nearmiss/tests/test_private_paths.py at main · ghzhost/nearmiss · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
# SPDX-License-Identifier: Apache-2.0
"""Filesystem-boundary tests for private storage path containment."""

from __future__ import annotations

from pathlib import Path

import pytest

from nearmiss.private_paths import (
    PrivateRootPreflightError,
    RepositoryContainmentError,
    RepositoryRootPreflightError,
    require_private_root_outside_repository,
)

ROOT = Path(__file__).resolve().parents[1]


def test_equal_inside_and_outside_roots_are_classified_without_creation(tmp_path: Path) -> None:
    repository = tmp_path / "repo"
    repository.mkdir()
    inside = repository / "private" / "not-created"

    with pytest.raises(RepositoryContainmentError):
        require_private_root_outside_repository(repository, repository)
    with pytest.raises(RepositoryContainmentError):
        require_private_root_outside_repository(inside, repository)
    assert not inside.exists()

    outside = tmp_path / "outside" / "not-created"
    assert require_private_root_outside_repository(outside, repository) == outside.resolve()
    assert not outside.exists()


def test_existing_live_repository_and_outside_paths_are_classified_by_identity() -> None:
    with pytest.raises(RepositoryContainmentError):
        require_private_root_outside_repository(ROOT / "tests", ROOT)
    assert require_private_root_outside_repository(ROOT.parent, ROOT) == ROOT.parent.resolve()


def test_case_alias_of_existing_repository_ancestor_is_rejected_when_supported() -> None:
    canonical = Path("/Users")
    alias = Path("/users")
    try:
        aliases_same_directory = canonical.samefile(alias)
    except OSError:
        aliases_same_directory = False
    if not aliases_same_directory:
        pytest.skip("filesystem does not expose /Users through the /users case alias")

    with pytest.raises(RepositoryContainmentError):
        require_private_root_outside_repository(
            alias / "nearmiss-private-root-must-not-exist",
            canonical,
        )


def test_resolved_symlink_outside_is_allowed_and_symlink_inside_is_rejected(
    tmp_path: Path,
) -> None:
    repository = tmp_path / "repo"
    repository.mkdir()
    outside = tmp_path / "outside"
    outside.mkdir()

    outward_link = repository / "private-link"
    outward_link.symlink_to(outside, target_is_directory=True)
    proposed = outward_link / "annual"
    assert (
        require_private_root_outside_repository(proposed, repository)
        == (outside / "annual").resolve()
    )

    inward_link = tmp_path / "repository-alias"
    inward_link.symlink_to(repository, target_is_directory=True)
    with pytest.raises(RepositoryContainmentError):
        require_private_root_outside_repository(inward_link / "annual", repository)


def test_malformed_root_and_repository_fail_separately(tmp_path: Path) -> None:
    repository = tmp_path / "repo"
    repository.mkdir()

    with pytest.raises(PrivateRootPreflightError, match="private storage root"):
        require_private_root_outside_repository("bad\0root", repository)
    with pytest.raises(RepositoryRootPreflightError, match="repository root"):
        require_private_root_outside_repository(tmp_path / "outside", "bad\0repository")
    with pytest.raises(PrivateRootPreflightError, match="private storage root"):
        require_private_root_outside_repository("", repository)
    with pytest.raises(RepositoryRootPreflightError, match="repository root"):
        require_private_root_outside_repository(tmp_path / "outside", "")


def test_files_and_missing_repositories_are_not_valid_roots(tmp_path: Path) -> None:
    repository = tmp_path / "repo"
    repository.mkdir()
    private_file = tmp_path / "private-file"
    private_file.write_text("not a directory")

    with pytest.raises(PrivateRootPreflightError):
        require_private_root_outside_repository(private_file, repository)
    with pytest.raises(RepositoryRootPreflightError):
        require_private_root_outside_repository(tmp_path / "outside", tmp_path / "missing")
    repository_file = tmp_path / "repository-file"
    repository_file.write_text("not a directory")
    with pytest.raises(RepositoryRootPreflightError):
        require_private_root_outside_repository(tmp_path / "outside", repository_file)