43 lines
1.3 KiB
Python
43 lines
1.3 KiB
Python
import pytest
|
|
|
|
from nexus_sync.client.config import COMMAND_ACCESS_ENV, load_command_access_policy
|
|
from nexus_sync.client.execute import CommandAccessPolicy
|
|
|
|
|
|
def test_load_command_access_policy_defaults_to_deny_all() -> None:
|
|
policy = load_command_access_policy({})
|
|
|
|
assert not policy.full_access
|
|
assert not policy.allows("hostname")
|
|
|
|
|
|
def test_load_command_access_policy_uses_default_when_env_is_missing() -> None:
|
|
default = CommandAccessPolicy.allow(["hostname"])
|
|
|
|
policy = load_command_access_policy({}, default=default)
|
|
|
|
assert policy == default
|
|
|
|
|
|
def test_load_command_access_policy_supports_command_allowlist() -> None:
|
|
policy = load_command_access_policy(
|
|
{COMMAND_ACCESS_ENV: "hostname, network_interfaces"},
|
|
)
|
|
|
|
assert policy.allows("hostname")
|
|
assert policy.allows("network_interfaces")
|
|
assert not policy.allows("unknown")
|
|
|
|
|
|
def test_load_command_access_policy_supports_full_access() -> None:
|
|
policy = load_command_access_policy({COMMAND_ACCESS_ENV: "full_access"})
|
|
|
|
assert policy.full_access
|
|
assert policy.allows("hostname")
|
|
assert policy.allows("future_registered_preset")
|
|
|
|
|
|
def test_load_command_access_policy_rejects_mixed_full_access() -> None:
|
|
with pytest.raises(ValueError, match="cannot be mixed"):
|
|
load_command_access_policy({COMMAND_ACCESS_ENV: "hostname,full_access"})
|