Files

137 lines
4.1 KiB
Python

from __future__ import annotations
import json
from pathlib import Path
import pytest
from tools.magic_patch import cli as magicpatch
from tools.magic_patch import verifier
def _executable(path: Path, body: str) -> Path:
path.write_text("#!/usr/bin/env python3\n" + body)
path.chmod(0o755)
return path
def test_auto_mode_is_optional_when_no_verifier_is_installed(
monkeypatch: pytest.MonkeyPatch,
) -> None:
monkeypatch.setattr(verifier, "resolve_executable", lambda configured: None)
result = verifier.verify(
mode="auto",
configured=None,
pack=Path("pack"),
source=Path("source"),
core_root=None,
python_executable=Path("python"),
timeout_seconds=10,
)
assert result.status == "unavailable"
assert not result.passed
def test_required_mode_fails_before_an_agent_is_started(
tmp_path: Path,
monkeypatch: pytest.MonkeyPatch,
) -> None:
source = tmp_path / "pack"
source.mkdir()
monkeypatch.setattr(verifier, "resolve_executable", lambda configured: None)
config = magicpatch.ConversionConfig(
source=source,
output=tmp_path / "output",
provider="codex",
source_sha="0123456789abcdef",
sandbox_verification="required",
)
with pytest.raises(
magicpatch.MagicPatchError, match="needs comfy-secure-verify-pack"
):
magicpatch._preflight(config)
def test_external_verifier_receives_a_versioned_request_and_returns_evidence(
tmp_path: Path,
) -> None:
request_copy = tmp_path / "observed-request.json"
executable = _executable(
tmp_path / "verifier",
"import argparse, json\n"
"from pathlib import Path\n"
"parser = argparse.ArgumentParser()\n"
"parser.add_argument('--request', required=True)\n"
"parser.add_argument('--output', required=True)\n"
"args = parser.parse_args()\n"
"request = json.loads(Path(args.request).read_text())\n"
f"Path({str(request_copy)!r}).write_text(json.dumps(request))\n"
"Path(args.output).write_text(json.dumps({\n"
f" 'format': {verifier.RESULT_FORMAT!r},\n"
" 'verifier': 'test-seatbelt',\n"
" 'status': 'passed',\n"
" 'checks': ['guest import', 'network denied'],\n"
" 'errors': [],\n"
"}))\n",
)
pack = tmp_path / "pack"
source = tmp_path / "source"
pack.mkdir()
source.mkdir()
result = verifier.verify(
mode="auto",
configured=executable,
pack=pack,
source=source,
core_root=None,
python_executable=Path("/usr/bin/python3"),
timeout_seconds=10,
)
request = json.loads(request_copy.read_text())
assert request["format"] == verifier.REQUEST_FORMAT
assert request["pack"] == str(pack.resolve())
assert request["source"] == str(source.resolve())
assert result.status == "passed"
assert result.checks == ("guest import", "network denied")
def test_an_installed_verifier_failure_is_not_silently_ignored(tmp_path: Path) -> None:
executable = _executable(
tmp_path / "verifier",
"import argparse, json\n"
"from pathlib import Path\n"
"parser = argparse.ArgumentParser()\n"
"parser.add_argument('--request', required=True)\n"
"parser.add_argument('--output', required=True)\n"
"args = parser.parse_args()\n"
"Path(args.output).write_text(json.dumps({\n"
f" 'format': {verifier.RESULT_FORMAT!r},\n"
" 'verifier': 'test-seatbelt',\n"
" 'status': 'failed',\n"
" 'checks': ['guest import'],\n"
" 'errors': ['network access unexpectedly succeeded'],\n"
"}))\n",
)
pack = tmp_path / "pack"
source = tmp_path / "source"
pack.mkdir()
source.mkdir()
result = verifier.verify(
mode="auto",
configured=executable,
pack=pack,
source=source,
core_root=None,
python_executable=Path("/usr/bin/python3"),
timeout_seconds=10,
)
assert result.status == "failed"
assert result.errors == ("network access unexpectedly succeeded",)