98 lines
3.1 KiB
Python
98 lines
3.1 KiB
Python
"""Tests for M9.4 transitive integrity verification."""
|
|
|
|
from unittest.mock import patch
|
|
|
|
from cmdforge.integrity import (
|
|
IntegrityNode,
|
|
IntegrityChain,
|
|
compute_tool_hash,
|
|
build_integrity_chain,
|
|
verify_integrity,
|
|
)
|
|
from cmdforge.tool import Tool, PromptStep, ToolStep
|
|
|
|
|
|
class TestComputeToolHash:
|
|
def test_same_tool_same_hash(self):
|
|
tool = Tool(name="test", version="1.0.0")
|
|
assert compute_tool_hash(tool) == compute_tool_hash(tool)
|
|
|
|
def test_different_tools_different_hash(self):
|
|
a = Tool(name="a", version="1.0.0")
|
|
b = Tool(name="b", version="1.0.0")
|
|
assert compute_tool_hash(a) != compute_tool_hash(b)
|
|
|
|
def test_version_change_changes_hash(self):
|
|
v1 = Tool(name="test", version="1.0.0")
|
|
v2 = Tool(name="test", version="2.0.0")
|
|
assert compute_tool_hash(v1) != compute_tool_hash(v2)
|
|
|
|
|
|
class TestIntegrityChain:
|
|
def test_single_tool_chain(self):
|
|
tool = Tool(name="solo", version="1.0.0")
|
|
chain = build_integrity_chain(tool)
|
|
assert chain.root.name == "solo"
|
|
assert chain.is_valid
|
|
|
|
def test_chain_with_unresolved_dep(self):
|
|
tool = Tool(
|
|
name="parent",
|
|
version="1.0.0",
|
|
steps=[ToolStep(tool="missing-dep", output_var="x")],
|
|
output="{x}",
|
|
)
|
|
chain = build_integrity_chain(tool)
|
|
assert "missing-dep" not in chain.nodes
|
|
# Chain is still valid because the dependency hash is "unresolved"
|
|
# and there's no node to compare against
|
|
assert chain.is_valid
|
|
|
|
def test_chain_valid_with_resolved_dep(self, tmp_path):
|
|
with patch("cmdforge.tool.TOOLS_DIR", tmp_path / ".cmdforge"):
|
|
from cmdforge.tool import save_tool
|
|
|
|
child = Tool(name="child", version="1.0.0")
|
|
save_tool(child)
|
|
|
|
parent = Tool(
|
|
name="parent",
|
|
version="1.0.0",
|
|
steps=[ToolStep(tool="child", output_var="x")],
|
|
output="{x}",
|
|
)
|
|
save_tool(parent)
|
|
|
|
chain = build_integrity_chain(parent)
|
|
assert "child" in chain.nodes
|
|
assert chain.is_valid
|
|
|
|
|
|
class TestVerifyIntegrity:
|
|
def test_valid_chain(self):
|
|
chain = IntegrityChain(
|
|
root=IntegrityNode(name="root", content_hash="abc"),
|
|
nodes={"root": IntegrityNode(name="root", content_hash="abc")},
|
|
)
|
|
assert verify_integrity(chain)
|
|
|
|
def test_tampered_chain(self):
|
|
chain = IntegrityChain(
|
|
root=IntegrityNode(
|
|
name="root",
|
|
content_hash="abc",
|
|
dependencies=["dep"],
|
|
dependency_hashes={"dep": "expected_hash"},
|
|
),
|
|
nodes={
|
|
"root": IntegrityNode(
|
|
name="root",
|
|
content_hash="abc",
|
|
dependencies=["dep"],
|
|
dependency_hashes={"dep": "expected_hash"},
|
|
),
|
|
"dep": IntegrityNode(name="dep", content_hash="different_hash"),
|
|
},
|
|
)
|
|
assert not chain.is_valid
|