host
e32391fd85
(cherry picked from commit 633cdbc94e7a7b0c5d3b0b135189faf3de6673f4) Reconcile-port: handler_admin.py hunks redirected into cloud/server.py _audit_scorecard (target keeps 6-mixin split; scorecard module itself applied cleanly).
240 lines
9.9 KiB
Python
240 lines
9.9 KiB
Python
"""7 维审计评分卡定向测试。
|
|
|
|
钉住的规则（任何一处改动都必须先改文档再改测试）：
|
|
- 7 维全部 >=9 才达标；任一维 <9 总体不达标。
|
|
- 平均分绝不能作为达标依据：6 维 10 分、1 维 4 分，平均 9.1 分，
|
|
总体仍是不达标。
|
|
- 未知维记 None 且总体不达标；未知不记 0、不记 10、不估算。
|
|
- 夹具/视口替代/代码评审证据记未实测，不算通过。
|
|
- 阈值默认值标注 test_default_unapproved；只有调用方显式传入
|
|
user_approved 才算已拍板。
|
|
- 端点只读：GET /audit-scorecard 不写库、不写账本、不改链头。
|
|
"""
|
|
|
|
import http.client
|
|
import json
|
|
import os
|
|
import sys
|
|
import tempfile
|
|
import threading
|
|
import unittest
|
|
from pathlib import Path
|
|
|
|
try:
|
|
from cloud.audit_scorecard import (
|
|
DEFAULT_THRESHOLDS, build_scorecard, example_scorecard_as_of_2026_10_31)
|
|
from cloud.auth import AuthStore
|
|
from cloud.server import create_server
|
|
except ImportError:
|
|
sys.path.insert(0, str(Path(__file__).resolve().parents[2]))
|
|
from cloud.audit_scorecard import (
|
|
DEFAULT_THRESHOLDS, build_scorecard, example_scorecard_as_of_2026_10_31)
|
|
from cloud.auth import AuthStore
|
|
from cloud.server import create_server
|
|
|
|
|
|
def _full_evidence():
|
|
return {
|
|
"delivery_quality": {
|
|
"first_pass_rate": 0.96, "defect_rate": 0.01,
|
|
"rework_rate": 0.04, "first_pass_known": True,
|
|
"defect_known": True, "rework_known": True,
|
|
"attempts_present": True, "evidence_kind": "real",
|
|
},
|
|
"gate_audit": {
|
|
"hard_gate_enforced": True, "gate_items_passed": 5,
|
|
"gate_items_total": 5, "merge_blocked_verified": True,
|
|
"loop_end_to_end_verified": True,
|
|
"sampling_misjudgment_rate": 0.0,
|
|
},
|
|
"arch_contract": {
|
|
"contract_frozen": True, "arch_violations": 0,
|
|
"directory_violations": 0, "import_violations": 0,
|
|
"stack_changed_without_approval": False,
|
|
},
|
|
"test_coverage": {
|
|
"prd_coverage_rate": 1.0, "cross_matrix_coverage_rate": 1.0,
|
|
"coverage_pct": 0.92, "cross_matrix_kind": "real",
|
|
"real_pg": True, "real_service": True,
|
|
"agent_six_complete": True,
|
|
"lint_items": 0, "mypy_items": 0, "bandit_high": 0,
|
|
},
|
|
"security_ledger": {
|
|
"ledger_verify_ok": True, "ledger_coverage_rate": 1.0,
|
|
"branch_protection": "protected",
|
|
"shell_whitelist_pass_rate": 1.0, "anchor_check_recent": True,
|
|
},
|
|
"cost_quota": {
|
|
"cost_records_complete": True, "unpriced_as_zero": False,
|
|
"per_creator_present": True, "quota_cutoff_verified": True,
|
|
},
|
|
"ops_scale": {
|
|
"ci_green_rate": 1.0, "deploy_success_rate": 1.0,
|
|
"rollback_drill_done": True, "ha_status": "second_host",
|
|
"parallel_scale_proven": 40,
|
|
},
|
|
}
|
|
|
|
|
|
class ScorecardTestCase(unittest.TestCase):
|
|
def test_all_nine_passes(self):
|
|
report = build_scorecard(_full_evidence())
|
|
self.assertEqual(report["overall"], "pass")
|
|
self.assertTrue(report["overall_pass"])
|
|
self.assertEqual(len(report["dimensions"]), 7)
|
|
for dim in report["dimensions"]:
|
|
self.assertIsNotNone(dim["score"])
|
|
self.assertGreaterEqual(dim["score"], 9.0)
|
|
self.assertEqual(dim["status"], "pass")
|
|
|
|
def test_one_dimension_below_nine_fails_overall(self):
|
|
ev = _full_evidence()
|
|
ev["gate_audit"]["hard_gate_enforced"] = False
|
|
report = build_scorecard(ev)
|
|
self.assertEqual(report["overall"], "not_pass")
|
|
self.assertFalse(report["overall_pass"])
|
|
gate = [d for d in report["dimensions"] if d["id"] == "gate_audit"][0]
|
|
self.assertEqual(gate["score"], 4.0)
|
|
|
|
def test_average_91_with_one_four_still_fails(self):
|
|
# 6 维 10 分、1 维 4 分：平均 9.1 分，总体仍是不达标。
|
|
# 构造方式：只让门禁维已知未强制（4.0），其余维满分证据。
|
|
ev = _full_evidence()
|
|
ev["gate_audit"]["hard_gate_enforced"] = False
|
|
report = build_scorecard(ev)
|
|
self.assertEqual(report["average_score"], 9.1)
|
|
self.assertTrue(report["average_is_not_pass_criterion"])
|
|
self.assertEqual(report["overall"], "not_pass")
|
|
self.assertFalse(report["overall_pass"])
|
|
|
|
def test_unknown_dimension_is_none_and_fails_overall(self):
|
|
report = build_scorecard({})
|
|
self.assertEqual(report["overall"], "not_pass")
|
|
for dim in report["dimensions"]:
|
|
self.assertIsNone(dim["score"])
|
|
self.assertEqual(dim["status"], "unknown")
|
|
self.assertTrue(report["missing_items"])
|
|
self.assertIsNone(report["average_score"])
|
|
|
|
def test_unknown_is_not_zero_and_not_ten(self):
|
|
ev = _full_evidence()
|
|
ev["delivery_quality"] = {}
|
|
report = build_scorecard(ev)
|
|
dim = [d for d in report["dimensions"]
|
|
if d["id"] == "delivery_quality"][0]
|
|
self.assertIsNone(dim["score"])
|
|
self.assertNotEqual(dim["score"], 0)
|
|
self.assertNotEqual(dim["score"], 10)
|
|
|
|
def test_fixture_evidence_is_untested_not_pass(self):
|
|
ev = _full_evidence()
|
|
ev["test_coverage"]["cross_matrix_kind"] = "viewport_substitute"
|
|
report = build_scorecard(ev)
|
|
dim = [d for d in report["dimensions"]
|
|
if d["id"] == "test_coverage"][0]
|
|
self.assertIsNone(dim["score"])
|
|
self.assertEqual(dim["status"], "unknown")
|
|
self.assertTrue(dim["untested_items"])
|
|
self.assertEqual(report["overall"], "not_pass")
|
|
|
|
def test_conditional_verdict_is_not_pass(self):
|
|
ev = _full_evidence()
|
|
ev["gate_audit"]["audit_verdict"] = "conditional"
|
|
report = build_scorecard(ev)
|
|
dim = [d for d in report["dimensions"] if d["id"] == "gate_audit"][0]
|
|
self.assertIsNone(dim["score"])
|
|
self.assertTrue(dim["untested_items"])
|
|
|
|
def test_threshold_defaults_are_unapproved(self):
|
|
for entry in DEFAULT_THRESHOLDS.values():
|
|
self.assertEqual(entry["source"], "test_default_unapproved")
|
|
report = build_scorecard(_full_evidence())
|
|
self.assertEqual(report["thresholds_source"],
|
|
"test_default_unapproved")
|
|
|
|
def test_user_approved_thresholds_change_source_only(self):
|
|
th = {k: {"value": v["value"], "source": "user_approved"}
|
|
for k, v in DEFAULT_THRESHOLDS.items()}
|
|
report = build_scorecard(_full_evidence(), thresholds=th)
|
|
self.assertEqual(report["thresholds_source"], "user_approved")
|
|
self.assertEqual(report["overall"], "pass")
|
|
|
|
def test_example_current_state_is_not_pass_and_not_estimated(self):
|
|
# 示例是系统用当前真实状态证据算出来的，不是上一轮判断分。
|
|
report = example_scorecard_as_of_2026_10_31()
|
|
self.assertEqual(report["overall"], "not_pass")
|
|
self.assertFalse(report["overall_pass"])
|
|
# 时效标注：示例卡是 2026-10-31 快照，不是当前系统得分。
|
|
self.assertEqual(report["evidence_as_of"], "2026-10-31")
|
|
self.assertEqual(report["evidence_kind"],
|
|
"historical_example_snapshot")
|
|
self.assertTrue(report["not_current_system_score"])
|
|
self.assertEqual(report["thresholds_source"],
|
|
"test_default_unapproved")
|
|
# 至少有一维是未知（None），且总体不达标不靠平均分。
|
|
self.assertTrue(any(d["score"] is None
|
|
for d in report["dimensions"]))
|
|
|
|
|
|
class ScorecardEndpointTestCase(unittest.TestCase):
|
|
def setUp(self):
|
|
self.tmp = tempfile.TemporaryDirectory()
|
|
self.db_path = os.path.join(self.tmp.name, "control.db")
|
|
self.auth = AuthStore(self.db_path)
|
|
self.owner_id, self.owner_key = self.auth.create_user("owner")
|
|
self.server = create_server(self.db_path, "127.0.0.1", 0)
|
|
self.port = self.server.server_address[1]
|
|
self.thread = threading.Thread(
|
|
target=self.server.serve_forever, daemon=True)
|
|
self.thread.start()
|
|
|
|
def tearDown(self):
|
|
self.server.shutdown()
|
|
self.server.server_close()
|
|
self.thread.join(timeout=5)
|
|
try:
|
|
self.auth.conn.close()
|
|
except Exception:
|
|
pass
|
|
self.tmp.cleanup()
|
|
|
|
def _req(self, method, path, key=None):
|
|
conn = http.client.HTTPConnection("127.0.0.1", self.port, timeout=10)
|
|
hdrs = {}
|
|
if key is not None:
|
|
hdrs["X-API-Key"] = key
|
|
try:
|
|
conn.request(method, path, headers=hdrs)
|
|
resp = conn.getresponse()
|
|
data = resp.read()
|
|
finally:
|
|
conn.close()
|
|
try:
|
|
parsed = json.loads(data.decode("utf-8")) if data else None
|
|
except ValueError:
|
|
parsed = None
|
|
return resp.status, parsed
|
|
|
|
def test_endpoint_requires_auth(self):
|
|
status, _ = self._req("GET", "/audit-scorecard")
|
|
self.assertEqual(status, 401)
|
|
|
|
def test_endpoint_is_readonly_and_not_pass_on_main_base(self):
|
|
status, report = self._req("GET", "/audit-scorecard",
|
|
key=self.owner_key)
|
|
self.assertEqual(status, 200)
|
|
self.assertEqual(len(report["dimensions"]), 7)
|
|
self.assertEqual(report["overall"], "not_pass")
|
|
self.assertTrue(report["average_is_not_pass_criterion"])
|
|
self.assertEqual(report["thresholds_source"],
|
|
"test_default_unapproved")
|
|
# 只读：端点调用前后，库里不产生评分卡表（本端点不写库）。
|
|
import sqlite3
|
|
conn = sqlite3.connect(self.db_path)
|
|
try:
|
|
tables = {r[0] for r in conn.execute(
|
|
"SELECT name FROM sqlite_master WHERE type='table'")}
|
|
finally:
|
|
conn.close()
|
|
self.assertNotIn("audit_scorecard", tables)
|