Publish curated ITWorx_MCP_Hub source from 5d65966d0393e868ed5df1d95a21412a4c587d78

tests/test_wp160_security.py

@@ -1,9 +1,12 @@
 from __future__ import annotations
 
 import json
+import shutil
+import subprocess
 import tempfile
 import unittest
 from pathlib import Path
+from unittest.mock import patch
 from uuid import uuid4
 
 from packages.connector_kit.gitea import GiteaSettings
@@ -16,7 +19,12 @@ from packages.connector_kit.knowledge import (
 from packages.connector_kit.redaction import safe_content
 from packages.hub_contracts.dataplane import AliasRecord
 from scripts.generate_sbom import generate
-from scripts.security_scan import _BEARER, scan_repository
+from scripts.security_scan import (
+    _BEARER,
+    _tracked_text_files,
+    scan_repository,
+    scan_secret_patterns,
+)
 from services.control_api.catalog.models import CatalogState
 from services.control_api.catalog.planner import build_plan
 from services.control_api.contextforge.models import GatewayDesiredState, GatewaySnapshot
@@ -34,6 +42,44 @@ class SecurityPlanTests(unittest.TestCase):
         self.assertEqual(report["secrets"]["findings"], [])
         self.assertTrue(report["invariants"]["denyByDefault"])
 
+    def test_secret_scan_ignores_untracked_scratch_checkout_files(self) -> None:
+        with tempfile.TemporaryDirectory() as directory:
+            repository = Path(directory)
+            git = shutil.which("git")
+            self.assertIsNotNone(git)
+            assert git is not None
+            subprocess.run([git, "init", "--quiet"], cwd=repository, check=True)  # noqa: S603
+            tracked = repository / "tracked.md"
+            tracked.write_text("ordinary tracked documentation\n", encoding="utf-8")
+            subprocess.run([git, "add", "tracked.md"], cwd=repository, check=True)  # noqa: S603
+            tracked_secret = repository / "tracked-secret.md"
+            tracked_secret.write_text(
+                'password = "tracked-sensitive-value-9283746501"\n', encoding="utf-8"
+            )
+            subprocess.run([git, "add", "tracked-secret.md"], cwd=repository, check=True)  # noqa: S603
+            scratch = repository / ".tmp" / "source-checkout"
+            scratch.mkdir(parents=True)
+            (scratch / "ignored.md").write_text(
+                'password = "untracked-sensitive-value-9283746501"\n', encoding="utf-8"
+            )
+
+            with patch("scripts.security_scan.ROOT", repository):
+                self.assertCountEqual(_tracked_text_files(), [tracked, tracked_secret])
+                findings = scan_secret_patterns()["findings"]
+                self.assertEqual(len(findings), 1)
+                self.assertEqual(findings[0]["path"], "tracked-secret.md")
+
+    def test_git_enumeration_failure_fails_closed(self) -> None:
+        error = subprocess.CalledProcessError(2, ["git", "ls-files", "-z"])
+        with patch("scripts.security_scan.subprocess.run", side_effect=error):
+            with self.assertRaises(subprocess.CalledProcessError):
+                _tracked_text_files()
+
+    def test_missing_git_fails_closed(self) -> None:
+        with patch("scripts.security_scan.shutil.which", return_value=None):
+            with self.assertRaises(FileNotFoundError):
+                _tracked_text_files()
+
     def test_sbom_is_deterministic_and_contains_locked_dependencies_and_images(self) -> None:
         report = generate()
         self.assertEqual(report["bomFormat"], "CycloneDX")