72 lines
2.5 KiB
Python
72 lines
2.5 KiB
Python
from __future__ import annotations
|
|
|
|
import pytest
|
|
from sqlmodel import Session, SQLModel, create_engine
|
|
|
|
from backend.app.db.models import Secret
|
|
from backend.app.services import repopulse_target_credential as target
|
|
|
|
|
|
def test_fixed_target_credential_is_durable_and_collision_safe(tmp_path, monkeypatch):
|
|
monkeypatch.setattr(
|
|
target.secret_store,
|
|
"secret_storage_status",
|
|
lambda: {"productionReady": True},
|
|
)
|
|
engine = create_engine(f"sqlite:///{tmp_path / 'credentials.db'}")
|
|
SQLModel.metadata.create_all(engine)
|
|
first_intent = "rpa-" + "a" * 20
|
|
|
|
with Session(engine) as session:
|
|
first_id, first_secret = target.get_or_create_repopulse_target_credential(
|
|
session, intent_id=first_intent
|
|
)
|
|
row = session.get(Secret, "ENROLL_REPOPULSE_TARGET_HMAC")
|
|
assert row is not None
|
|
assert first_secret.decode("ascii") not in row.encrypted_value
|
|
|
|
with Session(engine) as session:
|
|
replay_id, replay_secret = target.get_or_create_repopulse_target_credential(
|
|
session, intent_id=first_intent
|
|
)
|
|
assert (replay_id, replay_secret) == (first_id, first_secret)
|
|
with pytest.raises(
|
|
target.RepoPulseTargetCredentialError, match="target_credential_collision"
|
|
):
|
|
target.get_or_create_repopulse_target_credential(
|
|
session, intent_id="rpa-" + "b" * 20
|
|
)
|
|
|
|
with Session(engine) as session:
|
|
row = session.get(Secret, "ENROLL_REPOPULSE_TARGET_HMAC")
|
|
assert row is not None
|
|
row.metadata_json = {}
|
|
session.add(row)
|
|
session.commit()
|
|
with pytest.raises(
|
|
target.RepoPulseTargetCredentialError, match="target_credential_collision"
|
|
):
|
|
target.get_or_create_repopulse_target_credential(
|
|
session, intent_id=first_intent
|
|
)
|
|
|
|
|
|
def test_fixed_target_credential_requires_production_secret_store(
|
|
tmp_path, monkeypatch
|
|
):
|
|
monkeypatch.setattr(
|
|
target.secret_store,
|
|
"secret_storage_status",
|
|
lambda: {"productionReady": False},
|
|
)
|
|
engine = create_engine(f"sqlite:///{tmp_path / 'credentials.db'}")
|
|
SQLModel.metadata.create_all(engine)
|
|
with Session(engine) as session:
|
|
with pytest.raises(
|
|
target.RepoPulseTargetCredentialError, match="secret_store_not_ready"
|
|
):
|
|
target.get_or_create_repopulse_target_credential(
|
|
session, intent_id="rpa-" + "a" * 20
|
|
)
|
|
assert session.get(Secret, "ENROLL_REPOPULSE_TARGET_HMAC") is None
|