External/pmg
1
0
Fork 0
mirror of https://github.com/safedep/pmg.git synced 2026-08-03 07:24:09 +02:00
Code Issues Packages Projects Releases Wiki Activity
Files
5ac0f275b83d9d5a9342c6aae977ec32fa330daa
pmg/internal/audit/cloud_translate_test.go
T
Sahil BansalGitHubAbhisek Datta
 327c9c7068 feat(cooldown): respect trusted_packages in dependency cooldown (#342) 
* feat(cooldown): respect trusted_packages in dependency cooldown

Trusted packages are now treated as a superset waiver that bypasses every
PMG control (malware analysis, cooldown, and any future controls). A
globally trusted package is automatically exempt from the cooldown window
and no longer needs a duplicate entry in dependency_cooldown.skip.

The skip list remains the narrower, cooldown-only waiver for packages
that must bypass the cooldown wait but still be malware-scanned.

* refactor(cooldown): tag skip reason and audit-log skipped packages

Address review feedback on #342:

- Restore cooldownSkip to a pure single-list function (SRP); the merge
  into trusted_packages now happens in a separate mergeCooldownSkip step,
  driven by the exported CooldownSkip wrapper.
- Extend CooldownSkipInfo with a CooldownSkipReason (TrustedPackage /
  CooldownSkipList) on both SkipAll and per-version entries, so callers
  can tell apart the broad waiver from the cooldown-only one. When both
  lists match the same package, trusted_packages wins.
- Add audit.LogCooldownSkipped and emit it from the npm and PyPI
  interceptors on the SkipAll path, alongside the existing info log,
  carrying the source list as the reason.

* refactor(cooldown): inline list merge, audit per-version exemptions

Address further review feedback:

- Drop the separate mergeCooldownSkip helper; cooldownSkip now writes
  into a shared *CooldownSkipInfo and is called twice from CooldownSkip
  (cooldown skip list first, trusted_packages on top so trusted entries
  override the reason on overlap).
- Audit log every exemption, not just SkipAll: a new auditCooldownSkip
  helper in proxy/interceptors/cooldown.go emits one event per match
  (package-wide or per-version), each tagged with its source list.
  LogCooldownSkipped gains a version argument for the per-version case.
- Cover the trusted_packages reason path in TestCooldownSkip.

* fix(cooldown): avoid double-auditing trusted package exemptions

auditCooldownSkip now only emits EventTypeCooldownSkipped for entries
that came from dependency_cooldown.skip. Trusted-package exemptions
already get an EventTypeInstallTrustedAllowed event at tarball-download
time (proxy/interceptors/base_registry.go), so emitting a cooldown event
for them too would double-count the same waiver.

* emit trusted and cooldown skip events to cloud

* fix tests

* refactor(cooldown): return value from collectCooldownSkip, short-circuit on trusted SkipAll

Address PR review feedback:
- Rename cooldownSkip to collectCooldownSkip and return CooldownSkipInfo
  instead of mutating an input pointer.
- Add mergeCooldownSkip to combine per-list results with trusted_packages
  taking precedence on overlap.
- CooldownSkip now consults trusted_packages first and returns immediately
  on a package-wide trusted exemption (DC skip list cannot add anything).
- Extend tests to cover disjoint pinned entries across both lists and the
  case where DC version-less subsumes a trusted pinned entry.

* fix(audit): address cooldown review feedback

* fix(cooldown): audit cooldown skips at download time with concrete version

Backend rejects PackageVersion messages without a version, and audit logs
should reflect the runtime fact (a specific version was skipped) rather
than the config rule. Move the audit emission from metadata-request
handling to download-request handling, where the concrete version is
known, and require version in LogCooldownSkipped.

* chore(audit): drop dead scope assignment in LogCooldownSkipped

* refactor(cooldown): move skip-list logic into cooldown handlers

Registry interceptors no longer compute CooldownSkip or branch on SkipAll;
they just call HandleMetadataRequest. The npm and pypi cooldown handlers
own the skip lookup, the package-wide exemption short-circuit, and (for
pypi) the canonical-name denormalization. Also align LogCooldownSkipped
with other LogXxx signatures by taking *packagev1.PackageVersion.

* fix: Simplify audit logging for dependency cooldown skip

* refactor: Simplify cooldown handling and maintain separation of concepts for trusted and DC skip packages

* fix: Code review fixes

* fix: Emit cooldown skipped audit event ONLY when an in-window version is skipped

---------

Co-authored-by: Abhisek Datta <abhisek.datta@gmail.com>
2026-06-21 18:22:15 +05:30

377 lines
13 KiB
Go
Raw Blame History

package audit
import (
"errors"
"testing"
"time"
controltowerv1 "buf.build/gen/go/safedep/api/protocolbuffers/go/safedep/messages/controltower/v1"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
)
// testCloudSink returns a cloudSink with no real SyncClient, suitable for testing translation.
var testSink = &cloudSink{SyncClientBundle: &SyncClientBundle{}, invocationID: "test-invocation"}
func TestTranslateMalwareBlocked(t *testing.T) {
event := AuditEvent{
Type: EventTypeMalwareBlocked,
PackageVersion: testPackageVersion("evil-pkg", "1.2.3", "npm"),
AnalysisID: "analysis-123",
IsMalware: true,
IsVerified: true,
}
results := testSink.translateToPmgEvents(event)
require.Len(t, results, 1)
result := results[0]
assert.Equal(t, controltowerv1.PmgEventType_PMG_EVENT_TYPE_PACKAGE_DECISION, result.GetEventType())
require.True(t, result.HasPackageDecision())
decision := result.GetPackageDecision()
assert.Equal(t, controltowerv1.PmgPackageAction_PMG_PACKAGE_ACTION_BLOCKED, decision.GetAction())
assert.Equal(t, "analysis-123", decision.GetAnalysisId())
assert.True(t, decision.GetIsMalware())
assert.True(t, decision.GetIsVerified())
assert.NotNil(t, decision.GetPackageVersion())
}
func TestTranslateMalwareConfirmed(t *testing.T) {
event := AuditEvent{
Type: EventTypeMalwareConfirmed,
PackageVersion: testPackageVersion("suspect-pkg", "2.0.0", "npm"),
AnalysisID: "analysis-456",
IsMalware: false,
IsVerified: false,
}
results := testSink.translateToPmgEvents(event)
require.Len(t, results, 1)
result := results[0]
assert.Equal(t, controltowerv1.PmgEventType_PMG_EVENT_TYPE_PACKAGE_DECISION, result.GetEventType())
require.True(t, result.HasPackageDecision())
decision := result.GetPackageDecision()
assert.Equal(t, controltowerv1.PmgPackageAction_PMG_PACKAGE_ACTION_CONFIRMED, decision.GetAction())
assert.Equal(t, "analysis-456", decision.GetAnalysisId())
assert.False(t, decision.GetIsMalware())
assert.False(t, decision.GetIsVerified())
assert.False(t, decision.GetIsVerified())
}
func TestTranslateCooldownSkipped(t *testing.T) {
event := AuditEvent{
Type: EventTypeCooldownSkipped,
PackageVersion: testPackageVersion("exempt-pkg", "1.0.0", "npm"),
Reason: "dependency_cooldown.skip",
}
results := testSink.translateToPmgEvents(event)
require.Len(t, results, 1)
result := results[0]
assert.Equal(t, controltowerv1.PmgEventType_PMG_EVENT_TYPE_PACKAGE_DECISION, result.GetEventType())
require.True(t, result.HasPackageDecision())
decision := result.GetPackageDecision()
assert.Equal(t, controltowerv1.PmgPackageAction_PMG_PACKAGE_ACTION_COOLDOWN_SKIPPED, decision.GetAction())
require.NotNil(t, decision.GetPackageVersion(), "package_version must be propagated to the cloud sink")
assert.Equal(t, "exempt-pkg", decision.GetPackageVersion().GetPackage().GetName())
assert.Equal(t, "1.0.0", decision.GetPackageVersion().GetVersion())
}
func TestTranslateInstallTrustedAllowed(t *testing.T) {
event := AuditEvent{
Type: EventTypeInstallTrustedAllowed,
PackageVersion: testPackageVersion("trusted-pkg", "2.0.0", "npm"),
}
results := testSink.translateToPmgEvents(event)
require.Len(t, results, 1)
result := results[0]
assert.Equal(t, controltowerv1.PmgEventType_PMG_EVENT_TYPE_PACKAGE_DECISION, result.GetEventType())
require.True(t, result.HasPackageDecision())
decision := result.GetPackageDecision()
assert.Equal(t, controltowerv1.PmgPackageAction_PMG_PACKAGE_ACTION_TRUSTED, decision.GetAction())
require.NotNil(t, decision.GetPackageVersion())
assert.Equal(t, "trusted-pkg", decision.GetPackageVersion().GetPackage().GetName())
}
func TestTranslateInsecureBypassReturnsEmpty(t *testing.T) {
event := AuditEvent{
Type: EventTypeInstallInsecureBypass,
}
results := testSink.translateToPmgEvents(event)
assert.Empty(t, results)
}
func TestTranslateSandboxOverride(t *testing.T) {
event := AuditEvent{
Type: EventTypeSandboxOverride,
ProfileName: "strict",
Overrides: []map[string]string{
{"read": "/tmp"},
{"write": "/var/log"},
},
}
results := testSink.translateToPmgEvents(event)
require.Len(t, results, 1)
result := results[0]
assert.Equal(t, controltowerv1.PmgEventType_PMG_EVENT_TYPE_SANDBOX_OVERRIDE, result.GetEventType())
require.True(t, result.HasSandboxOverride())
override := result.GetSandboxOverride()
assert.Equal(t, "strict", override.GetSandboxProfile())
assert.ElementsMatch(t, []string{"read:/tmp", "write:/var/log"}, override.GetOverrides())
}
func TestTranslateError(t *testing.T) {
event := AuditEvent{
Type: EventTypeError,
Message: "something went wrong",
Error: errors.New("connection refused"),
}
results := testSink.translateToPmgEvents(event)
require.Len(t, results, 1)
result := results[0]
assert.Equal(t, controltowerv1.PmgEventType_PMG_EVENT_TYPE_ERROR, result.GetEventType())
require.True(t, result.HasError())
pmgErr := result.GetError()
assert.Equal(t, "*errors.errorString", pmgErr.GetErrorType())
assert.Equal(t, "something went wrong", pmgErr.GetMessage())
}
func TestTranslateErrorNilError(t *testing.T) {
event := AuditEvent{
Type: EventTypeError,
Message: "unknown issue",
Error: nil,
}
results := testSink.translateToPmgEvents(event)
require.Len(t, results, 1)
result := results[0]
pmgErr := result.GetError()
assert.Equal(t, "", pmgErr.GetErrorType())
assert.Equal(t, "unknown issue", pmgErr.GetMessage())
}
func TestTranslateCooldownBlocked(t *testing.T) {
publishDate := time.Date(2026, 5, 1, 0, 0, 0, 0, time.UTC)
event := AuditEvent{
Type: EventTypeDependencyCooldown,
PackageVersion: testPackageVersion("new-pkg", "1.0.0", "npm"),
PublishDate: publishDate,
CooldownDays: 30,
DaysAgo: 6,
DaysLeft: 24,
}
results := testSink.translateToPmgEvents(event)
require.Len(t, results, 1)
result := results[0]
assert.Equal(t, controltowerv1.PmgEventType_PMG_EVENT_TYPE_PACKAGE_DECISION, result.GetEventType())
require.True(t, result.HasPackageDecision())
decision := result.GetPackageDecision()
assert.Equal(t, controltowerv1.PmgPackageAction_PMG_PACKAGE_ACTION_COOLDOWN_BLOCKED, decision.GetAction())
assert.NotNil(t, decision.GetPackageVersion())
require.True(t, decision.HasCooldown())
cooldown := decision.GetCooldown()
assert.Equal(t, publishDate.Unix(), cooldown.GetPublishDate().AsTime().Unix())
assert.Equal(t, uint32(30), cooldown.GetCooldownDays())
assert.Equal(t, uint32(6), cooldown.GetDaysSincePublish())
assert.Equal(t, uint32(24), cooldown.GetDaysRemaining())
}
func TestTranslateHostObservation(t *testing.T) {
event := AuditEvent{
Type: EventTypeProxyHostObserved,
Hostname: "evil.example.com",
Method: "CONNECT",
}
results := testSink.translateToPmgEvents(event)
require.Len(t, results, 1)
result := results[0]
assert.Equal(t, controltowerv1.PmgEventType_PMG_EVENT_TYPE_HOST_OBSERVATION, result.GetEventType())
require.True(t, result.HasHostObservation())
obs := result.GetHostObservation()
assert.Equal(t, "evil.example.com", obs.GetHostname())
assert.Equal(t, "CONNECT", obs.GetMethod())
}
func TestTranslateUnsupportedEventReturnsEmpty(t *testing.T) {
unsupported := []EventType{
EventTypeDependencyResolved,
EventTypeInstallStarted,
EventTypeInstallAllowed,
EventTypeInstallInsecureBypass,
}
for _, et := range unsupported {
t.Run(string(et), func(t *testing.T) {
results := testSink.translateToPmgEvents(AuditEvent{Type: et})
assert.Empty(t, results)
})
}
}
func TestMapPackageManager(t *testing.T) {
tests := []struct {
name string
input string
expected controltowerv1.PmgPackageManager
}{
{"npm", "npm", controltowerv1.PmgPackageManager_PMG_PACKAGE_MANAGER_NPM},
{"npx", "npx", controltowerv1.PmgPackageManager_PMG_PACKAGE_MANAGER_NPM},
{"pnpm", "pnpm", controltowerv1.PmgPackageManager_PMG_PACKAGE_MANAGER_PNPM},
{"pnpx", "pnpx", controltowerv1.PmgPackageManager_PMG_PACKAGE_MANAGER_PNPM},
{"yarn", "yarn", controltowerv1.PmgPackageManager_PMG_PACKAGE_MANAGER_YARN},
{"bun", "bun", controltowerv1.PmgPackageManager_PMG_PACKAGE_MANAGER_BUN},
{"pip", "pip", controltowerv1.PmgPackageManager_PMG_PACKAGE_MANAGER_PIP},
{"pip3", "pip3", controltowerv1.PmgPackageManager_PMG_PACKAGE_MANAGER_PIP},
{"pipx", "pipx", controltowerv1.PmgPackageManager_PMG_PACKAGE_MANAGER_PIP},
{"poetry", "poetry", controltowerv1.PmgPackageManager_PMG_PACKAGE_MANAGER_POETRY},
{"uv", "uv", controltowerv1.PmgPackageManager_PMG_PACKAGE_MANAGER_UV},
{"unknown", "cargo", controltowerv1.PmgPackageManager_PMG_PACKAGE_MANAGER_UNSPECIFIED},
{"empty", "", controltowerv1.PmgPackageManager_PMG_PACKAGE_MANAGER_UNSPECIFIED},
}
for _, tc := range tests {
t.Run(tc.name, func(t *testing.T) {
assert.Equal(t, tc.expected, mapPackageManager(tc.input))
})
}
}
func TestTranslateSessionComplete(t *testing.T) {
event := AuditEvent{
Type: EventTypeSessionComplete,
SessionData: &SessionData{
PackageManager: "npm",
FlowType: FlowTypeProxy,
Outcome: OutcomeSuccess,
TotalAnalyzed: 10,
AllowedCount: 8,
BlockedCount: 1,
ConfirmedCount: 1,
TrustedSkipped: 2,
InsecureBypassed: 0,
CooldownBlockedCount: 3,
Duration: 5 * time.Second,
SandboxEnabled: true,
ParanoidMode: false,
TransitiveEnabled: true,
},
}
results := testSink.translateToPmgEvents(event)
require.Len(t, results, 1)
summary := results[0].GetSessionSummary()
require.NotNil(t, summary)
assert.Equal(t, controltowerv1.PmgPackageManager_PMG_PACKAGE_MANAGER_NPM, summary.GetPackageManager())
assert.Equal(t, controltowerv1.PmgFlowType_PMG_FLOW_TYPE_PROXY, summary.GetFlowType())
assert.Equal(t, uint32(10), summary.GetTotalAnalyzed())
assert.Equal(t, uint32(8), summary.GetAllowedCount())
assert.Equal(t, uint32(1), summary.GetBlockedCount())
assert.Equal(t, uint32(1), summary.GetConfirmedCount())
assert.Equal(t, uint32(2), summary.GetTrustedSkipped())
assert.Equal(t, uint32(3), summary.GetCooldownBlockedCount())
assert.True(t, summary.GetSandboxEnabled())
assert.False(t, summary.GetParanoidMode())
assert.True(t, summary.GetTransitiveEnabled())
assert.Equal(t, controltowerv1.PmgSessionOutcome_PMG_SESSION_OUTCOME_SUCCESS, summary.GetOutcome())
}
func TestTranslateSessionCompleteWithInsecureBypass(t *testing.T) {
event := AuditEvent{
Type: EventTypeSessionComplete,
SessionData: &SessionData{
PackageManager: "pip",
FlowType: FlowTypeGuard,
Outcome: OutcomeInsecureBypass,
InsecureBypassed: 3,
},
}
results := testSink.translateToPmgEvents(event)
require.Len(t, results, 2)
assert.Equal(t, controltowerv1.PmgEventType_PMG_EVENT_TYPE_SESSION_SUMMARY, results[0].GetEventType())
assert.Equal(t, controltowerv1.PmgEventType_PMG_EVENT_TYPE_INSECURE_BYPASS, results[1].GetEventType())
bypass := results[1].GetInsecureBypass()
require.NotNil(t, bypass)
assert.Equal(t, controltowerv1.PmgPackageManager_PMG_PACKAGE_MANAGER_PIP, bypass.GetPackageManager())
assert.Equal(t, uint32(3), bypass.GetPackagesBypassed())
}
func TestTranslateSessionCompleteNilSessionData(t *testing.T) {
event := AuditEvent{
Type: EventTypeSessionComplete,
SessionData: nil,
}
results := testSink.translateToPmgEvents(event)
assert.Empty(t, results)
}
func TestMapFlowType(t *testing.T) {
tests := []struct {
name string
input FlowType
expected controltowerv1.PmgFlowType
}{
{"guard", FlowTypeGuard, controltowerv1.PmgFlowType_PMG_FLOW_TYPE_GUARD},
{"proxy", FlowTypeProxy, controltowerv1.PmgFlowType_PMG_FLOW_TYPE_PROXY},
{"unknown", FlowType("other"), controltowerv1.PmgFlowType_PMG_FLOW_TYPE_UNSPECIFIED},
{"empty", FlowType(""), controltowerv1.PmgFlowType_PMG_FLOW_TYPE_UNSPECIFIED},
}
for _, tc := range tests {
t.Run(tc.name, func(t *testing.T) {
assert.Equal(t, tc.expected, mapFlowType(tc.input))
})
}
}
func TestMapSessionOutcome(t *testing.T) {
tests := []struct {
name string
input Outcome
expected controltowerv1.PmgSessionOutcome
}{
{"success", OutcomeSuccess, controltowerv1.PmgSessionOutcome_PMG_SESSION_OUTCOME_SUCCESS},
{"blocked", OutcomeBlocked, controltowerv1.PmgSessionOutcome_PMG_SESSION_OUTCOME_BLOCKED},
{"user_cancelled", OutcomeUserCancelled, controltowerv1.PmgSessionOutcome_PMG_SESSION_OUTCOME_USER_CANCELLED},
{"error", OutcomeError, controltowerv1.PmgSessionOutcome_PMG_SESSION_OUTCOME_ERROR},
{"dry_run", OutcomeDryRun, controltowerv1.PmgSessionOutcome_PMG_SESSION_OUTCOME_DRY_RUN},
{"insecure_bypass", OutcomeInsecureBypass, controltowerv1.PmgSessionOutcome_PMG_SESSION_OUTCOME_INSECURE_BYPASS},
{"unknown", Outcome("other"), controltowerv1.PmgSessionOutcome_PMG_SESSION_OUTCOME_UNSPECIFIED},
{"empty", Outcome(""), controltowerv1.PmgSessionOutcome_PMG_SESSION_OUTCOME_UNSPECIFIED},
}
for _, tc := range tests {
t.Run(tc.name, func(t *testing.T) {
assert.Equal(t, tc.expected, mapSessionOutcome(tc.input))
})
}
}
Reference in New Issue View Git Blame Copy Permalink