o
    )n\j                      @  s  d Z ddlmZ ddlZddlZddlZddlmZ ee	 j
d Zejdee ejdZedur?eeds?ejd= ddlmZ dd	lmZ dd
lmZ ddlmZ ddlmZ ddlmZmZ ddl m!Z!m"Z" G dd dej#Z$e%dkrej&dd dS dS )z.Standalone authenticated tenant-secret checks.    )annotationsN)Path   platform__path__)create_engine)Session)
StaticPool)Base)secrets_manager)SecretIntegrityErrorVersionedAESCipher)AppTenantc                   @  s<   e Zd Zdd Zdd Zdd Zdd Zd	d
 Zdd ZdS )SecretChecksc                   s   t ddditdd _tj j tj _ fddt_t	 jdd)}|
td	d	d
dddtddddddtddddddg |  W d    n1 sPw   Y  tdddd _t j _d S )Nz	sqlite://check_same_threadFT)connect_args	poolclassfuturec                     s   t  jddS )NTr   )r   engine selfr   ;/var/www/html/flask_server/tests/platform/secrets_checks.py<lambda>"   s    z$SecretChecks.setUp.<locals>.<lambda>r   tenant-azTenant Aactive)	tenant_idslugnamestatus	is_activetenant-bzTenant Bapp-azApp Az
apps.app_az/app-a)app_iddisplay_namemodule_pathroute_prefixr"       11111111111111111111111111111111s    22222222222222222222222222222222)key-1key-2r+   )r   r	   r   r
   metadata
create_allr   get_control_plane_sessionoriginal_factoryr   add_allr   r   commitr   cipherSecretsManagermanager)r   sessionr   r   r   setUp   s&   

zSecretChecks.setUpc                 C  s   | j t_| j  d S )N)r/   r   r.   r   disposer   r   r   r   tearDown/   s   zSecretChecks.tearDownc                 C  sh   | j jdddddd | d| j jdddd | j jddd}| d	|d
 d  | d|d
  d S )Nr   r$   	api_tokenzvery-secretadmin)r   r%   secret_namesecret_valueactor_id)r   r%   r;   )r   r%   r+   r   key_versionr<   )r4   
put_secretassertEqual
get_secretlist_secret_metadataassertNotIn)r   r,   r   r   r   5test_secret_round_trip_returns_metadata_without_value3   s   zBSecretChecks.test_secret_round_trip_returns_metadata_without_valuec                 C  sj   | j jd| jdddd}| t | j j|j| jdddd W d    d S 1 s.w   Y  d S )Nsecretr   r$   r9   aadr#   )r2   encryptr4   _aadassertRaisesr   decrypt
ciphertext)r   	encryptedr   r   r   +test_ciphertext_cannot_move_between_tenants?   s   "z8SecretChecks.test_ciphertext_cannot_move_between_tenantsc                 C  sx   | j jd dd}|jd d |jd dkrdnd }| t | j j|dd W d    d S 1 s5w   Y  d S )Ns   secret   scoperF   AB)r2   rH   decoderL   rJ   r   rK   )r   rM   tamperedr   r   r   test_tampering_is_rejectedI   s
   $"z'SecretChecks.test_tampering_is_rejectedc                 C  s:   t ddid}|jddd}| d| jj|jdd d S )Nr*   r)   legacyrO   rF   )r   rH   r@   r2   rK   rL   )r   
old_cipherrM   r   r   r   (test_old_key_version_remains_decryptableO   s   z5SecretChecks.test_old_key_version_remains_decryptableN)	__name__
__module____qualname__r6   r8   rD   rN   rU   rX   r   r   r   r   r      s    
r   __main__)	verbosity)'__doc__
__future__r   ossysunittestpathlibr   __file__resolveparentsPROJECT_ROOTpathinsertstrmodulesgetloaded_platformhasattr
sqlalchemyr   sqlalchemy.ormr   sqlalchemy.poolr	   	config.dbr
   platform.secretsr   platform.secrets.encryptionr   r   platform.tenants.modelsr   r   TestCaser   rY   mainr   r   r   r   <module>   s,    ;