exitdrill/tests/test_civicrm_target_demo.py at main · ghzhost/exitdrill · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
import hashlib
import json
import shutil
import subprocess
import sys
from pathlib import Path


def _tree_digest(root: Path) -> str:
    digest = hashlib.sha256()
    for path in sorted(item for item in root.rglob("*") if item.is_file()):
        digest.update(path.relative_to(root).as_posix().encode("utf-8"))
        digest.update(b"\0")
        digest.update(path.read_bytes())
        digest.update(b"\0")
    return digest.hexdigest()


def _run_builder(
    project: Path, source: Path, destination: Path
) -> subprocess.CompletedProcess[str]:
    return subprocess.run(  # noqa: S603 - fixed interpreter and repository script
        [
            sys.executable,
            str(project / "scripts" / "build_civicrm_target_adversaries.py"),
            str(source),
            str(destination),
        ],
        cwd=project,
        check=False,
        capture_output=True,
        text=True,
    )


def test_civicrm_target_roundtrip_canary_acceptance() -> None:
    project = Path(__file__).parents[1]
    completed = subprocess.run(  # noqa: S603 - fixed interpreter and repository script
        [
            sys.executable,
            str(project / "scripts" / "check_civicrm_target_roundtrip_demo.py"),
        ],
        cwd=project,
        check=False,
        capture_output=True,
        text=True,
    )

    assert completed.returncode == 0, completed.stderr
    assert completed.stderr == ""
    assert json.loads(completed.stdout) == {
        "adversarial_controls_detected": 5,
        "clean_observed_remediation_signals": 6,
        "clean_overall_status": "not_structurally_restorable",
        "clean_accessibility_serious_violations": 2,
        "clean_keyboard_tab_steps_to_roles_summary": 69,
        "clean_activity_view_observations": 1,
        "clean_contact_summary_workflow_observations": 1,
        "clean_case_client_workflow_observations": 1,
        "clean_browser_access_denial_observations": 1,
        "clean_browser_access_allow_control_observations": 1,
        "clean_case_search_http_500_observations": 1,
        "clean_evidence_index_entries": 12,
        "clean_browser_workflow_observations": 1,
        "clean_target_probe_passes": 5,
        "clean_ui_surface_observations": 1,
        "source_profile": "directus-11.17.4-civic-case/v0.1",
        "status": "civicrm_target_roundtrip_canary_verified",
        "target_profile": ("directus-11.17.4-civic-case-to-civicrm-standalone-6.16.2/v0.1"),
    }


def test_civicrm_adversary_builder_preserves_source_and_publishes_closed_set(
    tmp_path: Path,
) -> None:
    project = Path(__file__).parents[1]
    committed = project / "examples" / "civicrm-6.16.2-target-roundtrip" / "native"
    source = tmp_path / "source"
    destination = tmp_path / "adversaries"
    shutil.copytree(committed, source)
    before = _tree_digest(source)

    completed = _run_builder(project, source, destination)

    assert completed.returncode == 0, completed.stderr
    assert completed.stdout == ""
    assert completed.stderr == ""
    assert _tree_digest(source) == before
    assert {item.name for item in destination.iterdir()} == {
        "scalar-substitution",
        "relationship-rewire",
        "attachment-corruption",
        "permission-escalation",
        "nonempty-precondition",
        "adversarial-derivatives.json",
    }
    statement = json.loads(
        (destination / "adversarial-derivatives.json").read_text(encoding="utf-8")
    )
    assert statement["target_data_row_counts_preserved"] is True
    assert statement["attachment_file_counts_and_sizes_preserved"] is True
    assert not list(tmp_path.glob(".civicrm-target-adversaries.*"))


def test_civicrm_adversary_builder_rejects_overlapping_output(tmp_path: Path) -> None:
    project = Path(__file__).parents[1]
    committed = project / "examples" / "civicrm-6.16.2-target-roundtrip" / "native"
    source = tmp_path / "source"
    shutil.copytree(committed, source)
    destination = source / "nested-adversaries"

    completed = _run_builder(project, source, destination)

    assert completed.returncode == 2
    assert completed.stdout == ""
    assert "must not overlap" in completed.stderr
    assert str(source) not in completed.stderr
    assert not destination.exists()


def test_civicrm_adversary_builder_rejects_uncommitted_manifest_without_output(
    tmp_path: Path,
) -> None:
    project = Path(__file__).parents[1]
    committed = project / "examples" / "civicrm-6.16.2-target-roundtrip" / "native"
    source = tmp_path / "source"
    destination = tmp_path / "adversaries"
    shutil.copytree(committed, source)
    manifest_path = source / "capture-manifest.json"
    manifest = json.loads(manifest_path.read_text(encoding="utf-8"))
    manifest["target_version"] = "6.16.3"
    manifest_path.write_text(
        json.dumps(manifest, allow_nan=False, separators=(",", ":"), sort_keys=True) + "\n",
        encoding="utf-8",
    )

    completed = _run_builder(project, source, destination)

    assert completed.returncode == 2
    assert completed.stdout == ""
    assert "not the committed clean CiviCRM target canary" in completed.stderr
    assert str(source) not in completed.stderr
    assert not destination.exists()
    assert not list(tmp_path.glob(".civicrm-target-adversaries.*"))