mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-11-13 01:48:17 +00:00
77 lines
3.0 KiB
Python
77 lines
3.0 KiB
Python
"""Validation tests for detection-core tasks 7.1-7.2 (Req 5, 7, 11, 12)."""
|
|
|
|
import json
|
|
import sys
|
|
from pathlib import Path
|
|
|
|
sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
|
|
|
|
from openultrasast.core.admission import AdmissionManifestError, validate_report_schema # noqa: E402
|
|
from openultrasast.core.consumer import PushRequest, consume_verdict # noqa: E402
|
|
from openultrasast.core.verdict import Judgment, ProvenClaim # noqa: E402
|
|
from openultrasast.semantic.obligations.abstract_domain import ( # noqa: E402
|
|
AuthorityRef,
|
|
Completeness,
|
|
EvidenceRelation,
|
|
PairJudgment,
|
|
PathJudgment,
|
|
ResourceRef,
|
|
WitnessMatch,
|
|
)
|
|
from openultrasast.semantic.obligations.core_adapter import to_legacy_trace_record # noqa: E402
|
|
from openultrasast.semantic.obligations.trace import AbstractTraceState, Trace # noqa: E402
|
|
|
|
REPO = Path(__file__).resolve().parents[1]
|
|
|
|
|
|
def test_committed_admission_report_satisfies_schema() -> None:
|
|
report = json.loads((REPO / "benchmarks/measurements/2026-10-30-access-control-admission/report.json").read_text(encoding="utf-8"))
|
|
validate_report_schema(report)
|
|
|
|
|
|
def test_schema_validator_refuses_incomplete_report() -> None:
|
|
report = json.loads((REPO / "benchmarks/measurements/2026-10-30-access-control-admission/report.json").read_text(encoding="utf-8"))
|
|
del report["precision"]
|
|
try:
|
|
validate_report_schema(report)
|
|
raise AssertionError("report missing precision must be refused")
|
|
except AdmissionManifestError:
|
|
pass
|
|
|
|
|
|
def test_end_to_end_push_through_core_contracts() -> None:
|
|
state = AbstractTraceState(
|
|
path_judgment=PathJudgment(
|
|
judgment=PairJudgment.UNGUARDED,
|
|
missing=("identity_constraint",),
|
|
completeness=Completeness(is_complete=True, reasons=()),
|
|
matches=(WitnessMatch(EvidenceRelation.MUST, EvidenceRelation.MUST, EvidenceRelation.NO, ("fact:f",)),),
|
|
),
|
|
resource=ResourceRef(kind="exact", values=("credentials",)),
|
|
authority=AuthorityRef(values=("admin",), is_unknown=False),
|
|
resource_relation=EvidenceRelation.MUST,
|
|
authority_relation=EvidenceRelation.MUST,
|
|
)
|
|
trace = Trace(
|
|
entry_kind="route",
|
|
boundary="request",
|
|
access="public",
|
|
parameters=("request",),
|
|
hops=(),
|
|
operation_kind="protected_read",
|
|
fact_id="obligation:protected_read:src/app.py:30",
|
|
operation_line=30,
|
|
arguments=(),
|
|
guards_after=(),
|
|
requires=("identity_constraint",),
|
|
dominating=(),
|
|
missing="identity_constraint",
|
|
abstract_state=state,
|
|
)
|
|
record = to_legacy_trace_record(trace, entry="src/app.py::handler", digests={"input": "abc123"})
|
|
claim = ProvenClaim(trace_id="t1", witness="fact:f", path="src/app.py", line=30, family="access_control")
|
|
verdict = consume_verdict(PushRequest(base="b", head="h", budget_class="dev-pool"), record, (claim,), ())
|
|
assert verdict.claims[0].witness == "fact:f"
|
|
assert record.judgment is Judgment.UNGUARDED
|
|
assert record.canonical() == record.canonical()
|