70 lines
2.5 KiB
Python
70 lines
2.5 KiB
Python
"""Regression tests for hermetic guards around local desktop side effects."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import webbrowser
|
|
|
|
|
|
def test_webbrowser_open_calls_are_neutralized(monkeypatch):
|
|
"""OAuth/browser tests should never reach the real browser registry."""
|
|
|
|
def _real_browser_lookup_reached(*_args, **_kwargs):
|
|
raise AssertionError("test reached the real webbrowser registry")
|
|
|
|
monkeypatch.setattr(webbrowser, "get", _real_browser_lookup_reached)
|
|
|
|
url = "https://provider.example.invalid/oauth/authorize"
|
|
|
|
assert webbrowser.open(url) is True
|
|
assert webbrowser.open_new(url) is True
|
|
assert webbrowser.open_new_tab(url) is True
|
|
|
|
|
|
def test_webbrowser_get_controller_is_neutralized(_neutralize_webbrowser):
|
|
"""Direct controller access should still stay inside the test recorder."""
|
|
url = "https://provider.example.invalid/oauth/authorize"
|
|
|
|
controller = webbrowser.get("hermes-test-browser")
|
|
|
|
assert controller.open(url) is True
|
|
assert controller.open_new(url) is True
|
|
assert controller.open_new_tab(url) is True
|
|
assert _neutralize_webbrowser == [url, url, url]
|
|
|
|
|
|
def _isolate_anthropic_credentials(monkeypatch, tmp_path):
|
|
from agent import anthropic_adapter as aa
|
|
from agent import anthropic_credentials as ac
|
|
|
|
monkeypatch.delenv("ANTHROPIC_API_KEY", raising=False)
|
|
monkeypatch.delenv("ANTHROPIC_TOKEN", raising=False)
|
|
monkeypatch.delenv("CLAUDE_CODE_OAUTH_TOKEN", raising=False)
|
|
# Patch the implementation owner (anthropic_credentials); the adapter
|
|
# merely re-exports these functions after the godfile split.
|
|
monkeypatch.setattr(ac.Path, "home", lambda: tmp_path)
|
|
monkeypatch.setattr(ac.platform, "system", lambda: "Darwin")
|
|
|
|
def _real_keychain_reached(*_args, **_kwargs):
|
|
raise AssertionError("test reached the real macOS Keychain command")
|
|
|
|
monkeypatch.setattr(ac.subprocess, "run", _real_keychain_reached)
|
|
return aa
|
|
|
|
|
|
def test_claude_code_credential_read_does_not_touch_macos_keychain(
|
|
monkeypatch, tmp_path
|
|
):
|
|
"""The real credential reader should be safe under the suite guard."""
|
|
aa = _isolate_anthropic_credentials(monkeypatch, tmp_path)
|
|
|
|
assert aa.read_claude_code_credentials() is None
|
|
|
|
|
|
def test_anthropic_token_resolution_does_not_touch_macos_keychain(
|
|
monkeypatch, tmp_path
|
|
):
|
|
"""Token resolution should be safe under the same suite guard."""
|
|
aa = _isolate_anthropic_credentials(monkeypatch, tmp_path)
|
|
|
|
assert aa.resolve_anthropic_token() is None
|