112 lines
5.6 KiB
Python
112 lines
5.6 KiB
Python
from pathlib import Path
|
|
|
|
|
|
ROOT = Path(__file__).resolve().parents[3]
|
|
SCRIPT = ROOT / "scripts/reboot-recovery/agent99-legacy-sender-quarantine.ps1"
|
|
REGISTER_TASKS = ROOT / "agent99-register-tasks.ps1"
|
|
CONTROL_PLANE = ROOT / "agent99-control-plane.ps1"
|
|
|
|
|
|
def test_legacy_sender_quarantine_is_exact_bounded_and_rollback_ready() -> None:
|
|
source = SCRIPT.read_text(encoding="utf-8")
|
|
|
|
assert 'ValidateSet("Check", "Apply", "Verify")' in source
|
|
assert '"Wooo-Agent99-Host188-Performance-Guard"' in source
|
|
assert '"Wooo-Agent99-Performance-Guard"' in source
|
|
assert "a2f98560673ebed5aa1f828b4e577c8a34d1c277b2e498044c3526a4ffe15379" in source
|
|
assert "Export-ScheduledTask" in source
|
|
assert "Disable-ScheduledTask" in source
|
|
assert "Enable-ScheduledTask" in source
|
|
assert "Unregister-ScheduledTask" not in source
|
|
assert "Stop-ScheduledTask" not in source
|
|
assert "Restart-Service" not in source
|
|
assert "Restart-Computer" not in source
|
|
assert r"api\.telegram\.org|sendMessage|BotToken|ChatId" in source
|
|
assert "legacy_task_executable_identity_mismatch" in source
|
|
assert "legacy_task_working_directory_identity_mismatch" in source
|
|
assert "canonical_replacement_executable_identity_mismatch" in source
|
|
assert "canonical_replacement_working_directory_identity_mismatch" in source
|
|
assert "$replacementArguments -cne $ExpectedReplacementArguments" in source
|
|
assert "durableReceiptValid" in source
|
|
assert "receiptBooleanTypesValid" in source
|
|
assert "executorSourceSha256" in source
|
|
assert "rollbackArtifactSha256 -eq $rollbackSha256" in source
|
|
assert "rawTaskArgumentsStored = $false" in source
|
|
assert "secretValueRead = $false" in source
|
|
assert "taskDeleted = $false" in source
|
|
|
|
|
|
def test_legacy_sender_quarantine_has_check_apply_verify_receipts() -> None:
|
|
source = SCRIPT.read_text(encoding="utf-8")
|
|
|
|
for schema in (
|
|
"agent99_legacy_sender_quarantine_check_v1",
|
|
"agent99_legacy_sender_quarantine_receipt_v1",
|
|
"agent99_legacy_sender_quarantine_verify_v1",
|
|
):
|
|
assert schema in source
|
|
assert "wouldDisableLegacySender" in source
|
|
assert "durableReceiptAvailable" in source
|
|
assert "controlled_receipt_identity_already_exists" in source
|
|
assert 'identity -in @(".", "..")' in source
|
|
|
|
|
|
def test_task_registration_persists_the_exact_legacy_sender_sunset() -> None:
|
|
source = REGISTER_TASKS.read_text(encoding="utf-8")
|
|
quarantine_source = source[source.index("# Superseded by the canonical all-host performance guard.") :]
|
|
|
|
assert '"Wooo-Agent99-Host188-Performance-Guard"' in source
|
|
assert "a2f98560673ebed5aa1f828b4e577c8a34d1c277b2e498044c3526a4ffe15379" in source
|
|
assert "Disable-ScheduledTask" in source
|
|
assert "Unregister-ScheduledTask" not in source
|
|
assert "legacy_host188_sender_action_identity_mismatch" in source
|
|
assert "legacy_host188_sender_executable_identity_mismatch" in source
|
|
assert "legacy_host188_sender_working_directory_identity_mismatch" in source
|
|
assert "legacy_host188_sender_running_refuse_quarantine" in source
|
|
assert "legacy_host188_sender_quarantine_post_verifier_failed" in source
|
|
assert "agent99_legacy_sender_deployment_quarantine_v1" in source
|
|
assert "agent99-legacy-sender-deployment-quarantine.json" in source
|
|
assert "canonical_performance_sender_not_ready" in source
|
|
assert "canonical_performance_sender_direct_telegram_marker" in source
|
|
assert "canonical_performance_sender_executable_identity_mismatch" in source
|
|
assert "canonical_performance_sender_working_directory_identity_mismatch" in source
|
|
assert "$canonicalPerformanceArguments -cne $perfArgs" in source
|
|
assert "legacyActionIdentityVerified" in source
|
|
assert "replacementActionIdentityVerified" in source
|
|
assert "$registerTaskProducerManifestBound = [bool](" in source
|
|
assert "producerManifestBound = $registerTaskProducerManifestBound" in source
|
|
assert "rawTaskArgumentsStored = $false" in source
|
|
assert "secretValueRead = $false" in source
|
|
assert "receiptWritePerformed = $true" in source
|
|
assert "Move-Item -Force" in source
|
|
assert quarantine_source.index("$canonicalPerformanceTask = Get-ScheduledTask") < quarantine_source.index(
|
|
"Disable-ScheduledTask"
|
|
)
|
|
|
|
|
|
def test_selfcheck_independently_verifies_legacy_sender_quarantine() -> None:
|
|
source = CONTROL_PLANE.read_text(encoding="utf-8")
|
|
|
|
assert "function Test-AgentLegacySenderQuarantine" in source
|
|
assert "agent99_legacy_sender_deployment_quarantine_v1" in source
|
|
assert "legacy_sender_quarantine_receipt_missing" in source
|
|
assert "legacy_sender_quarantine_verified" in source
|
|
assert "legacy_sender_quarantine_drift" in source
|
|
assert "currentStateMatchesReceipt" in source
|
|
assert "receiptStatusMatchesState" in source
|
|
assert "replacementActionValid" in source
|
|
assert "legacyActionValid" in source
|
|
assert "$legacyActionSha256 = Get-AgentSha256Hex" in source
|
|
assert "$replacementArguments -ceq $expectedReplacementArguments" in source
|
|
assert "[StringComparer]::OrdinalIgnoreCase.Equals" in source
|
|
assert "legacyActionIdentityVerified -eq $true" in source
|
|
assert "replacementActionIdentityVerified -eq $true" in source
|
|
assert "receiptBooleanTypesValid" in source
|
|
assert "producerIdentityValid" in source
|
|
assert "producerManifestBound -is [bool]" in source
|
|
assert "legacyTaskFound -is [bool]" in source
|
|
assert "rawTaskArgumentsStored -eq $false" in source
|
|
assert "$legacySenderQuarantine = Test-AgentLegacySenderQuarantine" in source
|
|
assert 'if ($legacySenderQuarantine.severity -eq "critical")' in source
|
|
assert "legacySenderQuarantineEvidenceRef" in source
|