108 lines
4.1 KiB
Python
108 lines
4.1 KiB
Python
from __future__ import annotations
|
|
|
|
import unittest
|
|
|
|
from sqlalchemy import create_engine
|
|
from sqlalchemy.orm import Session
|
|
|
|
from govoplan_policy.backend.campaign_archive_encryption import (
|
|
CampaignArchiveEncryptionPolicyError,
|
|
campaign_archive_encryption_policy_state,
|
|
resolve_campaign_archive_encryption_rows,
|
|
save_campaign_archive_encryption_policy,
|
|
)
|
|
from govoplan_policy.backend.db.models import PolicyOverride
|
|
|
|
|
|
class CampaignArchiveEncryptionPolicyTests(unittest.TestCase):
|
|
def setUp(self) -> None:
|
|
self.engine = create_engine("sqlite:///:memory:")
|
|
PolicyOverride.__table__.create(self.engine)
|
|
|
|
def test_secure_default_denies_legacy(self) -> None:
|
|
decision = resolve_campaign_archive_encryption_rows(())
|
|
|
|
self.assertEqual(frozenset({"aes"}), decision.allowed_password_encryption_methods)
|
|
self.assertNotIn("zip_standard", decision.allowed_password_encryption_methods)
|
|
self.assertEqual("system", decision.source_path[0].path)
|
|
self.assertTrue(decision.policy_hash)
|
|
|
|
def test_child_scope_can_narrow_but_not_loosen_parent(self) -> None:
|
|
with Session(self.engine) as session:
|
|
save_campaign_archive_encryption_policy(
|
|
session,
|
|
tenant_id="tenant-1",
|
|
scope_type="system",
|
|
scope_id=None,
|
|
owner_type=None,
|
|
owner_id=None,
|
|
policy={"allowed_password_encryption_methods": ["aes", "zip_standard"]},
|
|
actor_id="admin",
|
|
)
|
|
tenant = save_campaign_archive_encryption_policy(
|
|
session,
|
|
tenant_id="tenant-1",
|
|
scope_type="tenant",
|
|
scope_id=None,
|
|
owner_type=None,
|
|
owner_id=None,
|
|
policy={"allowed_password_encryption_methods": ["aes"]},
|
|
actor_id="admin",
|
|
)
|
|
self.assertEqual(
|
|
frozenset({"aes"}),
|
|
tenant.effective.allowed_password_encryption_methods,
|
|
)
|
|
|
|
with self.assertRaises(CampaignArchiveEncryptionPolicyError):
|
|
save_campaign_archive_encryption_policy(
|
|
session,
|
|
tenant_id="tenant-1",
|
|
scope_type="user",
|
|
scope_id="owner-1",
|
|
owner_type=None,
|
|
owner_id=None,
|
|
policy={"allowed_password_encryption_methods": ["aes", "zip_standard"]},
|
|
actor_id="admin",
|
|
)
|
|
|
|
def test_owner_and_campaign_sources_are_complete(self) -> None:
|
|
with Session(self.engine) as session:
|
|
for scope_type, scope_id, methods in (
|
|
("system", None, ["aes", "zip_standard"]),
|
|
("tenant", None, ["aes", "zip_standard"]),
|
|
("group", "owner-group", ["aes", "zip_standard"]),
|
|
("campaign", "campaign-1", ["aes"]),
|
|
):
|
|
save_campaign_archive_encryption_policy(
|
|
session,
|
|
tenant_id="tenant-1",
|
|
scope_type=scope_type,
|
|
scope_id=scope_id,
|
|
owner_type="group" if scope_type == "campaign" else None,
|
|
owner_id="owner-group" if scope_type == "campaign" else None,
|
|
policy={"allowed_password_encryption_methods": methods},
|
|
actor_id="admin",
|
|
)
|
|
state = campaign_archive_encryption_policy_state(
|
|
session,
|
|
tenant_id="tenant-1",
|
|
scope_type="campaign",
|
|
scope_id="campaign-1",
|
|
owner_type="group",
|
|
owner_id="owner-group",
|
|
)
|
|
|
|
self.assertEqual(
|
|
["system", "tenant", "group", "campaign"],
|
|
[step.scope_type for step in state.effective.source_path],
|
|
)
|
|
self.assertEqual(
|
|
frozenset({"aes"}),
|
|
state.effective.allowed_password_encryption_methods,
|
|
)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|