External/roboco
1
0
Fork 0
mirror of https://github.com/rennf93/roboco.git synced 2026-08-03 07:23:24 +02:00
Code Issues Packages Projects Releases Wiki Activity

test(conftest): pin ambient posture settings — the suite is hermetic now (#598)

Browse Source 
An operator .env with deploy-flavored values skewed local runs three
ways: environment=production flipped the GHSA-4f7g fail-closed auth gate
(header-trust tests 401), an armed cloud_auth 401'd every agent request,
an armed guard rate-limited the suite, and a missing encryption key
failed every crypto path. The autouse fixture pins environment,
encryption_key (per-process Fernet), cloud_auth_enabled, and
guard_enabled to schema defaults; suites exercising those postures arm
them per-test. Full suite locally: 13641 passed, 0 failed — was 174
failures under an armed .env.

Co-authored-by: Renn F <rennf93@users.noreply.github.com>
This commit is contained in:
Renzo F
2026-07-19 19:12:04 +02:00
committed by GitHub
co-authored by Renn F
parent 39ad09febc
commit db04674342
1 changed files with 27 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/conftest.py
+27
View File
@@ -47,6 +47,7 @@ from uuid import UUID, uuid4
import asyncpg
import pytest
import pytest_asyncio
from cryptography.fernet import Fernet
from roboco.config import settings as _settings
from roboco.db import tables as roboco_tables
from roboco.db.base import Base, close_db
@@ -96,6 +97,32 @@ async def _dispose_global_db_engine() -> AsyncIterator[None]:
await close_db()
_TEST_FERNET_KEY = Fernet.generate_key().decode()
@pytest.fixture(autouse=True)
def _hermetic_settings(monkeypatch: pytest.MonkeyPatch) -> None:
"""Tests never depend on the operator's ambient config (.env / shell).
A developer machine may carry a production-flavored .env (real deploy
values) or nothing at all; both skewed the suite — a missing
ROBOCO_ENCRYPTION_KEY failed every crypto-touching test with
EncryptionError, and environment=production flips the GHSA-4f7g
fail-closed auth gate so header-trust tests 401. Pin both: development
environment and a per-process Fernet key (crypto round-trips within
the run). Tests exercising production behavior monkeypatch it
per-test, which overrides this baseline.
"""
monkeypatch.setattr(_settings, "environment", "development")
monkeypatch.setattr(_settings, "encryption_key", _TEST_FERNET_KEY)
# Auth/guard posture rides ambient flags too: an armed cloud_auth 401s
# every header-trust request, an armed guard rate-limits the suite.
# Pin both to their config-schema defaults; the cloud-auth and guard
# suites arm them per-test.
monkeypatch.setattr(_settings, "cloud_auth_enabled", False)
monkeypatch.setattr(_settings, "guard_enabled", False)
@pytest.fixture(autouse=True)
def _no_live_redis(monkeypatch: pytest.MonkeyPatch) -> None:
"""Keep every test off the real localhost Redis (see module docstring).