Initial curated ITWorx_MCP_Hub source from 368fba691ea8d23403b4d56b53b5ec670d7c5020

tests/test_codex_operational_scripts.py

@@ -0,0 +1,81 @@
+from __future__ import annotations
+
+import ast
+import subprocess
+import sys
+from pathlib import Path
+
+ROOT = Path(__file__).parents[1]
+
+
+def test_authentik_payload_is_valid_python_and_never_prints_secret() -> None:
+    path = ROOT / "scripts" / "authentik_provision_mcp_service_account.py"
+    source = path.read_text(encoding="utf-8")
+    ast.parse(source)
+    assert "INTENT_APP_PASSWORD" in source
+    assert '"subject": str(user.uuid)' in source
+    assert "print(secret" not in source
+    assert '"key": secret' in source
+
+
+def test_codex_installer_uses_stdio_bridge_and_secret_reference_only() -> None:
+    source = (ROOT / "scripts" / "install_codex_mcp.ps1").read_text(encoding="utf-8")
+    assert "mcp_stdio_bridge.py" in source
+    assert "--client-secret-file" in source
+    assert "mcp', 'add'" in source
+    assert "Secret file ACL must grant only" in source
+    assert "Secret file must already be owned" in source
+    assert "SetOwner" not in source
+    assert "Set-Acl" not in source
+    assert "Get-Content" not in source
+    assert "WriteAllText" not in source
+
+
+def test_stdio_bridge_starts_outside_repository_working_directory(tmp_path: Path) -> None:
+    result = subprocess.run(  # noqa: S603
+        [sys.executable, str(ROOT / "scripts" / "mcp_stdio_bridge.py"), "--help"],
+        cwd=tmp_path,
+        capture_output=True,
+        check=False,
+        text=True,
+        timeout=60,
+    )
+    assert result.returncode == 0, result.stderr
+    assert "ITWorx MCP stdio bridge" in result.stdout
+
+
+def test_machine_client_provisioner_imports_outside_repository(tmp_path: Path) -> None:
+    result = subprocess.run(  # noqa: S603
+        [
+            sys.executable,
+            str(ROOT / "scripts" / "provision_machine_client.py"),
+            "--issuer",
+            "https://auth.itworx.test/application/o/hub/",
+            "--subject",
+            "fixture-subject",
+            "--oauth-username",
+            "svc-fixture",
+            "--name",
+            "Fixture",
+            "--project",
+            "fixture",
+            "--database-url",
+            "sqlite:///:memory:",
+        ],
+        cwd=tmp_path,
+        capture_output=True,
+        check=False,
+        text=True,
+        timeout=60,
+    )
+    assert result.returncode == 1
+    assert "ModuleNotFoundError" not in result.stderr
+
+
+def test_credential_generator_uses_csprng_and_user_only_acl() -> None:
+    source = (ROOT / "scripts" / "new_codex_credential.ps1").read_text(encoding="utf-8")
+    assert "RandomNumberGenerator" in source
+    assert "SetAccessRuleProtection($true, $false)" in source
+    assert "Set-Acl" in source
+    assert "Write-Output $path" in source
+    assert "Write-Output $value" not in source