mirror of
https://github.com/safedep/pmg.git
synced 2026-08-03 07:24:09 +02:00
Sahil BansalandGitHub
2d938ea381
* docs(specs): add custom block messages and package blocklist spec * docs(specs): add custom block messages and package blocklist implementation plan * feat(config): add blocked_packages list and custom block messages * feat(audit): add package_blocklist_blocked event and blocklist model * feat(proxy): block blocklisted packages in the policy gate before analysis * feat(guard): block blocklisted packages before trust skip and analysis * feat(ui): render blocklist blocks and custom messages, fix silent-mode block output * feat(proxy): append custom messages to malware and go-cooldown block bodies * test(proxye2e): cover blocklist enforcement and custom block messages * docs(specs): remove spec and plan documents * refactor: drop guard-flow blocklist enforcement and trim docs Guard mode is being deprecated; the blocklist is enforced in proxy mode only. Remove the trusted_packages mirroring references outside the docs. * refactor(config): consolidate blocklist and block message under top-level block section Replace dependency_cooldown.message, malware.message and blocked_packages with a single block section: block.message is appended to every block output regardless of which control blocked, and block.packages is the package blocklist. * fix(ui): render block.message as info note with clean spacing * fix(ui): indent wrapped continuation lines in block reasons and messages * update config template * refactor(config): replace block section with top-level advisory_message Remove the package blocklist (will be implemented as part of policies in the future) and replace block.message with an optional top-level advisory_message appended to every block output. * chore(config): move advisory_message near top-level scalar configs in template
72 lines
1.8 KiB
Go
72 lines
1.8 KiB
Go
package proxye2e
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"github.com/safedep/pmg/config"
|
|
)
|
|
|
|
// TestCase is one end-to-end scenario. Config mutates the global PMG config for
|
|
// the case; Setup registers fixtures and verdicts; Exec drives traffic; Assert
|
|
// verifies the outcome.
|
|
type TestCase struct {
|
|
Name string
|
|
PinnedVersions map[string]string
|
|
Config func(rc *config.RuntimeConfig)
|
|
Setup func(h *Harness)
|
|
Exec func(h *Harness) ExecResult
|
|
Assert func(t *testing.T, h *Harness, result ExecResult)
|
|
}
|
|
|
|
// RunCases runs each case serially. Serial execution is required because the
|
|
// interceptors read the global config singleton at request time, which the
|
|
// runner mutates per case.
|
|
func RunCases(t *testing.T, cases []TestCase) {
|
|
for _, tc := range cases {
|
|
t.Run(tc.Name, func(t *testing.T) {
|
|
applyConfig(t, tc.Config)
|
|
|
|
h := New(t, WithPinnedVersions(tc.PinnedVersions))
|
|
defer h.Close()
|
|
|
|
if tc.Setup != nil {
|
|
tc.Setup(h)
|
|
}
|
|
|
|
var result ExecResult
|
|
if tc.Exec != nil {
|
|
result = tc.Exec(h)
|
|
}
|
|
|
|
if tc.Assert != nil {
|
|
tc.Assert(t, h, result)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
// applyConfig resets the security-relevant config fields to a known hermetic
|
|
// baseline, applies the case override, then restores the original on cleanup so
|
|
// a developer's on-disk config never leaks into a case.
|
|
func applyConfig(t *testing.T, override func(rc *config.RuntimeConfig)) {
|
|
t.Helper()
|
|
|
|
rc := config.Get()
|
|
saved := *rc
|
|
t.Cleanup(func() { *rc = saved })
|
|
|
|
rc.InsecureInstallation = false
|
|
rc.Config.Paranoid = false
|
|
rc.Config.TrustedPackages = nil
|
|
rc.Config.DependencyCooldown = config.DependencyCooldownConfig{}
|
|
rc.Config.AdvisoryMessage = ""
|
|
|
|
if override != nil {
|
|
override(rc)
|
|
}
|
|
|
|
if err := config.PreprocessPackageRefs(&rc.Config); err != nil {
|
|
t.Fatalf("failed to preprocess trusted packages: %v", err)
|
|
}
|
|
}
|