tests/test_policy.py
1.6 KB · 63 lines · python Raw
1 """Tests for AccessPolicy / ArtifactPolicy."""
2
3 from __future__ import annotations
4
5 import pytest
6
7 from pqc_enclave_sdk import (
8 AccessPolicy,
9 ArtifactKind,
10 ArtifactMetadata,
11 ArtifactPolicy,
12 PolicyViolationError,
13 )
14
15
16 def _meta(
17 kind: ArtifactKind, bundle: str = "com.example.app"
18 ) -> ArtifactMetadata:
19 return ArtifactMetadata(
20 artifact_id="id",
21 name="n",
22 kind=kind,
23 app_bundle_id=bundle,
24 )
25
26
27 def test_no_rule_allows_by_default() -> None:
28 policy = AccessPolicy()
29 policy.check(_meta(ArtifactKind.MODEL_WEIGHTS), "com.any.caller")
30
31
32 def test_allowed_bundle_ids_filters_callers() -> None:
33 policy = AccessPolicy().add(
34 ArtifactPolicy(
35 kind=ArtifactKind.CREDENTIAL,
36 allowed_bundle_ids=frozenset({"com.example.trusted"}),
37 )
38 )
39 policy.check(_meta(ArtifactKind.CREDENTIAL), "com.example.trusted")
40
41
42 def test_empty_allow_list_without_biometric_allows() -> None:
43 policy = AccessPolicy().add(
44 ArtifactPolicy(
45 kind=ArtifactKind.TOKENIZER,
46 allowed_bundle_ids=frozenset(),
47 require_biometric=False,
48 )
49 )
50 # Empty allow-list means any bundle; check should not raise.
51 policy.check(_meta(ArtifactKind.TOKENIZER), "com.random.bundle")
52
53
54 def test_check_raises_on_denied_caller() -> None:
55 policy = AccessPolicy().add(
56 ArtifactPolicy(
57 kind=ArtifactKind.CREDENTIAL,
58 allowed_bundle_ids=frozenset({"com.example.trusted"}),
59 )
60 )
61 with pytest.raises(PolicyViolationError):
62 policy.check(_meta(ArtifactKind.CREDENTIAL), "com.example.malicious")
63