tests/test_guard.py
1.1 KB · 40 lines · python Raw
1 """Tests for FilesystemGuard."""
2
3 from __future__ import annotations
4
5 import os
6 import platform
7
8 import pytest
9
10 from pqc_audit_log_fs.guard import FilesystemGuard
11
12
13 def test_seal_runs_without_error(tmp_path: str) -> None:
14 p = os.path.join(str(tmp_path), "f.txt")
15 with open(p, "w", encoding="utf-8") as f:
16 f.write("data")
17 guard = FilesystemGuard()
18 # Must not raise
19 guard.seal(p)
20
21
22 def test_verify_read_only_after_seal(tmp_path: str) -> None:
23 p = os.path.join(str(tmp_path), "f.txt")
24 with open(p, "w", encoding="utf-8") as f:
25 f.write("data")
26 guard = FilesystemGuard()
27 guard.seal(p)
28 if platform.system() == "Windows":
29 # On Windows, Python's os.chmod dropping write bits may not fully
30 # reflect in S_IWUSR for all file systems; if our verifier still sees
31 # the file as writable, skip rather than fail.
32 if not guard.verify_read_only(p):
33 pytest.skip("chmod does not drop S_IWUSR on this Windows filesystem")
34 assert guard.verify_read_only(p) is True
35 # Restore write to allow pytest tmp cleanup
36 try:
37 os.chmod(p, 0o644)
38 except OSError:
39 pass
40