"""Adversarial contracts for the Atlas-only draft pull-request client.""" from __future__ import annotations import base64 import copy import importlib.util import json import sys import urllib.request from email.message import Message from pathlib import Path import pytest ROOT = Path(__file__).parents[2] CLIENT_PATH = ROOT / "services/hermes/scm-common/scripts/gitea_api.py" HEAD_SHA = "465cf9146b05c174a2a8d310aff6c64be58277b6" if str(CLIENT_PATH.parent) not in sys.path: sys.path.insert(0, str(CLIENT_PATH.parent)) def _load(): spec = importlib.util.spec_from_file_location("safe_gitea_api", CLIENT_PATH) assert spec and spec.loader module = importlib.util.module_from_spec(spec) sys.modules[spec.name] = module spec.loader.exec_module(module) return module def _draft_payload(**updates): payload = { "base": "main", "body": "Review evidence", "head": "hermes/review-fix", "title": "WIP: Repair review findings", } payload.update(updates) return payload def _draft_response(**updates): response = { "number": 3, "state": "open", "draft": True, "merged": False, "html_url": "https://scm.bstein.dev/atlas/cassandra/pulls/3", "url": "https://scm.bstein.dev/atlas/cassandra/pulls/3", "title": "WIP: Focused fix", "body": "Review evidence", "base": {"ref": "main", "repo": {"full_name": "atlas/cassandra"}}, "head": { "ref": "hermes/fix", "sha": HEAD_SHA, "repo": {"full_name": "atlas/cassandra"}, }, } response.update(updates) return response class Response: def __init__(self, body: object, status: int | None = None): self.body = body if isinstance(body, bytes) else json.dumps(body).encode() self.status = status if status is not None else (201 if isinstance(body, dict) else 200) self.headers = Message() self.headers["Content-Type"] = "application/json" def __enter__(self): return self def __exit__(self, *_args): return False def read(self, limit=-1): return self.body if limit < 0 else self.body[:limit] def test_redirect_handler_rejects_cross_origin_with_sentinel_authorization(): client = _load() source = urllib.request.Request( "https://scm.bstein.dev/api/v1/repos/atlas/cassandra", headers={"Authorization": "token redirect-sentinel"}, ) with pytest.raises(client.PolicyError, match="redirects are not allowed") as exc: client.RejectRedirectHandler().redirect_request( source, None, 302, "Found", {}, "https://evil.example/collect", ) assert "redirect-sentinel" not in str(exc.value) assert any( isinstance(handler, client.RejectRedirectHandler) for handler in client._SAFE_OPENER.handlers ) @pytest.mark.parametrize( ("base_url", "path"), [ ("https://evil.example", "/api/v1/repos/atlas/cassandra"), ("http://scm.bstein.dev", "/api/v1/repos/atlas/cassandra"), ("https://scm.bstein.dev:443", "/api/v1/repos/atlas/cassandra"), ("https://scm.bstein.dev/", "/api/v1/repos/atlas/cassandra"), ("HTTPS://scm.bstein.dev", "/api/v1/repos/atlas/cassandra"), ("https://SCM.bstein.dev", "/api/v1/repos/atlas/cassandra"), ("https://user@scm.bstein.dev", "/api/v1/repos/atlas/cassandra"), ("https://scm.bstein.dev", "https://evil.example/api/v1/repos/atlas/cassandra"), ("https://scm.bstein.dev", "/api/v1/repos/evil/cassandra"), ("https://scm.bstein.dev", "/api/v1/repos/%61tlas/cassandra"), ("https://scm.bstein.dev", "/api/v1/repos/atlas/../admin"), ], ) def test_host_owner_and_path_escape_attempts_are_rejected(base_url: str, path: str): client = _load() with pytest.raises(client.PolicyError): client.build_request("GET", path, base_url=base_url, token="secret") @pytest.mark.parametrize( "path", [ "/api/v1/repos/atlas/cassandra/pulls/1\nHost: evil.example", "/api/v1/repos/atlas/cassandra/pulls/1\r\nX-Test: value", "/api/v1/repos/atlas/cassandra/pulls/1\tignored", "/api/v1/repos/atlas/cassandra/pulls/1\x00ignored", "/api/v1/repos/atlas/cassandra/pulls/1\x1fignored", "/api/v1/repos/atlas/cassandra/pulls/1\x7fignored", "/api/v1/repos/atlas/cassandra\\pulls\\1", "/api/v1/repos/atlas/cassandra/pulls/%31", "/api/v1/repos/atlas/cassandra/pulls/１", " https://scm.bstein.dev/api/v1/repos/atlas/cassandra", "https://scm.bstein.dev/api/v1/repos/atlas/cassandra", ], ) def test_raw_noncanonical_target_is_rejected_before_urlsplit_and_opener( path: str, monkeypatch ): client = _load() split_called = False opener_called = False original_urlsplit = client.urllib.parse.urlsplit def urlsplit(*args, **kwargs): nonlocal split_called split_called = True return original_urlsplit(*args, **kwargs) def opener(*_args, **_kwargs): nonlocal opener_called opener_called = True return Response(b"{}") monkeypatch.setattr(client.urllib.parse, "urlsplit", urlsplit) with pytest.raises(client.PolicyError): client.read(path, token="runtime", opener=opener) assert split_called is False assert opener_called is False @pytest.mark.parametrize( "path", [ "/api/v1/repos/atlas/cassandra/pulls/1?", "//scm.bstein.dev/api/v1/repos/atlas/cassandra", "/api/v1/repos/atlas/cassandra/./pulls/1", "/api/v1/repos/atlas/cassandra/../admin", "/api/v1/repos/atlas/cassandra//pulls/1", "/api/v1/repos/atlas/cassandra/pulls/1?limit=01", ], ) def test_noncanonical_round_trip_or_segments_never_reach_opener(path: str): client = _load() opener_called = False def opener(*_args, **_kwargs): nonlocal opener_called opener_called = True return Response(b"{}") with pytest.raises(client.PolicyError): client.read(path, token="runtime", opener=opener) assert opener_called is False @pytest.mark.parametrize( "path", [ "/api/v1/repos/atlas/cassandra", "/api/v1/repos/atlas/cassandra/pulls?state=open&limit=20&page=1", "/api/v1/repos/atlas/cassandra/pulls/7", "/api/v1/repos/atlas/cassandra/pulls/7/commits?limit=20", "/api/v1/repos/atlas/cassandra/pulls/7/files?page=1", "/api/v1/repos/atlas/cassandra/branches", "/api/v1/repos/atlas/cassandra/branches/main", "/api/v1/repos/atlas/cassandra/commits?limit=10", f"/api/v1/repos/atlas/cassandra/git/commits/{HEAD_SHA}", f"/api/v1/repos/atlas/cassandra/commits/{HEAD_SHA}/status", f"/api/v1/repos/atlas/cassandra/commits/{HEAD_SHA}/statuses?limit=10", f"/api/v1/repos/atlas/cassandra/statuses/{HEAD_SHA}?page=1", ], ) def test_explicit_read_allowlist_accepts_only_engineering_metadata(path: str): client = _load() request = client.build_request( "GET", path, base_url=client.CANONICAL_BASE_URL, token="runtime" ) assert request.method == "GET" @pytest.mark.parametrize( "path", [ "/api/v1/repos/atlas/cassandra/hooks", "/api/v1/repos/atlas/cassandra/actions/secrets", "/api/v1/repos/atlas/cassandra/actions/variables", "/api/v1/repos/atlas/cassandra/collaborators", "/api/v1/repos/atlas/cassandra/branch_protections", "/api/v1/repos/atlas/cassandra/keys", "/api/v1/repos/atlas/cassandra/pulls/7/reviews", "/api/v1/repos/atlas/cassandra/pulls/7/merge", "/api/v1/repos/atlas/cassandra/pulls/7.diff", "/api/v1/repos/atlas/cassandra/releases", ], ) def test_privileged_or_content_routes_are_denied_even_for_get(path: str): client = _load() with pytest.raises(client.PolicyError, match="outside the metadata read allowlist"): client.authorize_request("GET", path, None) @pytest.mark.parametrize( "path", [ "/api/v1/repos/atlas/cassandra/pulls?limit=51", "/api/v1/repos/atlas/cassandra/pulls?state=merged", "/api/v1/repos/atlas/cassandra/pulls?private=true", "/api/v1/repos/atlas/cassandra/pulls?limit=1&limit=2", "/api/v1/repos/atlas/cassandra?p=1", ], ) def test_read_query_is_bounded(path: str): client = _load() with pytest.raises(client.PolicyError): client.authorize_request("GET", path, None) @pytest.mark.parametrize( "query", [ "page=0", "page=10001", "page=01", "limit=0", "limit=51", "limit=01", "page=" + "9" * 4000, "page=０", "page=%EF%BC%90", "state=%6fpen", "p%61ge=1", "page=1&page=2", "page=1&" + "x" * 17 + "=1", "state=" + "x" * 17, "page=1&limit=2&state=open&extra=3", ], ) def test_read_query_requires_canonical_bounded_ascii(query: str): client = _load() with pytest.raises(client.PolicyError): client.authorize_request( "GET", f"/api/v1/repos/atlas/cassandra/pulls?{query}", None ) @pytest.mark.parametrize( "suffix", [ "pulls/{number}", "pulls/{number}.patch", "pulls/{number}.diff", "pulls/{number}/commits", "pulls/{number}/files", "commits/{number}/status", "commits/{number}/statuses", "statuses/{number}", "branches/{number}", ], ) def test_oversized_numeric_or_captured_path_never_reaches_opener(suffix: str): client = _load() called = False def opener(*_args, **_kwargs): nonlocal called called = True return Response(b"{}") path = "/api/v1/repos/atlas/cassandra/" + suffix.format(number="9" * 4000) with pytest.raises(client.PolicyError): client.read(path, token="runtime", opener=opener) assert called is False @pytest.mark.parametrize( "number", ["0", "01", "2147483648", "１２", "%31", "12345678901"], ) @pytest.mark.parametrize("tail", ["", ".patch", ".diff", "/commits", "/files"]) def test_noncanonical_or_out_of_range_pr_number_never_reaches_opener( number: str, tail: str ): client = _load() called = False def opener(*_args, **_kwargs): nonlocal called called = True return Response(b"{}") with pytest.raises(client.PolicyError): client.read( f"/api/v1/repos/atlas/cassandra/pulls/{number}{tail}", token="runtime", opener=opener, ) assert called is False def test_maximum_bounded_pr_number_is_readable(): client = _load() called = False def opener(*_args, **_kwargs): nonlocal called called = True return Response(b"{}") assert ( client.read( "/api/v1/repos/atlas/cassandra/pulls/2147483647", token="runtime", opener=opener, ) == b"{}" ) assert called is True @pytest.mark.parametrize( ("method", "path", "data"), [ ("DELETE", "/api/v1/repos/atlas/cassandra/pulls/4", None), ("POST", "/api/v1/repos/atlas/cassandra/pulls/4/merge", {}), ( "POST", "/api/v1/repos/atlas/cassandra/pulls/4/reviews", {"event": "APPROVED"}, ), ("PATCH", "/api/v1/repos/atlas/cassandra/pulls/4", {"title": "WIP: x"}), ("PUT", "/api/v1/repos/atlas/cassandra/branches/main", {}), ], ) def test_merge_approve_close_delete_update_and_other_mutations_are_rejected( method: str, path: str, data: object ): client = _load() with pytest.raises(client.PolicyError): client.build_request( method, path, base_url=client.CANONICAL_BASE_URL, token="secret", data=data ) @pytest.mark.parametrize( "ref", [ "foo/.bar", "foo/bar.lock/baz", "foo..bar", "foo@{bar", "foo//bar", "-danger", "danger.", "danger~one", "danger^one", "danger:one", "danger one", ], ) def test_complete_git_ref_validation_rejects_invalid_names(ref: str): client = _load() with pytest.raises(client.PolicyError): client._validate_ref(ref, "head") def test_git_ref_validation_uses_fixed_trusted_binary(): client = _load() assert client._validate_ref.__globals__["GIT_BIN"] == "/usr/bin/git" assert client._validate_ref("hermes/valid-fix", "head") == "hermes/valid-fix" @pytest.mark.parametrize("field", ["base", "head"]) @pytest.mark.parametrize("oversized", ["r" * 100_000, "🧪" * 128]) def test_oversized_ref_never_invokes_git_request_or_opener( field: str, oversized: str, monkeypatch ): client = _load() git_called = False request_built = False opener_called = False original_build_request = client.build_request def git_run(*_args, **_kwargs): nonlocal git_called git_called = True raise AssertionError("Git must not receive an oversized ref") def build_request(*args, **kwargs): nonlocal request_built request_built = True return original_build_request(*args, **kwargs) def opener(*_args, **_kwargs): nonlocal opener_called opener_called = True return Response(_draft_response()) monkeypatch.setattr(client._validate_ref.__globals__["subprocess"], "run", git_run) client.build_request = build_request refs = {"base": "main", "head": "hermes/fix"} refs[field] = oversized with pytest.raises(client.PolicyError, match="branch-name limit"): client.create_draft( "cassandra", base=refs["base"], head=refs["head"], head_sha=HEAD_SHA, title="Focused fix", body="Review evidence", token="runtime", opener=opener, ) assert git_called is False assert request_built is False assert opener_called is False @pytest.mark.parametrize( ("field", "oversized"), [("repo", "r" * 101), ("title", "🧪" * 200), ("body", "🧪" * 9_000)], ) def test_other_text_bounds_fail_before_git_request_or_opener( field: str, oversized: str, monkeypatch ): client = _load() git_called = False request_built = False opener_called = False original_build_request = client.build_request def git_run(*_args, **_kwargs): nonlocal git_called git_called = True raise AssertionError("Git must not run before cheap input bounds") def build_request(*args, **kwargs): nonlocal request_built request_built = True return original_build_request(*args, **kwargs) def opener(*_args, **_kwargs): nonlocal opener_called opener_called = True return Response(_draft_response()) monkeypatch.setattr(client._validate_ref.__globals__["subprocess"], "run", git_run) client.build_request = build_request values = { "repo": "cassandra", "title": "Focused fix", "body": "Review evidence", } values[field] = oversized with pytest.raises(client.PolicyError): client.create_draft( values["repo"], base="main", head="hermes/fix", head_sha=HEAD_SHA, title=values["title"], body=values["body"], token="runtime", opener=opener, ) assert git_called is False assert request_built is False assert opener_called is False def test_create_forces_draft_title_and_same_repository_branch_names(): client = _load() assert ( client.authorize_request( "POST", "/api/v1/repos/atlas/cassandra/pulls", _draft_payload() ) == "create-draft" ) with pytest.raises(client.PolicyError, match="draft-title prefix"): client.authorize_request( "POST", "/api/v1/repos/atlas/cassandra/pulls", _draft_payload(title="Not a draft"), ) with pytest.raises(client.PolicyError): client.authorize_request( "POST", "/api/v1/repos/atlas/cassandra/pulls", _draft_payload(head="someone:branch"), ) def test_runtime_token_is_only_an_authorization_header(): client = _load() request = client.build_request( "POST", "/api/v1/repos/atlas/cassandra/pulls", base_url=client.CANONICAL_BASE_URL, token="do-not-leak", data=_draft_payload(), ) assert "do-not-leak" not in request.full_url assert b"do-not-leak" not in request.data assert request.get_header("Authorization") == "token do-not-leak" @pytest.mark.parametrize( "sensitive", [ "client_" + "secret=not-a-real-value", '{"client_' + 'secret":\n"synthetic-value"}', '{"client_' + 'secret"\n:\n"synthetic-value"}', '{"client\\u005f' + 'secret":"synthetic-value"}', "client_" + "secret:\n synthetic-value", '{"client\\q' + 'secret":"synthetic-value"}', '{"client\n' + 'secret":"synthetic-value"}', '"client_' + 'secret"\x0b:\n"synthetic-value"', "ACCESS_" + "TOKEN = 'not-a-real-value'", '{"refresh_' + 'token": "not-a-real-value"}', "private_" + "key: not-a-real-value", "AWS_SECRET_ACCESS_" + "KEY=not-a-real-value", "aws_access_key_" + "id: not-a-real-value", "AWS_SESSION_" + "TOKEN = 'not-a-real-value'", '{"AccessKey' + 'Id":"not-a-real-value"}', '{"SecretAccess' + 'Key":"not-a-real-value"}', '{"Session' + 'Token":"not-a-real-value"}', "aws-security-" + "token: not-a-real-value", "Account" + "Key=not-a-real-value", "SharedAccess" + "Signature: not-a-real-value", "AZURE_STORAGE_CONNECTION_" + "STRING='not-a-real-value'", "DefaultEndpointsProtocol=https;AccountName=fake;Account" + "Key=not-a-real-value;EndpointSuffix=example", "?sv=2024-11-04&ss=b&srt=sco&sp=rwdlac&se=2099-01-01&sig=" + "not-a-real-value", "DOCKER_AUTH_" + "CONFIG='not-a-real-value'", '{"auths":{"registry.example":{"auth":"bm90LXJlYWw="}}}', '{"identity' + 'token":"not-a-real-value"}', '{"type":"service_' + 'account","client_email":"fake@example.test"}', '{"private_key_' + 'id":"not-a-real-value"}', '{"client_' + 'email":"fake@example.test"}', "GOOGLE_CREDENTIALS" + "=not-a-real-value", "personal_access_" + "token: not-a-real-value", "GITEA_" + "TOKEN=not-a-real-value", "gitlab-token" + ": not-a-real-value", "pat" + "=not-a-real-value", "Authorization: " + "Bearer not-a-real-credential-value", "authorization = " + '"Basic not-a-real-credential-value"', "Bearer" + "=not-a-real-credential-value", "Basic" + ": not-a-real-credential-value", "pass" + "word=not-a-real-credential", "ghp_" + "notarealcredentialvalue123456", "github_pat_" + "notarealcredentialvalue123456", "glpat-" + "notarealcredentialvalue123456", "xoxb-" + "not-a-real-credential-value-123456", "sk-ant-" + "notarealcredentialvalue123456", "sk-proj-" + "notarealcredentialvalue123456", "sk_live_" + "notarealcredentialvalue123456", "ya29." + "notarealcredentialvalue123456", "gta_" + "notarealcredentialvalue123456", "whsec_" + "notarealcredentialvalue123456", "npm_" + "notarealcredentialvalue123456", "pypi-" + "notarealcredentialvalue123456789012345", "hf_" + "notarealcredentialvalue123456", "SG." + "notarealvalue1234" + ".notarealcredentialvalue123456", "SK" + "a" * 32, "https://hooks.slack.com/services/" + "T000/B000/notarealvalue123456", "https://discord.com/api/webhooks/123456789/" + "notarealcredentialvalue123456", "https://fake.webhook.office.com/" + "notarealcredentialvalue123456", "webhook_" + "url=https://example.test/not-real", "FutureCloudSigning" + "Credential=not-a-real-value", "future-client-signing-" + "key: not-a-real-value", "future_client_signing_" + "key='not-a-real-value'", '{"serviceAccountPrivate' + 'Key":"not-a-real-value"}', "CONTAINER_REGISTRY_" + "CREDENTIAL=not-a-real-value", "someWebhookSigning" + "Secret: not-a-real-value", "client" + "Key=not-a-real-value", "session" + "Key: not-a-real-value", "access" + "Id=not-a-real-value", "credentials" + ": {user: fake}", "private" + "Key: |", "nuget_api_" + "key=not-a-real-value", "oy2" + "a" * 44, "sk_test_" + "notarealcredentialvalue123456", "A1b2C3d4E5f6G7h8I9j0K_l-M+n/O=pQ2rS3tU4vW5xY6zZ7aB8cC9d", "AKIA" + "A" * 16, "AIza" + "a" * 35, "-----BEGIN OPENSSH " + "PRIVATE KEY-----", "ssh-ed25519 " + "bm90YXJlYWxjcmVkZW50aWFsdmFsdWU=", "eyJnotarealheader." + "notarealpayloadvalue." + "notarealsignature", ], ) @pytest.mark.parametrize("field", ["title", "body"]) def test_create_rejects_expanded_credential_shapes_before_network( sensitive: str, field: str ): client = _load() called = False request_built = False original_build_request = client.build_request def build_request(*args, **kwargs): nonlocal request_built request_built = True return original_build_request(*args, **kwargs) def opener(*_args, **_kwargs): nonlocal called called = True return Response(_draft_response()) client.build_request = build_request values = {"title": "Focused fix", "body": "Review evidence"} values[field] = sensitive with pytest.raises(client.PolicyError, match="credential material"): client.create_draft( "cassandra", base="main", head="hermes/fix", head_sha=HEAD_SHA, title=values["title"], body=values["body"], token="runtime-sentinel", opener=opener, ) assert request_built is False assert called is False def test_very_long_compact_body_is_rejected_before_request_or_network(): client = _load() request_built = False opener_called = False original_build_request = client.build_request def build_request(*args, **kwargs): nonlocal request_built request_built = True return original_build_request(*args, **kwargs) def opener(*_args, **_kwargs): nonlocal opener_called opener_called = True return Response(_draft_response()) client.build_request = build_request with pytest.raises(client.PolicyError, match="credential material"): client.create_draft( "cassandra", base="main", head="hermes/fix", head_sha=HEAD_SHA, title="Focused fix", body="a" * 300, token="runtime-sentinel", opener=opener, ) assert request_built is False assert opener_called is False @pytest.mark.parametrize( "safe_text", [ "AWS_SECRET_ACCESS_KEY is injected at runtime", "Token: reject empty values", "Authorization = preserve header behavior", "Password: add regression", "Review the Authorization header behavior", "Bearer authentication is required for this route", "Document Docker auths payload rejection", "The client_email field belongs to service accounts", "AccountKey assignments must be blocked", "This patch changes token validation without including a value", "FutureCloudSigningCredential handling needs a regression test", "The clientKey name is documented without an assigned value", "A SHA-256 digest 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef is evidence", ], ) def test_credential_policy_keeps_normal_engineering_prose_usable(safe_text: str): client = _load() assert client._validate_body(safe_text) == safe_text assert client._draft_title(safe_text) == f"WIP: {safe_text}" @pytest.mark.parametrize("field", ["title", "body"]) def test_create_rejects_exact_runtime_token_before_network(field: str): client = _load() called = False request_built = False original_build_request = client.build_request def build_request(*args, **kwargs): nonlocal request_built request_built = True return original_build_request(*args, **kwargs) def opener(*_args, **_kwargs): nonlocal called called = True return Response(_draft_response()) client.build_request = build_request runtime_token = "exact-random-runtime-sentinel-7b73ac61" values = {"title": "Focused fix", "body": "Review evidence"} values[field] = f"Accidental {runtime_token} value" with pytest.raises(client.PolicyError, match="runtime credential"): client.create_draft( "cassandra", base="main", head="hermes/fix", head_sha=HEAD_SHA, title=values["title"], body=values["body"], token=runtime_token, opener=opener, ) assert request_built is False assert called is False @pytest.mark.parametrize("field", ["repo", "base", "head", "title", "body"]) def test_every_public_field_rejects_exact_runtime_token_before_git_or_network( field: str, monkeypatch ): client = _load() git_called = False request_built = False opener_called = False runtime_token = "runtime-sentinel" values = { "repo": "cassandra", "base": "main", "head": "hermes/fix", "title": "Focused fix", "body": "Review evidence", } values[field] = runtime_token def git_run(*_args, **_kwargs): nonlocal git_called git_called = True raise AssertionError("Git must not run for a credential-bearing field") def build_request(*_args, **_kwargs): nonlocal request_built request_built = True raise AssertionError("a request must not be built") def opener(*_args, **_kwargs): nonlocal opener_called opener_called = True raise AssertionError("the opener must not be called") monkeypatch.setattr(client._validate_ref.__globals__["subprocess"], "run", git_run) monkeypatch.setattr(client, "build_request", build_request) with pytest.raises(client.PolicyError, match="runtime credential"): client.create_draft( values["repo"], base=values["base"], head=values["head"], head_sha=HEAD_SHA, title=values["title"], body=values["body"], token=runtime_token, opener=opener, ) assert git_called is False assert request_built is False assert opener_called is False @pytest.mark.parametrize( "sensitive", [ " ".join(["{}"] * 32) + ' {"client_secret":"synthetic-value"}', "prefix_ghp_notarealcredentialvalue123456_suffix", "client_secret: correct horse battery staple", "'client_secret':\n synthetic-value", ], ) @pytest.mark.parametrize("field", ["title", "body"]) def test_structured_scanner_closes_bounded_and_wrapped_token_bypasses( sensitive: str, field: str ): client = _load() values = {"title": "Focused fix", "body": "Review evidence"} values[field] = sensitive called = False def opener(*_args, **_kwargs): nonlocal called called = True return Response(_draft_response()) with pytest.raises(client.PolicyError, match="credential material"): client.create_draft( "cassandra", base="main", head="hermes/fix", head_sha=HEAD_SHA, title=values["title"], body=values["body"], token="runtime-sentinel", opener=opener, ) assert called is False @pytest.mark.parametrize("status", [200, 202, 204, 206]) def test_create_accepts_only_http_201(status: int): client = _load() with pytest.raises(client.PolicyError, match="unexpected HTTP status"): client.create_draft( "cassandra", base="main", head="hermes/fix", head_sha=HEAD_SHA, title="Focused fix", body="Review evidence", token="runtime", opener=lambda *_a, **_k: Response(_draft_response(), status=status), ) @pytest.mark.parametrize("status", [201, 202, 204, 206]) def test_read_accepts_only_http_200(status: int): client = _load() with pytest.raises(client.PolicyError, match="unexpected HTTP status"): client.read( "/api/v1/repos/atlas/cassandra", token="runtime", opener=lambda *_a, **_k: Response(b"{}", status=status), ) def test_successful_create_validates_each_ref_once(monkeypatch): client = _load() calls = [] def git_run(command, **_kwargs): calls.append(command) return type("Result", (), {"returncode": 0})() monkeypatch.setattr(client._validate_ref.__globals__["subprocess"], "run", git_run) client.create_draft( "cassandra", base="main", head="hermes/fix", head_sha=HEAD_SHA, title="Focused fix", body="Review evidence", token="runtime", opener=lambda *_a, **_k: Response(_draft_response()), ) assert [command[-1] for command in calls] == [ "refs/heads/main", "refs/heads/hermes/fix", ] def test_create_verifies_every_server_postcondition(): client = _load() calls = [] def opener(request, timeout): calls.append((request, timeout)) return Response(_draft_response()) result = client.create_draft( "cassandra", base="main", head="hermes/fix", head_sha=HEAD_SHA, title="Focused fix", body="Review evidence", token="runtime", opener=opener, ) assert json.loads(result) == _draft_response() payload = json.loads(calls[0][0].data) assert payload == { "base": "main", "body": "Review evidence", "head": "hermes/fix", "title": "WIP: Focused fix", } assert calls[0][1] == 30 def test_create_postcondition_rejects_every_material_mismatch(): client = _load() mutations = [ ("number", 0), ("number", 2_147_483_648), ("state", "closed"), ("draft", False), ("merged", True), ("html_url", "https://evil.example/pulls/3"), ("url", "https://evil.example/api/pulls/3"), ("title", "Focused fix"), ("body", "different"), ] documents = [] for key, value in mutations: document = _draft_response() document[key] = value documents.append(document) for path, value in [ (("base", "ref"), "master"), (("base", "repo", "full_name"), "evil/cassandra"), (("head", "ref"), "other"), (("head", "sha"), "0" * 40), (("head", "repo", "full_name"), "evil/cassandra"), ]: document = copy.deepcopy(_draft_response()) target = document for key in path[:-1]: target = target[key] target[path[-1]] = value documents.append(document) for document in documents: with pytest.raises(client.PolicyError): client._require_create_response( json.dumps(document).encode(), repo="cassandra", base="main", head="hermes/fix", head_sha=HEAD_SHA, title="WIP: Focused fix", body="Review evidence", ) def test_read_response_is_bounded(): client = _load() with pytest.raises(client.PolicyError, match="safe size limit"): client.read( "/api/v1/repos/atlas/cassandra", token="runtime", opener=lambda *_a, **_k: Response(b"x" * (client.MAX_RESPONSE_BYTES + 1)), ) def test_direct_api_rejects_unexpected_success_content_type(): client = _load() response = Response(b"{}") response.headers.replace_header("Content-Type", "text/html") with pytest.raises(client.PolicyError, match="unexpected response type"): client.read( "/api/v1/repos/atlas/cassandra", token="runtime", opener=lambda *_a, **_k: response, ) def test_output_redaction_covers_exact_token_and_authorization_header(): client = _load() raw = b'{"message":"do-not-leak","debug":"Authorization: token do-not-leak"}' redacted = client.redact_bytes(raw, "do-not-leak") assert b"do-not-leak" not in redacted assert redacted.count(b"[REDACTED]") >= 1 @pytest.mark.parametrize( "reflected", [ b"runtime-sentinel", base64.b64encode(b"runtime-sentinel"), base64.b64encode(b"hermes-automation:runtime-sentinel"), ], ) def test_direct_api_rejects_credential_reflection(reflected: bytes): client = _load() with pytest.raises(client.PolicyError, match="credential material"): client.read( "/api/v1/repos/atlas/cassandra", token="runtime-sentinel", opener=lambda *_a, **_k: Response( b'{"unexpected":"' + reflected + b'"}' ), )