82 lines
2.7 KiB
Python
82 lines
2.7 KiB
Python
from __future__ import annotations
|
|
|
|
import ast
|
|
import subprocess
|
|
import sys
|
|
from pathlib import Path
|
|
|
|
ROOT = Path(__file__).parents[1]
|
|
|
|
|
|
def test_authentik_payload_is_valid_python_and_never_prints_secret() -> None:
|
|
path = ROOT / "scripts" / "authentik_provision_mcp_service_account.py"
|
|
source = path.read_text(encoding="utf-8")
|
|
ast.parse(source)
|
|
assert "INTENT_APP_PASSWORD" in source
|
|
assert '"subject": str(user.uuid)' in source
|
|
assert "print(secret" not in source
|
|
assert '"key": secret' in source
|
|
|
|
|
|
def test_codex_installer_uses_stdio_bridge_and_secret_reference_only() -> None:
|
|
source = (ROOT / "scripts" / "install_codex_mcp.ps1").read_text(encoding="utf-8")
|
|
assert "mcp_stdio_bridge.py" in source
|
|
assert "--client-secret-file" in source
|
|
assert "mcp', 'add'" in source
|
|
assert "Secret file ACL must grant only" in source
|
|
assert "Secret file must already be owned" in source
|
|
assert "SetOwner" not in source
|
|
assert "Set-Acl" not in source
|
|
assert "Get-Content" not in source
|
|
assert "WriteAllText" not in source
|
|
|
|
|
|
def test_stdio_bridge_starts_outside_repository_working_directory(tmp_path: Path) -> None:
|
|
result = subprocess.run( # noqa: S603
|
|
[sys.executable, str(ROOT / "scripts" / "mcp_stdio_bridge.py"), "--help"],
|
|
cwd=tmp_path,
|
|
capture_output=True,
|
|
check=False,
|
|
text=True,
|
|
timeout=60,
|
|
)
|
|
assert result.returncode == 0, result.stderr
|
|
assert "ITWorx MCP stdio bridge" in result.stdout
|
|
|
|
|
|
def test_machine_client_provisioner_imports_outside_repository(tmp_path: Path) -> None:
|
|
result = subprocess.run( # noqa: S603
|
|
[
|
|
sys.executable,
|
|
str(ROOT / "scripts" / "provision_machine_client.py"),
|
|
"--issuer",
|
|
"https://auth.itworx.test/application/o/hub/",
|
|
"--subject",
|
|
"fixture-subject",
|
|
"--oauth-username",
|
|
"svc-fixture",
|
|
"--name",
|
|
"Fixture",
|
|
"--project",
|
|
"fixture",
|
|
"--database-url",
|
|
"sqlite:///:memory:",
|
|
],
|
|
cwd=tmp_path,
|
|
capture_output=True,
|
|
check=False,
|
|
text=True,
|
|
timeout=60,
|
|
)
|
|
assert result.returncode == 1
|
|
assert "ModuleNotFoundError" not in result.stderr
|
|
|
|
|
|
def test_credential_generator_uses_csprng_and_user_only_acl() -> None:
|
|
source = (ROOT / "scripts" / "new_codex_credential.ps1").read_text(encoding="utf-8")
|
|
assert "RandomNumberGenerator" in source
|
|
assert "SetAccessRuleProtection($true, $false)" in source
|
|
assert "Set-Acl" in source
|
|
assert "Write-Output $path" in source
|
|
assert "Write-Output $value" not in source
|