test_quality_gate_workspace_secrets.py

Go to the documentation of this file.

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
# tests/tests_git/test_quality_gate_workspace_secrets.py
 
"""
Purpose
-------
Regression coverage for the workspace-mode secret-scanner fix
(P2 of the drift resolution plan): when ``run_quality_gate_on_files``
runs from a workspace root, per-subproject ``entropy_exclusions``
configured in ``<sp>/.option_c/octrc.json`` must apply to files in
that subproject. Path patterns are prefixed with the subproject's
workspace-relative path. The new ``module_self_doc`` context value
must be honoured alongside ``test_directory`` for ``path_pattern``
exclusions and accepted by the octrc schema validator.
 
Responsibilities
----------------
- Build a minimal workspace + subproject + manifest.
- Plant a high-entropy string in a target Python file.
- Verify the scanner finds it WITHOUT a config (baseline).
- Verify the scanner skips it WITH a per-subproject ``module_self_doc``
  exclusion when invoked from the workspace root.
- Verify the schema validator accepts ``module_self_doc``.
 
Diagnostics
-----------
Domain: GIT-TESTS
Levels:
    L2 — test lifecycle
    L3 — per-assertion details
 
Contracts
---------
- Tests run hermetically inside ``tmp_path``; no real workspace is touched.
- Exclusion semantics are verified end-to-end through
  :func:`oct.git.quality_gate.run_quality_gate_on_files`.
 
Dependencies
------------
- oct.git.quality_gate (run_quality_gate_on_files entry point under test)
- oct.linter.oct_lint (_validate_octrc_schema for context validation)
"""
 
from __future__ import annotations
 
import json
from pathlib import Path
 
import pytest
 
from oct.git.quality_gate import run_quality_gate_on_files
from oct.linter.oct_lint import _validate_octrc_schema
 
 
HIGH_ENTROPY_FILE = '''\
#!/usr/bin/env python3
# -*- coding: utf-8 -*-
# subproj/help_text.py
 
"""
Purpose
-------
Help-text holder.
 
Responsibilities
----------------
- Hold strings.
 
Diagnostics
-----------
Domain: TEST
Levels:
    L2 -- lifecycle
    L3 -- details
    L4 -- tracing
 
Contracts
---------
- Strings are constants.
 
Dependencies
------------
"""
 
# A long, high-entropy literal that would trip the entropy scanner
# at the default code threshold of 4.5 bits/char. Mixed-case
# alphanumerics with rare characters push entropy well above 4.5.
HELP_BLURB = "aB3kQ9pZ2vMx7Lw5fT8r1NjY6sH4dGcPe0iVoUbXqMnRtKaCyEbWlIuFhDsAjVgZ"
'''
 
 
def _make_workspace(tmp_path: Path, subproj_octrc: dict | None) -> Path:
    """Build a minimal workspace at ``tmp_path/ws`` with one subproject.
 
    Returns the workspace root.
    """
    ws_root = tmp_path / "ws"
    ws_root.mkdir()
    (ws_root / ".option_c_workspace.json").write_text(
        json.dumps({
            "version": "1.0",
            "name": "test-ws",
            "subprojects": [
                {"path": "sub", "name": "sub"},
            ],
        }),
        encoding="utf-8",
    )
 
    sub_root = ws_root / "sub"
    sub_root.mkdir()
 
    if subproj_octrc is not None:
        (sub_root / ".option_c").mkdir()
        (sub_root / ".option_c" / "octrc.json").write_text(
            json.dumps(subproj_octrc),
            encoding="utf-8",
        )
 
    target = sub_root / "help_text.py"
    target.write_text(HIGH_ENTROPY_FILE, encoding="utf-8")
    return ws_root
 
 
def test_workspace_mode_baseline_flags_high_entropy(tmp_path: Path):
    """Without any subproject octrc, the high-entropy literal is flagged."""
    ws_root = _make_workspace(tmp_path, subproj_octrc=None)
    target = ws_root / "sub" / "help_text.py"
 
    result = run_quality_gate_on_files(
        files=[target],
        project_root=ws_root,
        profile="compact",
    )
 
    assert result.secrets_findings, "expected high-entropy literal to flag"
    assert any(
        "help_text.py" in finding[0] and "high-entropy" in finding[2].lower()
        for finding in result.secrets_findings
    ), result.secrets_findings
 
 
def test_workspace_mode_module_self_doc_exclusion_applies(tmp_path: Path):
    """Subproject's module_self_doc path_pattern is honoured at workspace scope.
 
    The pattern ``help_text.py`` (subproject-relative) is prefixed with
    ``sub/`` by the workspace merge, so the workspace-relative file
    path ``sub/help_text.py`` matches and entropy is exempted.
    """
    octrc = {
        "secret_scanner": {
            "entropy_exclusions": [
                {
                    "path_pattern": "help_text.py",
                    "context": "module_self_doc",
                    "reason": "Self-documenting help text",
                    "restrictions": {
                        "exempt_entropy_only": True,
                        "require_waiver_for_secret_patterns": True,
                    },
                },
            ],
        },
    }
    ws_root = _make_workspace(tmp_path, subproj_octrc=octrc)
    target = ws_root / "sub" / "help_text.py"
 
    result = run_quality_gate_on_files(
        files=[target],
        project_root=ws_root,
        profile="compact",
    )
 
    assert not result.secrets_findings, (
        f"expected no findings; got {result.secrets_findings}"
    )
 
 
def test_octrc_schema_accepts_module_self_doc_context():
    """The schema validator accepts the new ``module_self_doc`` context."""
    cfg = {
        "secret_scanner": {
            "entropy_exclusions": [
                {
                    "path_pattern": "oct/cli.py",
                    "context": "module_self_doc",
                    "reason": "self-doc",
                    "restrictions": {"exempt_entropy_only": True},
                },
            ],
        },
    }
    errors = _validate_octrc_schema(cfg)
    assert errors == [], errors
 
 
def test_octrc_schema_rejects_unknown_context():
    """Unknown ``context`` values are still rejected (regression guard)."""
    cfg = {
        "secret_scanner": {
            "entropy_exclusions": [
                {
                    "path_pattern": "x/",
                    "context": "totally_made_up",
                    "reason": "nope",
                },
            ],
        },
    }
    errors = _validate_octrc_schema(cfg)
    assert any("context" in e for e in errors), errors