82 lines
3.3 KiB
Python
82 lines
3.3 KiB
Python
from __future__ import annotations
|
|
|
|
import os
|
|
import stat
|
|
import unittest
|
|
|
|
from .fixtures import isolated_environment
|
|
|
|
|
|
class FixtureTests(unittest.TestCase):
|
|
def test_fixture_uses_private_directories_and_separate_sessions(self) -> None:
|
|
inherited = os.environ.copy()
|
|
inherited.update(
|
|
{
|
|
"OPENAI_API_KEY": "must-not-cross-boundary",
|
|
"GITHUB_TOKEN": "must-not-cross-boundary",
|
|
"SSH_AUTH_SOCK": "/tmp/host-agent.sock",
|
|
"CUSTOM_SECRET_VALUE": "must-not-cross-boundary",
|
|
}
|
|
)
|
|
with isolated_environment() as fixture:
|
|
# The fixture intentionally does not accept an inherited environment;
|
|
# this test still checks that the resulting allowlist is safe.
|
|
self.assertNotIn("OPENAI_API_KEY", fixture.env)
|
|
self.assertNotIn("GITHUB_TOKEN", fixture.env)
|
|
self.assertNotIn("SSH_AUTH_SOCK", fixture.env)
|
|
self.assertNotIn("CUSTOM_SECRET_VALUE", fixture.env)
|
|
session_environment = fixture.session("one").environment(inherited)
|
|
self.assertNotIn("OPENAI_API_KEY", session_environment)
|
|
self.assertNotIn("GITHUB_TOKEN", session_environment)
|
|
self.assertNotIn("SSH_AUTH_SOCK", session_environment)
|
|
self.assertNotIn("CUSTOM_SECRET_VALUE", session_environment)
|
|
self.assertEqual(
|
|
set(fixture.env),
|
|
{
|
|
"HOME",
|
|
"XDG_CONFIG_HOME",
|
|
"XDG_STATE_HOME",
|
|
"XDG_CACHE_HOME",
|
|
"XDG_RUNTIME_DIR",
|
|
"TMPDIR",
|
|
"PATH",
|
|
"LANG",
|
|
"LC_ALL",
|
|
"PYTHONDONTWRITEBYTECODE",
|
|
},
|
|
)
|
|
for path in (
|
|
fixture.root,
|
|
fixture.home,
|
|
fixture.xdg_config_home,
|
|
fixture.xdg_state_home,
|
|
fixture.xdg_cache_home,
|
|
fixture.xdg_runtime_dir,
|
|
fixture.tmpdir,
|
|
fixture.repos,
|
|
fixture.sessions,
|
|
fixture.stub_bin,
|
|
):
|
|
assert path is not None
|
|
self.assertEqual(stat.S_IMODE(path.stat().st_mode), 0o700, path)
|
|
first = fixture.session("one")
|
|
second = fixture.session("two")
|
|
self.assertNotEqual(first.tmp, second.tmp)
|
|
self.assertNotEqual(first.state, second.state)
|
|
self.assertEqual(stat.S_IMODE(first.tmp.stat().st_mode), 0o700)
|
|
self.assertEqual(stat.S_IMODE(second.state.stat().st_mode), 0o700)
|
|
|
|
def test_session_environment_points_only_at_its_paths(self) -> None:
|
|
with isolated_environment() as fixture:
|
|
session = fixture.session("one")
|
|
environment = session.environment(fixture.env)
|
|
self.assertEqual(environment["HOME"], str(session.home))
|
|
self.assertEqual(environment["XDG_STATE_HOME"], str(session.state))
|
|
self.assertEqual(environment["XDG_RUNTIME_DIR"], str(session.runtime))
|
|
self.assertEqual(environment["TMPDIR"], str(session.tmp))
|
|
self.assertNotIn("GH_TOKEN", environment)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|