_row( latest_status="success", latest_scan_depth="shallow", latest_started_at=now - timedelta(minutes=10), latest_ended_at=now - timedelta(minutes=9), latest_success_ended_at=now - timedelta(minutes=9), latest_total_assets=1, ), inventory_rows=[ _row(asset_type="host", cnt=1, unowned_count=1, stale_count=0), ], coverage_rows=[ _row(dimension="auto_monitoring", status="unknown", cnt=1), ], relationship_row=_row(relationship_count=0, orphan_asset_count=1), compliance_rows=[ _row(dimension="cve_scan", status="unknown", cnt=1), ], automation_rows=[], ai_trace_row=_row(trace_count=0, accepted_trace_count=0), siem_row=_row(), audit_row=_row(), generated_at=now, ) assert payload["summary"]["automation_coverage_green_percent"] == 0 assert payload["summary"]["automation_coverage_unknown_count"] == 1 assert payload["summary"]["compliance_unknown_count"] == 1 assert payload["summary"]["siem_observed_stage_count"] == 0 assert payload["summary"]["ai_loop_observed_stage_count"] == 0 assert payload["completion"]["strict_runtime_closure_percent"] == 0 work_item_ids = {item["work_item_id"] for item in payload["work_items"]} assert { "AIA-P0-006-02", "AIA-P0-006-03", "AIA-P0-006-04", "AIA-P0-006-05", "AIA-P0-006-06", "AIA-P0-007-01", "AIA-P0-008-01", } <= work_item_ids def test_certificate_assets_remain_open_until_live_tls_probe_is_evidenced() -> None: now = datetime(2026, 7, 11, 4, 0, tzinfo=UTC) payload = build_iwooos_security_asset_control_plane( discovery_row=_row( latest_status="success", latest_scan_depth="full", latest_success_ended_at=now - timedelta(minutes=1), latest_total_assets=10, ), inventory_rows=[ _row( asset_type="certificate", cnt=10, unowned_count=10, stale_count=0, unverified_certificate_count=10, ), ], coverage_rows=[], relationship_row=_row(relationship_count=0, orphan_asset_count=10), compliance_rows=[], automation_rows=[], ai_trace_row=_row(trace_count=0, accepted_trace_count=0), siem_row=_row(), audit_row=_row(), generated_at=now, ) assert payload["summary"]["certificate_live_unverified_count"] == 10 assert payload["certificate_inventory"] == { "certificate_asset_count": 10, "live_tls_verified_count": 0, "live_tls_evidenced_count": 0, "live_tls_healthy_count": 0, "live_tls_unverified_count": 10, "live_tls_unhealthy_count": 0, "live_tls_health_proven": False, "raw_certificate_path_returned": False, "certificate_material_read": False, "private_key_material_read": False, } work_item = next( item for item in payload["work_items"] if item["work_item_id"] == "AIA-P0-006-02B" ) assert work_item["gap_count"] == 10 domains = { domain["domain_id"]: domain for domain in payload["security_program_domains"] } assert domains["network_dns_tls"]["gap_code"] == ( "certificate_live_tls_probe_missing" ) assert domains["network_dns_tls"]["status"] != "controlled" def test_unhealthy_live_tls_evidence_remains_a_p0_gap() -> None: now = datetime(2026, 7, 11, 4, 0, tzinfo=UTC) payload = build_iwooos_security_asset_control_plane( discovery_row=_row( latest_status="success", latest_scan_depth="full", latest_success_ended_at=now - timedelta(minutes=1), latest_total_assets=3, ), inventory_rows=[ _row( asset_type="certificate", cnt=3, unowned_count=3, stale_count=0, unverified_certificate_count=0, unhealthy_certificate_count=1, ), ], coverage_rows=[], relationship_row=_row(relationship_count=0, orphan_asset_count=3), compliance_rows=[], automation_rows=[], ai_trace_row=_row(trace_count=0, accepted_trace_count=0), siem_row=_row(), audit_row=_row(), generated_at=now, ) assert payload["summary"]["certificate_live_unverified_count"] == 0 assert payload["summary"]["certificate_live_unhealthy_count"] == 1 assert payload["certificate_inventory"]["live_tls_evidenced_count"] == 3 assert payload["certificate_inventory"]["live_tls_healthy_count"] == 2 assert payload["certificate_inventory"]["live_tls_unhealthy_count"] == 1 assert payload["certificate_inventory"]["live_tls_health_proven"] is False work_item = next( item for item in payload["work_items"] if item["work_item_id"] == "AIA-P0-006-02B" ) assert work_item["gap_count"] == 1 domains = { domain["domain_id"]: domain for domain in payload["security_program_domains"] } assert domains["network_dns_tls"]["gap_code"] == ("certificate_live_tls_unhealthy") def test_fully_evidenced_healthy_tls_inventory_proves_health() -> None: now = datetime(2026, 7, 11, 4, 0, tzinfo=UTC) payload = build_iwooos_security_asset_control_plane( discovery_row=_row( latest_status="success", latest_scan_depth="full", latest_success_ended_at=now - timedelta(minutes=1), latest_total_assets=10, ), inventory_rows=[ _row( asset_type="certificate", cnt=10, unowned_count=10, stale_count=0, unverified_certificate_count=0, unhealthy_certificate_count=0, ), ], coverage_rows=[], relationship_row=_row(relationship_count=10, orphan_asset_count=0), compliance_rows=[], automation_rows=[], ai_trace_row=_row(trace_count=0, accepted_trace_count=0), siem_row=_row(), audit_row=_row(), generated_at=now, ) assert payload["certificate_inventory"]["live_tls_evidenced_count"] == 10 assert payload["certificate_inventory"]["live_tls_healthy_count"] == 10 assert payload["certificate_inventory"]["live_tls_unverified_count"] == 0 assert payload["certificate_inventory"]["live_tls_unhealthy_count"] == 0 assert payload["certificate_inventory"]["live_tls_health_proven"] is True assert all( item["work_item_id"] != "AIA-P0-006-02B" for item in payload["work_items"] ) def test_partial_source_failure_is_visible_without_erasing_core_inventory() -> None: source_health = [ {"source_id": "asset_discovery", "status": "ready", "reason_code": None}, {"source_id": "asset_inventory", "status": "ready", "reason_code": None}, { "source_id": "audit_runtime", "status": "unavailable", "reason_code": "audit_runtime_query_failed", }, ] payload = _ready_payload(source_health) assert payload["status"] == "degraded" assert payload["source_status"] == "live_database_partial" assert payload["summary"]["managed_asset_count"] == 24 assert payload["summary"]["ready_source_count"] == 2 assert payload["summary"]["unavailable_source_count"] == 1 assert payload["source_health"] == source_health assert payload["work_items"][0]["work_item_id"] == "AIA-P0-006-00" def test_read_public_source_returns_redacted_reason_code_on_query_failure( monkeypatch, ) -> None: class FailingDb: async def execute(self, statement): raise RuntimeError("private table detail") class DbContext: async def __aenter__(self): return FailingDb() async def __aexit__(self, exc_type, exc, traceback): return False monkeypatch.setattr( "src.services.iwooos_security_asset_control_plane.get_db_context", lambda project_id: DbContext(), ) value, health = asyncio.run( _read_public_source( project_id="awoooi", limiter=asyncio.Semaphore(1), source_id="audit_runtime", statement="SELECT 1", result_mode="one", default={}, ) ) assert value == {} assert health == { "source_id": "audit_runtime", "status": "unavailable", "reason_code": "audit_runtime_query_failed", } def test_unavailable_payload_is_fixed_degraded_contract_without_raw_error() -> None: payload = build_unavailable_iwooos_security_asset_control_plane( "database_query_failed" ) assert payload["status"] == "degraded" assert payload["source_status"] == "live_database_unavailable" assert payload["reason_code"] == "database_query_failed" assert payload["summary"]["managed_asset_count"] == 0 assert payload["summary"]["overall_security_completion_percent"] == 0 assert payload["completion"]["overall_percent"] == 0 assert payload["completion"]["strict_runtime_closure_percent"] == 0 assert payload["summary"]["source_count"] == 12 assert payload["summary"]["unavailable_source_count"] == 12 assert payload["ai_automation"]["strict_runtime_completion"]["closed"] is False assert payload["discovery"]["fresh"] is False assert payload["boundaries"]["raw_asset_identity_returned"] is False assert payload["boundaries"]["raw_event_payload_returned"] is False assert payload["boundaries"]["raw_discovery_error_returned"] is False def test_service_redacts_database_exception_details(monkeypatch) -> None: service = IwoooSSecurityAssetControlPlaneService() async def fail_load(): raise RuntimeError("postgresql://operator:raw-secret@private-host/runtime") monkeypatch.setattr(service, "_load_snapshot", fail_load) payload = asyncio.run(service.get_snapshot()) text = json.dumps(payload) assert payload["reason_code"] == "database_query_failed" assert "raw-secret" not in text assert "private-host" not in text def test_service_reuses_short_lived_public_aggregate_cache(monkeypatch) -> None: service = IwoooSSecurityAssetControlPlaneService() calls = 0 expected = _ready_payload() async def load_once(): nonlocal calls calls += 1 return expected monkeypatch.setattr(service, "_load_snapshot", load_once) async def read_twice(): first = await service.get_snapshot() second = await service.get_snapshot() return first, second first, second = asyncio.run(read_twice()) assert calls == 1 assert first is expected assert second is expected def test_service_uses_canonical_awoooi_project_scope(monkeypatch) -> None: service = IwoooSSecurityAssetControlPlaneService() requested_projects: list[str] = [] class FailingContext: async def __aenter__(self): raise RuntimeError("stop after project scope capture") async def __aexit__(self, exc_type, exc, traceback): return False def fake_db_context(project_id: str): requested_projects.append(project_id) return FailingContext() monkeypatch.setattr( "src.services.iwooos_security_asset_control_plane.get_db_context", fake_db_context, ) async def strict_runtime_unavailable(): return {}, { "source_id": "autonomous_strict_runtime", "status": "unavailable", "reason_code": "autonomous_strict_runtime_query_failed", } monkeypatch.setattr( "src.services.iwooos_security_asset_control_plane._read_strict_runtime_source", strict_runtime_unavailable, ) async def wazuh_runtime_unavailable(**_kwargs): return {}, { "source_id": "wazuh_controlled_runtime", "status": "unavailable", "reason_code": "wazuh_controlled_runtime_query_failed", } monkeypatch.setattr( "src.services.iwooos_security_asset_control_plane._read_wazuh_runtime_source", wazuh_runtime_unavailable, ) payload = asyncio.run(service.get_snapshot()) assert requested_projects == ["awoooi"] * 10 assert payload["status"] == "degraded" assert payload["source_status"] == "live_database_unavailable" assert payload["summary"]["source_count"] == 12 assert payload["summary"]["unavailable_source_count"] == 12 def test_service_bounds_source_concurrency_for_database_budget(monkeypatch) -> None: service = IwoooSSecurityAssetControlPlaneService() concurrency = {"active": 0, "maximum": 0} statements: list[str] = [] class EmptyResult: def fetchall(self): return [] def one(self): return {} def one_or_none(self): return None class SlowDb: async def execute(self, statement): statements.append(str(statement)) concurrency["active"] += 1 concurrency["maximum"] = max(concurrency["maximum"], concurrency["active"]) await asyncio.sleep(0.02) concurrency["active"] -= 1 return EmptyResult() class DbContext: async def __aenter__(self): return SlowDb() async def __aexit__(self, exc_type, exc, traceback): return False monkeypatch.setattr( "src.services.iwooos_security_asset_control_plane.get_db_context", lambda project_id: DbContext(), ) async def strict_runtime_ready(): return _closed_strict_runtime(), { "source_id": "autonomous_strict_runtime", "status": "ready", "reason_code": None, } monkeypatch.setattr( "src.services.iwooos_security_asset_control_plane._read_strict_runtime_source", strict_runtime_ready, ) async def wazuh_runtime_ready(**_kwargs): return _closed_wazuh_runtime_lanes(), { "source_id": "wazuh_controlled_runtime", "status": "ready", "reason_code": None, } monkeypatch.setattr( "src.services.iwooos_security_asset_control_plane._read_wazuh_runtime_source", wazuh_runtime_ready, ) payload = asyncio.run(service._load_snapshot()) assert concurrency["maximum"] == 3 assert payload["summary"]["source_count"] == 12 assert payload["summary"]["ready_source_count"] == 12 assert payload["summary"]["unavailable_source_count"] == 0 compliance_query = next( statement for statement in statements if "asset_compliance_snapshot" in statement ) assert "CROSS JOIN dimensions" in compliance_query assert "LEFT JOIN LATERAL" in compliance_query assert ( "ORDER BY snapshot.detected_at DESC, snapshot.snapshot_id DESC" in compliance_query ) assert "latest.detected_at < NOW() - INTERVAL '36 hours'" in compliance_query assert "THEN 'unknown'" in compliance_query inventory_query = next( statement for statement in statements if "FROM asset_inventory" in statement ) assert "forbidden_source_domain_detected" in inventory_query assert "digest_pinned" in inventory_query assert "live_tls_probe_evidenced" in inventory_query assert "live_tls_healthy" in inventory_query wazuh_asset_query = next( statement for statement in statements if "program_canonical_id" in statement ) assert "awoooi:observability_and_security:wazuh" in wazuh_asset_query assert "service:wazuh-manager" in wazuh_asset_query assert "runtime_canonical_asset_ids" in wazuh_asset_query assert "lower(btrim(owner_team)) = 'aisoc'" in wazuh_asset_query assert "auto_monitoring" in wazuh_asset_query assert "auto_alerting" in wazuh_asset_query assert "snapshot.created_at DESC" in wazuh_asset_query siem_query = next( statement for statement in statements if "FROM alert_rule_catalog" in statement ) assert "correlated_controlled_route_count_24h" in siem_query assert "ansible_candidate_matched" in siem_query assert "jsonb_array_elements" in siem_query assert "executor_candidates" in siem_query assert "candidate_payload ->> 'catalog_id'" in siem_query assert "independent_verifier_pass_count_24h" in siem_query assert "all_postconditions_passed" in siem_query assert "executor_returncode_trusted" in siem_query assert "learning_writeback_count_24h" in siem_query assert "ansible_learning_writeback_recorded" in siem_query audit_query = next( statement for statement in statements if "WITH k8s AS" in statement ) assert "count(*) FILTER (WHERE success IS FALSE)" in audit_query assert "CROSS JOIN mcp" in audit_query assert "CROSS JOIN asset_changes" in audit_query assert "repository_readback_verified" in siem_query def test_public_api_returns_live_aggregate(monkeypatch) -> None: payload = _ready_payload() class FakeService: async def get_snapshot(self): return payload monkeypatch.setattr( "src.api.v1.iwooos.get_iwooos_security_asset_control_plane_service", lambda: FakeService(), ) app = FastAPI() app.include_router(router) response = TestClient(app).get("/api/v1/iwooos/security-asset-control-plane") assert response.status_code == 200 data = response.json() assert data["schema_version"] == "iwooos_security_asset_control_plane_v1" assert data["summary"]["managed_asset_count"] == 24 assert data["summary"]["siem_stage_coverage_percent"] == 100 assert data["ai_automation"]["same_run_closed_loop_proven"] is False assert "192.168." not in response.text assert "raw-secret" not in response.text