48 lines
1.8 KiB
Python
48 lines
1.8 KiB
Python
from __future__ import annotations
|
|
|
|
import os
|
|
import tempfile
|
|
import unittest
|
|
from pathlib import Path
|
|
|
|
from scripts.verify_demo_token_runtime import validate_mount
|
|
|
|
|
|
class DemoTokenRuntimeCheckTests(unittest.TestCase):
|
|
def test_accepts_exact_read_only_regular_file_mount(self) -> None:
|
|
with tempfile.TemporaryDirectory() as directory:
|
|
path = Path(directory) / "revocations.json"
|
|
path.write_text('{"schemaVersion":"1.0","revokedJtis":[]}\n', encoding="utf-8")
|
|
path.chmod(0o600)
|
|
report = validate_mount(
|
|
[{"Destination": "/etc/itworx", "Source": str(path.parent), "RW": False}], path
|
|
)
|
|
self.assertEqual(report["status"], "pass")
|
|
if os.name != "nt":
|
|
self.assertEqual(report["mode"], "0600")
|
|
|
|
def test_rejects_wrong_or_writable_mount(self) -> None:
|
|
with tempfile.TemporaryDirectory() as directory:
|
|
expected = Path(directory) / "expected.json"
|
|
actual = Path(directory) / "example.json"
|
|
expected.write_text("{}", encoding="utf-8")
|
|
actual.write_text("{}", encoding="utf-8")
|
|
expected.chmod(0o600)
|
|
actual.chmod(0o600)
|
|
with self.assertRaisesRegex(ValueError, "does not match"):
|
|
validate_mount(
|
|
[
|
|
{
|
|
"Destination": "/etc/itworx",
|
|
"Source": str(actual.parent / "wrong"),
|
|
"RW": False,
|
|
}
|
|
],
|
|
expected,
|
|
)
|
|
with self.assertRaisesRegex(ValueError, "read-only"):
|
|
validate_mount(
|
|
[{"Destination": "/etc/itworx", "Source": str(expected.parent), "RW": True}],
|
|
expected,
|
|
)
|