75 lines
3.1 KiB
Python
75 lines
3.1 KiB
Python
"""A11: whole-tree audit_log single-writer scan assertion.
|
|
|
|
Extends the pre-existing ``NoAuditBypassTestCase`` in
|
|
``test_audit_automations_chain.py`` (which only scanned
|
|
``cloud/*.py`` at the top level) to the whole tree: every
|
|
``.py`` file under the repository root is scanned for a
|
|
direct audit_log insert code form, except the test fixtures
|
|
themselves.
|
|
|
|
Scope and exclusions, stated so a future red test is readable:
|
|
|
|
- Production code: exactly one hit is allowed, ``cloud/auth.py``
|
|
(``audit_on_conn``, the unified port; ``AuthStore.audit`` is
|
|
that function plus a commit/retry wrapper, not a second write
|
|
path). Any new production hit -- any module, any subdirectory
|
|
(``cloud/skills/...``, ``tools/``, ``deploy/``, ``host.py``,
|
|
top level) -- turns this test red.
|
|
- Test fixtures excluded: ``cloud/tests/test_tamper_ledger.py``
|
|
(tamper simulation) and ``cloud/tests/test_chat_history.py``
|
|
(legacy-row simulation) deliberately insert audit_log rows
|
|
into throwaway databases, and
|
|
``cloud/tests/test_automation_run_due.py`` (a fake PG
|
|
connection whose ``execute`` matches intercepted audit_log
|
|
SQL strings and records params in memory -- it executes no
|
|
SQL at all). They are fixtures, not production writes, and
|
|
were already documented as out of scope by the pre-existing
|
|
test. They are listed by name here, not by a broad ``tests/``
|
|
exclusion, so a new test file that starts writing audit_log
|
|
directly would still turn this red.
|
|
- No pending production direct-write points were found at the
|
|
time this test was added (2026-11-02): the full-tree scan
|
|
returned only ``cloud/auth.py`` in production code. If a
|
|
future scan finds one, do NOT silently fix production code
|
|
under this test's name and do NOT land a red test: record
|
|
the point in the delivery report and route the fix to its
|
|
own batch.
|
|
"""
|
|
|
|
import re
|
|
import unittest
|
|
from pathlib import Path
|
|
|
|
_PATTERN = re.compile(r"INSERT\s+INTO\s+audit_log", re.IGNORECASE)
|
|
# Fixture files that deliberately insert audit_log rows into
|
|
# throwaway test databases (see module docstring).
|
|
_FIXTURE_FILES = {
|
|
"cloud/tests/test_tamper_ledger.py",
|
|
"cloud/tests/test_chat_history.py",
|
|
"cloud/tests/test_automation_run_due.py",
|
|
}
|
|
|
|
|
|
class AuditLogSingleWriterTestCase(unittest.TestCase):
|
|
def test_only_auth_writes_audit_log_tree_wide(self):
|
|
repo_root = Path(__file__).resolve().parents[2]
|
|
offenders = []
|
|
for path in sorted(repo_root.rglob("*.py")):
|
|
rel = path.relative_to(repo_root).as_posix()
|
|
if rel in _FIXTURE_FILES:
|
|
continue
|
|
# Skip nothing else: .git contains no .py files, and
|
|
# a work/host-worktrees checkout (if present) is a
|
|
# separate worktree's copy of the code, not this
|
|
# tree's production code.
|
|
if rel.startswith("work/host-worktrees/"):
|
|
continue
|
|
text = path.read_text(encoding="utf-8", errors="replace")
|
|
if _PATTERN.search(text):
|
|
offenders.append(rel)
|
|
self.assertEqual(offenders, ["cloud/auth.py"])
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|