ddaad724ad
Some checks failed
CD Pipeline / build-and-deploy (push) Has been cancelled
CD Pipeline / post-deploy-checks (push) Has been cancelled
CD Pipeline / tests (push) Has been cancelled
Code Review / ai-code-review (push) Has been cancelled
Ansible / Reboot Recovery Contract / validate (push) Has been cancelled
93 lines
3.8 KiB
Python
93 lines
3.8 KiB
Python
from __future__ import annotations
|
|
|
|
from fastapi import FastAPI
|
|
from fastapi.testclient import TestClient
|
|
|
|
from src.api.v1.iwooos import router
|
|
from src.services.iwooos_owner_evidence_intake_preflight import (
|
|
load_latest_iwooos_owner_evidence_intake_preflight,
|
|
)
|
|
|
|
|
|
def _client() -> TestClient:
|
|
app = FastAPI()
|
|
app.include_router(router)
|
|
return TestClient(app)
|
|
|
|
|
|
def test_iwooos_owner_evidence_intake_preflight_prioritizes_p0_lanes() -> None:
|
|
payload = load_latest_iwooos_owner_evidence_intake_preflight()
|
|
|
|
assert payload["schema_version"] == "iwooos_owner_evidence_intake_preflight_v1"
|
|
assert payload["status"] == "owner_evidence_intake_preflight_ready_no_runtime_action"
|
|
assert payload["summary"]["lane_count"] == 6
|
|
assert payload["summary"]["canonical_owner_field_count"] == 9
|
|
assert payload["summary"]["required_owner_field_total"] == 54
|
|
assert payload["summary"]["dispatch_preflight_check_count"] == 9
|
|
assert payload["summary"]["reviewer_intake_lane_count"] == 5
|
|
|
|
lane_ids = [lane["lane_id"] for lane in payload["lanes"]]
|
|
assert lane_ids == [
|
|
"nginx_public_gateway",
|
|
"dns_tls_certbot",
|
|
"k8s_production_gitops",
|
|
"secret_workflow_runner_source_control",
|
|
"public_admin_api_runtime_config",
|
|
"wazuh_manager_registry",
|
|
]
|
|
assert payload["lanes"][0]["label"] == "Nginx / 公開入口 / 反向代理"
|
|
assert payload["lanes"][-1]["label"] == "Wazuh manager registry / 逐主機矩陣"
|
|
|
|
|
|
def test_iwooos_owner_evidence_intake_preflight_keeps_runtime_boundaries_closed() -> None:
|
|
payload = load_latest_iwooos_owner_evidence_intake_preflight()
|
|
|
|
summary = payload["summary"]
|
|
assert summary["request_sent_count"] == 0
|
|
assert summary["owner_response_received_count"] == 0
|
|
assert summary["owner_response_accepted_count"] == 0
|
|
assert summary["owner_response_quarantined_count"] == 0
|
|
assert summary["reviewer_queue_write_count"] == 0
|
|
assert summary["runtime_gate_count"] == 0
|
|
assert summary["action_button_count"] == 0
|
|
assert summary["host_write_authorized_count"] == 0
|
|
assert summary["active_scan_authorized_count"] == 0
|
|
assert summary["wazuh_live_query_authorized_count"] == 0
|
|
assert summary["wazuh_active_response_authorized_count"] == 0
|
|
assert summary["secret_value_collection_allowed_count"] == 0
|
|
|
|
boundaries = payload["execution_boundaries"]
|
|
assert boundaries["not_authorization"] is True
|
|
for key, value in boundaries.items():
|
|
if key == "not_authorization":
|
|
continue
|
|
assert value is False
|
|
|
|
for lane in payload["lanes"]:
|
|
assert lane["request_sent"] is False
|
|
assert lane["owner_response_received"] is False
|
|
assert lane["owner_response_accepted"] is False
|
|
assert lane["reviewer_queue_write"] is False
|
|
assert lane["runtime_gate_open"] is False
|
|
assert lane["action_buttons_allowed"] is False
|
|
assert lane["secret_value_collection_allowed"] is False
|
|
|
|
|
|
def test_iwooos_owner_evidence_intake_preflight_api_is_public_safe() -> None:
|
|
response = _client().get("/api/v1/iwooos/owner-evidence-intake-preflight")
|
|
|
|
assert response.status_code == 200
|
|
data = response.json()
|
|
assert data["schema_version"] == "iwooos_owner_evidence_intake_preflight_v1"
|
|
assert data["summary"]["lane_count"] == 6
|
|
assert data["summary"]["runtime_gate_count"] == 0
|
|
assert data["lanes"][0]["lane_id"] == "nginx_public_gateway"
|
|
assert data["lanes"][-1]["lane_id"] == "wazuh_manager_registry"
|
|
assert "192.168.0." not in response.text
|
|
assert "工作視窗" not in response.text
|
|
assert "批准！繼續" not in response.text
|
|
assert "source_thread_id" not in response.text
|
|
assert "owenhytsai/" not in response.text
|
|
assert "raw Wazuh payload" not in response.text
|
|
assert "WAZUH_API_PASSWORD" not in response.text
|