test_dbg_assert_safety.py

Go to the documentation of this file.

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
# tests/tests_linter/test_dbg_assert_safety.py
 
"""
Purpose
-------
Validate the linter's ``dbg_assert_safety`` rule (OI-403 / AP-16).
 
Responsibilities
----------------
- Confirm that ``_dbg_assert`` calls inside security-sensitive functions
  are flagged.
- Confirm that ``_dbg_assert`` calls inside security-sensitive classes
  (via method scope) are flagged.
- Confirm that ``_dbg_assert`` calls inside modules with security-sensitive
  filenames are flagged.
- Confirm that ``_dbg_assert`` calls in ordinary contexts are not flagged.
 
Diagnostics
-----------
Domain: LINTER-TESTS
L2: test lifecycle
L3: assertion details
L4: deep tracing
 
Contracts
---------
Inputs:  inline source strings
Outputs: pass/fail assertions
"""
 
from oct.linter import oct_lint
 
 
def test_dbg_assert_in_auth_function_flagged():
    """_dbg_assert inside a function whose name contains 'authenticate' is flagged."""
    source = (
        'def authenticate_user(token):\n'
        '    _dbg_assert("AUTH", token is not None, "token required")\n'
        '    return True\n'
    )
    ok, msg = oct_lint.check_dbg_assert_safety(source)
    assert not ok
    assert "authenticate_user" in msg
    assert "AP-16" in msg
 
 
def test_dbg_assert_in_harmless_function_passes():
    """_dbg_assert inside a harmless function is fine."""
    source = (
        'def compute_sum(a, b):\n'
        '    _dbg_assert("MATH", isinstance(a, int), "a must be int")\n'
        '    return a + b\n'
    )
    ok, msg = oct_lint.check_dbg_assert_safety(source)
    assert ok, f"Expected pass, got: {msg}"
 
 
def test_dbg_assert_in_class_method_of_auth_class_flagged():
    """_dbg_assert inside a method of a security-sensitive class is flagged."""
    source = (
        'class AuthManager:\n'
        '    def check(self, token):\n'
        '        _dbg_assert("AUTH", token, "need token")\n'
        '        return True\n'
    )
    ok, msg = oct_lint.check_dbg_assert_safety(source)
    assert not ok
    assert "AuthManager" in msg
 
 
def test_dbg_assert_in_security_module_flagged():
    """_dbg_assert in a module whose filename is security-sensitive is flagged."""
    source = (
        'def helper():\n'
        '    _dbg_assert("SEC", True, "ok")\n'
    )
    ok, msg = oct_lint.check_dbg_assert_safety(source, filename="password_check.py")
    assert not ok
    assert "password_check" in msg
 
 
def test_no_dbg_assert_calls_passes():
    """Source without any _dbg_assert calls passes trivially."""
    source = (
        'def authenticate_user(token):\n'
        '    if not token:\n'
        '        raise ValueError("token required")\n'
        '    return True\n'
    )
    ok, msg = oct_lint.check_dbg_assert_safety(source)
    assert ok
 
 
def test_dbg_assert_attribute_call_flagged():
    """Attribute-style ``oc_diagnostics._dbg_assert`` call is also flagged."""
    source = (
        'def validate_credentials(user, pw):\n'
        '    oc_diagnostics._dbg_assert("AUTH", user, "user required")\n'
        '    return True\n'
    )
    ok, msg = oct_lint.check_dbg_assert_safety(source)
    assert not ok
    assert "validate_credentials" in msg