@agentikos/omega-os 0.1.0 → 0.19.5

package/omega/Agentik_Engine/tests/test_vault.py

@@ -0,0 +1,173 @@
+"""Tests for the encrypted secrets vault.
+
+Two backends to exercise:
+
+  * **plain** — always runs (the fallback when `age` is not installed).
+  * **age**   — runs only when `age` and `age-keygen` are both on PATH.
+                We skip the age-specific cases otherwise so CI on minimal
+                hosts doesn't go red.
+
+Also exercises the path-traversal refusal and the round-trip invariant
+(write then read returns the same value).
+"""
+from __future__ import annotations
+
+import os
+import shutil
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+from unittest import mock
+
+
+HERE = Path(__file__).resolve().parent
+sys.path.insert(0, str(HERE.parent))
+
+from omega_engine.vault import (  # noqa: E402
+    _safe_ref,
+    vault_init,
+    vault_read,
+    vault_status,
+    vault_write,
+)
+
+
+AGE_AVAILABLE = bool(shutil.which("age")) and bool(shutil.which("age-keygen"))
+
+
+class TestSafeRef(unittest.TestCase):
+    def test_rejects_empty(self):
+        with self.assertRaises(ValueError):
+            _safe_ref("")
+
+    def test_rejects_path_traversal(self):
+        for bad in ("../escape", "a/b", "x\\y", ".hidden"):
+            with self.assertRaises(ValueError):
+                _safe_ref(bad)
+
+    def test_accepts_flat_names(self):
+        for good in ("CLAUDE_OAUTH", "max-primary_TOKEN", "abc123"):
+            self.assertEqual(_safe_ref(good), good)
+
+
+class TestPlainBackend(unittest.TestCase):
+    """The fallback backend, always available."""
+
+    def test_init_with_no_age_picks_plain(self):
+        with tempfile.TemporaryDirectory() as td:
+            with mock.patch("omega_engine.vault._age_available", return_value=False):
+                info = vault_init(td)
+            self.assertEqual(info["backend"], "plain")
+            self.assertFalse(info["age_installed"])
+            sec = Path(td) / "Agentik_Extra" / "etc" / "secrets"
+            self.assertTrue(sec.is_dir())
+            # secrets dir is mode 700
+            mode = sec.stat().st_mode & 0o777
+            self.assertEqual(mode, 0o700)
+
+    def test_round_trip_plain(self):
+        with tempfile.TemporaryDirectory() as td:
+            with mock.patch("omega_engine.vault._age_available", return_value=False):
+                path = vault_write(td, "MY_TOKEN", "s3cret-value")
+                # mode 600
+                mode = path.stat().st_mode & 0o777
+                self.assertEqual(mode, 0o600)
+                # file is named without .age suffix in plain mode
+                self.assertTrue(path.name.endswith("MY_TOKEN"))
+                self.assertFalse(path.name.endswith(".age"))
+
+                got = vault_read(td, "MY_TOKEN")
+                self.assertEqual(got, "s3cret-value")
+
+    def test_read_returns_none_when_missing(self):
+        with tempfile.TemporaryDirectory() as td:
+            with mock.patch("omega_engine.vault._age_available", return_value=False):
+                self.assertIsNone(vault_read(td, "ABSENT"))
+
+    def test_overwrite_rotates_in_place(self):
+        with tempfile.TemporaryDirectory() as td:
+            with mock.patch("omega_engine.vault._age_available", return_value=False):
+                vault_write(td, "TOK", "v1")
+                vault_write(td, "TOK", "v2")
+                self.assertEqual(vault_read(td, "TOK"), "v2")
+
+    def test_status_counts_plain(self):
+        with tempfile.TemporaryDirectory() as td:
+            with mock.patch("omega_engine.vault._age_available", return_value=False):
+                vault_write(td, "A", "1")
+                vault_write(td, "B", "2")
+                status = vault_status(td)
+            self.assertEqual(status["backend"], "plain")
+            self.assertEqual(status["plaintext_count"], 2)
+            self.assertEqual(status["encrypted_count"], 0)
+
+
+@unittest.skipUnless(AGE_AVAILABLE, "age + age-keygen not installed on this host")
+class TestAgeBackend(unittest.TestCase):
+    """Exercised only when age is installed (CI may or may not have it)."""
+
+    def test_init_generates_keypair(self):
+        with tempfile.TemporaryDirectory() as td:
+            info = vault_init(td)
+            self.assertEqual(info["backend"], "age")
+            key = Path(info["key_path"])
+            pub = Path(info["pub_path"])
+            self.assertTrue(key.exists())
+            self.assertTrue(pub.exists())
+            self.assertEqual(key.stat().st_mode & 0o777, 0o600)
+            # public key file starts with "age1"
+            self.assertTrue(pub.read_text().strip().startswith("age1"))
+
+    def test_init_is_idempotent(self):
+        with tempfile.TemporaryDirectory() as td:
+            a = vault_init(td)
+            b = vault_init(td)
+            self.assertEqual(a["key_path"], b["key_path"])
+            self.assertEqual(a["pub_path"], b["pub_path"])
+
+    def test_round_trip_age(self):
+        with tempfile.TemporaryDirectory() as td:
+            path = vault_write(td, "OAUTH_X", "abc-DEF-123")
+            self.assertTrue(path.name.endswith(".age"))
+            mode = path.stat().st_mode & 0o777
+            self.assertEqual(mode, 0o600)
+            got = vault_read(td, "OAUTH_X")
+            self.assertEqual(got, "abc-DEF-123")
+
+    def test_status_counts_encrypted(self):
+        with tempfile.TemporaryDirectory() as td:
+            vault_write(td, "A", "1")
+            vault_write(td, "B", "2")
+            status = vault_status(td)
+            self.assertEqual(status["backend"], "age")
+            self.assertEqual(status["encrypted_count"], 2)
+            self.assertEqual(status["plaintext_count"], 0)
+
+    def test_write_cleans_up_old_plaintext(self):
+        with tempfile.TemporaryDirectory() as td:
+            # Pre-seed a plaintext file as if from a legacy install.
+            with mock.patch("omega_engine.vault._age_available", return_value=False):
+                vault_write(td, "LEGACY", "old")
+            # Now write through the age backend.
+            vault_write(td, "LEGACY", "new")
+            sec = Path(td) / "Agentik_Extra" / "etc" / "secrets"
+            self.assertTrue((sec / "LEGACY.age").exists())
+            self.assertFalse((sec / "LEGACY").exists(),
+                             "old plaintext should have been cleaned up")
+            self.assertEqual(vault_read(td, "LEGACY"), "new")
+
+
+class TestAccountUsesVault(unittest.TestCase):
+    """`account.write_token` / `read_token` must round-trip through the vault."""
+
+    def test_account_token_round_trip(self):
+        from omega_engine.account import read_token, write_token
+
+        with tempfile.TemporaryDirectory() as td:
+            write_token(td, "MAX_PRIMARY", "claude-token-xyz")
+            self.assertEqual(read_token(td, "MAX_PRIMARY"), "claude-token-xyz")
+
+
+if __name__ == "__main__":
+    unittest.main(verbosity=2)

package/omega/Agentik_Engine/tests/test_webhooks_and_readiness.py

@@ -0,0 +1,277 @@
+"""Tests for inbound webhooks (HMAC gate) + the doctor's Ready verdict.
+
+Two pieces under test:
+
+1. ``omega_engine.webhooks``
+   * ``WebhookRegistry`` loads from the SSOT YAML
+   * ``verify_signature`` rejects missing/wrong-format/wrong-value sigs
+   * ``handle_webhook`` runs the gate end-to-end + fires the supervisor
+   * GitHub + Linear + generic source formats
+
+2. ``omega doctor`` ends with READY / PARTIAL / NOT_READY
+   * Empty tree → NOT_READY
+   * Full tree with no provider creds → PARTIAL
+"""
+from __future__ import annotations
+
+import io
+import json
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+from unittest import mock
+
+import yaml
+
+
+HERE = Path(__file__).resolve().parent
+sys.path.insert(0, str(HERE.parent))
+
+from omega_engine.webhooks import (  # noqa: E402
+    WebhookRegistry,
+    WebhookSpec,
+    generate_test_signature,
+    handle_webhook,
+    load_registry,
+    signature_header_for,
+    verify_signature,
+)
+
+
+# ---------------------------------------------------------------------------
+# Signature verification — the hard line
+# ---------------------------------------------------------------------------
+
+
+class TestVerifySignature(unittest.TestCase):
+    SECRET = "hunter2"
+
+    def test_missing_header_rejected(self):
+        ok, reason = verify_signature("github", b"body", None, self.SECRET)
+        self.assertFalse(ok)
+        self.assertIn("missing signature", reason)
+
+    def test_missing_secret_rejected(self):
+        ok, reason = verify_signature("github", b"body",
+                                       "sha256=" + "0" * 64, "")
+        self.assertFalse(ok)
+        self.assertIn("secret not set", reason)
+
+    def test_github_correct(self):
+        body = b'{"action":"opened"}'
+        sig = generate_test_signature("github", body, self.SECRET)
+        ok, _ = verify_signature("github", body, sig, self.SECRET)
+        self.assertTrue(ok)
+
+    def test_github_wrong_secret(self):
+        body = b'{"action":"opened"}'
+        sig = generate_test_signature("github", body, "different")
+        ok, reason = verify_signature("github", body, sig, self.SECRET)
+        self.assertFalse(ok)
+        self.assertIn("mismatch", reason)
+
+    def test_github_missing_prefix(self):
+        ok, reason = verify_signature("github", b"x",
+                                       "0" * 64,  # no "sha256=" prefix
+                                       self.SECRET)
+        self.assertFalse(ok)
+        self.assertIn("prefix", reason)
+
+    def test_linear_correct(self):
+        body = b'{"data":"..."}'
+        sig = generate_test_signature("linear", body, self.SECRET)
+        ok, _ = verify_signature("linear", body, sig, self.SECRET)
+        self.assertTrue(ok)
+
+    def test_generic_correct(self):
+        body = b'arbitrary payload'
+        sig = generate_test_signature("generic", body, self.SECRET)
+        ok, _ = verify_signature("generic", body, sig, self.SECRET)
+        self.assertTrue(ok)
+
+    def test_unknown_source(self):
+        ok, reason = verify_signature("aliens", b"x", "sha256=0", self.SECRET)
+        self.assertFalse(ok)
+        self.assertIn("unknown source", reason)
+
+
+# ---------------------------------------------------------------------------
+# Registry
+# ---------------------------------------------------------------------------
+
+
+class TestRegistry(unittest.TestCase):
+    def _seed(self, td: Path) -> Path:
+        d = td / "Agentik_SSOT" / "webhooks"
+        d.mkdir(parents=True)
+        (d / "webhooks.yaml").write_text(yaml.safe_dump({
+            "webhooks": [
+                {"id": "github-prs", "path": "/webhook/github-prs",
+                 "source": "github", "secret_ref": "GITHUB_HOOK_SECRET"},
+                {"id": "linear-issues", "path": "/webhook/linear-issues",
+                 "source": "linear", "secret_ref": "LINEAR_HOOK_SECRET"},
+            ],
+        }))
+        return td
+
+    def test_load(self):
+        with tempfile.TemporaryDirectory() as td:
+            home = self._seed(Path(td))
+            reg = load_registry(home)
+            self.assertEqual(len(reg.specs), 2)
+            self.assertEqual(reg.by_path("/webhook/github-prs").source, "github")
+            self.assertIsNone(reg.by_path("/webhook/nope"))
+
+    def test_load_missing_file(self):
+        with tempfile.TemporaryDirectory() as td:
+            reg = load_registry(Path(td))
+            self.assertEqual(reg.specs, [])
+
+
+# ---------------------------------------------------------------------------
+# handle_webhook — end to end
+# ---------------------------------------------------------------------------
+
+
+class TestHandleWebhook(unittest.TestCase):
+    def _seed_with_secret(self, td: Path) -> Path:
+        # SSOT + a vault entry for the secret.
+        d = td / "Agentik_SSOT" / "webhooks"
+        d.mkdir(parents=True)
+        (d / "webhooks.yaml").write_text(yaml.safe_dump({
+            "webhooks": [{
+                "id": "github-prs",
+                "path": "/webhook/github-prs",
+                "source": "github",
+                "secret_ref": "GITHUB_HOOK_SECRET",
+            }],
+        }))
+        from omega_engine.vault import vault_write
+        vault_write(td, "GITHUB_HOOK_SECRET", "hunter2")
+        return td
+
+    def test_unknown_path_404(self):
+        with tempfile.TemporaryDirectory() as td:
+            self._seed_with_secret(Path(td))
+            r = handle_webhook(
+                td, path="/webhook/does-not-exist",
+                headers={}, body=b"",
+            )
+            self.assertEqual(r["status"], 404)
+            self.assertFalse(r["ok"])
+
+    def test_bad_signature_401(self):
+        with tempfile.TemporaryDirectory() as td:
+            self._seed_with_secret(Path(td))
+            r = handle_webhook(
+                td, path="/webhook/github-prs",
+                headers={"X-Hub-Signature-256": "sha256=" + "0" * 64},
+                body=b'{"action":"opened"}',
+            )
+            self.assertEqual(r["status"], 401)
+            self.assertFalse(r["ok"])
+
+    def test_valid_signature_no_supervisor_returns_200(self):
+        with tempfile.TemporaryDirectory() as td:
+            self._seed_with_secret(Path(td))
+            body = b'{"action":"opened"}'
+            sig = generate_test_signature("github", body, "hunter2")
+            r = handle_webhook(
+                td, path="/webhook/github-prs",
+                headers={"X-Hub-Signature-256": sig},
+                body=body,
+            )
+            self.assertEqual(r["status"], 200)
+            self.assertTrue(r["ok"])
+            self.assertEqual(r["fired"], [])
+
+    def test_valid_signature_fires_supervisor(self):
+        with tempfile.TemporaryDirectory() as td:
+            self._seed_with_secret(Path(td))
+            body = b'{"action":"opened"}'
+            sig = generate_test_signature("github", body, "hunter2")
+
+            class _FakeSupervisor:
+                def __init__(self): self.calls = []
+                def wake_webhook(self, path, payload):
+                    self.calls.append((path, payload))
+                    return ["fake-charter-1"]
+
+            sup = _FakeSupervisor()
+            r = handle_webhook(
+                td, path="/webhook/github-prs",
+                headers={"X-Hub-Signature-256": sig},
+                body=body, supervisor=sup,
+            )
+            self.assertEqual(r["status"], 202)
+            self.assertEqual(r["fired"], ["fake-charter-1"])
+            self.assertEqual(sup.calls[0][0], "/webhook/github-prs")
+            self.assertEqual(sup.calls[0][1]["action"], "opened")
+
+
+# ---------------------------------------------------------------------------
+# Doctor's Ready / Partial / Not Ready verdict
+# ---------------------------------------------------------------------------
+
+
+class TestDoctorReadiness(unittest.TestCase):
+    """We don't run the full doctor here (it touches dozens of subsystems);
+    we exercise the verdict logic by feeding it controlled results."""
+
+    def _verdict_from_results(self, results):
+        """Replicate the in-cli verdict logic against a controlled list."""
+        CRITICAL = {
+            "structure", "event store", "vault", "providers",
+            "accounts", "aisb suite", "educators",
+        }
+        IMPORTANT = {
+            "24/7 services", "telegram", "llm clis",
+            "claude code settings", "audit history", "mcp",
+        }
+        critical_fails = []
+        important_warns = []
+        for r in results:
+            if r["status"] == "FAIL":
+                critical_fails.append(r)
+            elif r["status"] == "warn" and r["section"] in IMPORTANT:
+                important_warns.append(r)
+        if critical_fails:
+            return "NOT_READY"
+        if important_warns:
+            return "PARTIAL"
+        return "READY"
+
+    def test_all_ok_is_ready(self):
+        results = [
+            {"section": "structure", "status": "ok", "msg": "..."},
+            {"section": "vault", "status": "ok", "msg": "..."},
+            {"section": "providers", "status": "ok", "msg": "..."},
+        ]
+        self.assertEqual(self._verdict_from_results(results), "READY")
+
+    def test_one_fail_is_not_ready(self):
+        results = [
+            {"section": "vault", "status": "FAIL", "msg": "no backend"},
+            {"section": "structure", "status": "ok", "msg": "..."},
+        ]
+        self.assertEqual(self._verdict_from_results(results), "NOT_READY")
+
+    def test_warns_on_important_is_partial(self):
+        results = [
+            {"section": "structure", "status": "ok", "msg": "..."},
+            {"section": "telegram", "status": "warn", "msg": "no token"},
+        ]
+        self.assertEqual(self._verdict_from_results(results), "PARTIAL")
+
+    def test_warns_only_on_optional_is_ready(self):
+        results = [
+            {"section": "structure", "status": "ok", "msg": "..."},
+            {"section": "event store", "status": "warn", "msg": "empty"},
+        ]
+        # "event store" is NOT in IMPORTANT — empty is fine on a fresh install.
+        self.assertEqual(self._verdict_from_results(results), "READY")
+
+
+if __name__ == "__main__":
+    unittest.main(verbosity=2)