62 lines
2.4 KiB
Python
62 lines
2.4 KiB
Python
from __future__ import annotations
|
|
|
|
import pathlib
|
|
import tomllib
|
|
import unittest
|
|
|
|
from govoplan_audit.backend.manifest import get_manifest
|
|
|
|
|
|
ROOT = pathlib.Path(__file__).resolve().parents[1]
|
|
|
|
|
|
class AuditModuleContractTests(unittest.TestCase):
|
|
def test_audit_package_does_not_hard_require_access(self) -> None:
|
|
project = tomllib.loads((ROOT / "pyproject.toml").read_text(encoding="utf-8"))["project"]
|
|
dependencies = tuple(project["dependencies"])
|
|
|
|
self.assertTrue(any(item.startswith("govoplan-core>=") for item in dependencies))
|
|
self.assertFalse(any(item.startswith("govoplan-access") for item in dependencies))
|
|
|
|
def test_audit_source_does_not_import_access_implementation(self) -> None:
|
|
offenders: list[str] = []
|
|
for path in (ROOT / "src" / "govoplan_audit").rglob("*.py"):
|
|
source = path.read_text(encoding="utf-8")
|
|
if "govoplan_access" in source:
|
|
offenders.append(str(path.relative_to(ROOT)))
|
|
|
|
self.assertEqual([], offenders)
|
|
|
|
def test_audit_documentation_declares_admin_help_contexts(self) -> None:
|
|
topics = {topic.id: topic for topic in get_manifest().documentation}
|
|
|
|
evidence = topics["audit.read-authorized-evidence"]
|
|
self.assertIn("audit.admin.system", evidence.metadata["help_contexts"])
|
|
self.assertIn("audit.admin.tenant", evidence.metadata["help_contexts"])
|
|
self.assertEqual(
|
|
["audit.admin.system", "audit.admin.tenant"],
|
|
evidence.metadata["surfaces"],
|
|
)
|
|
operations = topics["audit.recording-retention-and-outbox"]
|
|
self.assertIn("audit.retention", operations.metadata["help_contexts"])
|
|
|
|
def test_evidence_export_permissions_are_module_owned_and_scope_separated(self) -> None:
|
|
manifest = get_manifest()
|
|
permissions = {item.scope: item for item in manifest.permissions}
|
|
|
|
self.assertEqual("tenant", permissions["audit:evidence:export"].level)
|
|
self.assertEqual("system", permissions["audit:system_evidence:export"].level)
|
|
roles = {item.slug: item for item in manifest.role_templates}
|
|
self.assertIn(
|
|
"audit:evidence:export",
|
|
roles["audit_evidence_exporter"].permissions,
|
|
)
|
|
self.assertIn(
|
|
"audit:system_evidence:export",
|
|
roles["audit_system_evidence_exporter"].permissions,
|
|
)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|