aiox-core 5.0.3 → 5.0.4

package/pro/squads/squad-creator-pro/scripts/tests/test_security_scanner.py

@@ -1,354 +1,354 @@
-#!/usr/bin/env python3
-"""
-Tests for security_scanner.py
-Run with: pytest scripts/tests/test_security_scanner.py -v
-"""
-
-import os
-import sys
-import json
-import pytest
-import tempfile
-from pathlib import Path
-
-# Add parent directory to path for imports
-sys.path.insert(0, str(Path(__file__).parent.parent))
-
-from security_scanner import (
-    scan_file_content,
-    scan_for_files,
-    scan_squad,
-    SecurityIssue,
-    SecurityResult,
-    SECURITY_CHECKS,
-    FILE_CHECKS,
-)
-
-
-class TestAPIKeyDetection:
-    """Tests for API key detection (SEC-001)"""
-
-    def test_detects_api_key(self):
-        """Should detect hardcoded API keys"""
-        with tempfile.NamedTemporaryFile(mode='w', suffix='.md', delete=False) as f:
-            f.write('config:\n  api_key: "sk-1234567890abcdef1234567890abcdef"\n')
-            f.flush()
-
-            issues = scan_file_content(
-                Path(f.name),
-                "SEC-001",
-                SECURITY_CHECKS["SEC-001"]
-            )
-
-            # Should detect (unless excluded by pattern)
-            # Note: "sk-1234" is in exclusion list, but full key should be caught
-            os.unlink(f.name)
-
-    def test_ignores_placeholder(self):
-        """Should ignore placeholder values"""
-        with tempfile.NamedTemporaryFile(mode='w', suffix='.md', delete=False) as f:
-            f.write('config:\n  api_key: "${API_KEY}"\n')
-            f.flush()
-
-            issues = scan_file_content(
-                Path(f.name),
-                "SEC-001",
-                SECURITY_CHECKS["SEC-001"]
-            )
-
-            assert len(issues) == 0
-            os.unlink(f.name)
-
-    def test_ignores_example(self):
-        """Should ignore example values"""
-        with tempfile.NamedTemporaryFile(mode='w', suffix='.md', delete=False) as f:
-            f.write('# Example:\n  api_key: "your-key-here-example"\n')
-            f.flush()
-
-            issues = scan_file_content(
-                Path(f.name),
-                "SEC-001",
-                SECURITY_CHECKS["SEC-001"]
-            )
-
-            assert len(issues) == 0
-            os.unlink(f.name)
-
-
-class TestSecretDetection:
-    """Tests for secret/password detection (SEC-002)"""
-
-    def test_detects_password(self):
-        """Should detect hardcoded passwords"""
-        with tempfile.NamedTemporaryFile(mode='w', suffix='.yaml', delete=False) as f:
-            f.write('database:\n  password: "realpassword123456"\n')
-            f.flush()
-
-            issues = scan_file_content(
-                Path(f.name),
-                "SEC-002",
-                SECURITY_CHECKS["SEC-002"]
-            )
-
-            # Check if detected (may be excluded if matches exclusion pattern)
-            os.unlink(f.name)
-
-    def test_ignores_env_var(self):
-        """Should ignore environment variable references"""
-        with tempfile.NamedTemporaryFile(mode='w', suffix='.yaml', delete=False) as f:
-            f.write('database:\n  password: "${DATABASE_PASSWORD}"\n')
-            f.flush()
-
-            issues = scan_file_content(
-                Path(f.name),
-                "SEC-002",
-                SECURITY_CHECKS["SEC-002"]
-            )
-
-            assert len(issues) == 0
-            os.unlink(f.name)
-
-
-class TestAWSKeyDetection:
-    """Tests for AWS key detection (SEC-003)"""
-
-    def test_detects_aws_access_key(self):
-        """Should detect AWS access keys"""
-        with tempfile.NamedTemporaryFile(mode='w', suffix='.py', delete=False) as f:
-            f.write('AWS_ACCESS_KEY = "AKIAIOSFODNN7EXAMPLE"\n')
-            f.flush()
-
-            issues = scan_file_content(
-                Path(f.name),
-                "SEC-003",
-                SECURITY_CHECKS["SEC-003"]
-            )
-
-            # AKIAIOSFODNN7EXAMPLE is a known example key, may be excluded
-            os.unlink(f.name)
-
-    def test_ignores_documentation(self):
-        """Should ignore AWS keys in grep patterns/documentation"""
-        with tempfile.NamedTemporaryFile(mode='w', suffix='.md', delete=False) as f:
-            f.write('# Pattern to find: grep -E "AKIA[A-Z0-9]{16}"\n')
-            f.flush()
-
-            issues = scan_file_content(
-                Path(f.name),
-                "SEC-003",
-                SECURITY_CHECKS["SEC-003"]
-            )
-
-            assert len(issues) == 0
-            os.unlink(f.name)
-
-
-class TestPrivateKeyDetection:
-    """Tests for private key detection (SEC-005)"""
-
-    def test_detects_private_key_content(self):
-        """Should detect private key content"""
-        with tempfile.NamedTemporaryFile(mode='w', suffix='.txt', delete=False) as f:
-            f.write('-----BEGIN RSA PRIVATE KEY-----\nMIIEow...\n-----END RSA PRIVATE KEY-----\n')
-            f.flush()
-
-            issues = scan_file_content(
-                Path(f.name),
-                "SEC-005",
-                SECURITY_CHECKS["SEC-005"]
-            )
-
-            # Should be detected
-            assert len(issues) >= 1
-            os.unlink(f.name)
-
-    def test_ignores_grep_pattern(self):
-        """Should ignore private key patterns in grep commands"""
-        with tempfile.NamedTemporaryFile(mode='w', suffix='.md', delete=False) as f:
-            f.write('action: "grep -rE \'-----BEGIN.*PRIVATE KEY-----\'"\n')
-            f.flush()
-
-            issues = scan_file_content(
-                Path(f.name),
-                "SEC-005",
-                SECURITY_CHECKS["SEC-005"]
-            )
-
-            assert len(issues) == 0
-            os.unlink(f.name)
-
-
-class TestDatabaseURLDetection:
-    """Tests for database URL detection (SEC-007)"""
-
-    def test_detects_postgres_url(self):
-        """Should detect PostgreSQL URLs with passwords"""
-        with tempfile.NamedTemporaryFile(mode='w', suffix='.env', delete=False) as f:
-            f.write('DATABASE_URL=postgres://user:realpassword@prod-db.example.com:5432/mydb\n')
-            f.flush()
-
-            issues = scan_file_content(
-                Path(f.name),
-                "SEC-007",
-                SECURITY_CHECKS["SEC-007"]
-            )
-
-            # Should be detected
-            assert len(issues) >= 1
-            os.unlink(f.name)
-
-    def test_ignores_localhost(self):
-        """Should ignore localhost database URLs"""
-        with tempfile.NamedTemporaryFile(mode='w', suffix='.yaml', delete=False) as f:
-            f.write('database:\n  url: "postgres://user:pass@localhost:5432/dev"\n')
-            f.flush()
-
-            issues = scan_file_content(
-                Path(f.name),
-                "SEC-007",
-                SECURITY_CHECKS["SEC-007"]
-            )
-
-            assert len(issues) == 0
-            os.unlink(f.name)
-
-
-class TestFileBasedChecks:
-    """Tests for file-based security checks"""
-
-    def test_detects_env_file(self):
-        """Should detect .env files"""
-        with tempfile.TemporaryDirectory() as tmpdir:
-            env_file = Path(tmpdir) / ".env"
-            env_file.write_text("SECRET=value\n")
-
-            issues = scan_for_files(
-                Path(tmpdir),
-                "SEC-008",
-                FILE_CHECKS["SEC-008"]
-            )
-
-            assert len(issues) >= 1
-            assert any(i.check_id == "SEC-008" for i in issues)
-
-    def test_detects_pem_file(self):
-        """Should detect .pem files"""
-        with tempfile.TemporaryDirectory() as tmpdir:
-            pem_file = Path(tmpdir) / "server.pem"
-            pem_file.write_text("fake pem content\n")
-
-            issues = scan_for_files(
-                Path(tmpdir),
-                "SEC-006",
-                FILE_CHECKS["SEC-006"]
-            )
-
-            assert len(issues) >= 1
-            assert any(i.check_id == "SEC-006" for i in issues)
-
-
-class TestSquadScan:
-    """Tests for full squad scanning"""
-
-    def test_clean_squad_passes(self):
-        """Clean squad should pass all checks"""
-        with tempfile.TemporaryDirectory() as tmpdir:
-            # Create minimal squad structure
-            (Path(tmpdir) / "agents").mkdir()
-            (Path(tmpdir) / "tasks").mkdir()
-            (Path(tmpdir) / "config.yaml").write_text("name: test-squad\nversion: 1.0.0\n")
-            (Path(tmpdir) / "agents" / "main.md").write_text("# Main Agent\n\nNo secrets here.\n")
-
-            result = scan_squad(tmpdir)
-
-            assert result.status == "pass"
-            assert result.issues_count == 0
-
-    def test_squad_with_secret_fails(self):
-        """Squad with secrets should fail"""
-        with tempfile.TemporaryDirectory() as tmpdir:
-            # Create squad with secret
-            (Path(tmpdir) / "config.yaml").write_text(
-                'name: test-squad\napi_key: "sk-realkey1234567890abcdef"\n'
-            )
-
-            result = scan_squad(tmpdir)
-
-            # May or may not fail depending on exclusion patterns
-            # The important thing is the scan completes
-
-    def test_nonexistent_path(self):
-        """Nonexistent path should return error"""
-        result = scan_squad("/nonexistent/path/to/squad")
-
-        assert result.status == "error"
-        assert len(result.issues) >= 1
-
-
-class TestOutputFormats:
-    """Tests for output formatting"""
-
-    def test_json_output(self):
-        """JSON output should be valid"""
-        with tempfile.TemporaryDirectory() as tmpdir:
-            (Path(tmpdir) / "config.yaml").write_text("name: test\n")
-
-            result = scan_squad(tmpdir)
-
-            # Convert to JSON and back
-            from security_scanner import format_json
-            json_str = format_json(result)
-            parsed = json.loads(json_str)
-
-            assert "status" in parsed
-            assert "issues_count" in parsed
-            assert "checks_run" in parsed
-
-    def test_text_output(self):
-        """Text output should contain key information"""
-        with tempfile.TemporaryDirectory() as tmpdir:
-            (Path(tmpdir) / "config.yaml").write_text("name: test\n")
-
-            result = scan_squad(tmpdir)
-
-            from security_scanner import format_text
-            text = format_text(result)
-
-            assert "Security Scan" in text
-            assert "Status:" in text
-            assert "Checks:" in text
-
-
-class TestStrictMode:
-    """Tests for strict mode (no exclusions)"""
-
-    def test_strict_catches_more(self):
-        """Strict mode should catch patterns that are normally excluded"""
-        with tempfile.NamedTemporaryFile(mode='w', suffix='.md', delete=False) as f:
-            # Write something that would normally be excluded
-            f.write('# Example: api_key: "example-key-12345678"\n')
-            f.flush()
-
-            # Normal mode - should be excluded
-            normal_issues = scan_file_content(
-                Path(f.name),
-                "SEC-001",
-                SECURITY_CHECKS["SEC-001"],
-                strict=False
-            )
-
-            # Strict mode - should catch it
-            strict_issues = scan_file_content(
-                Path(f.name),
-                "SEC-001",
-                SECURITY_CHECKS["SEC-001"],
-                strict=True
-            )
-
-            # Strict should catch more or equal
-            assert len(strict_issues) >= len(normal_issues)
-            os.unlink(f.name)
-
-
-if __name__ == "__main__":
-    pytest.main([__file__, "-v"])
+#!/usr/bin/env python3
+"""
+Tests for security_scanner.py
+Run with: pytest scripts/tests/test_security_scanner.py -v
+"""
+
+import os
+import sys
+import json
+import pytest
+import tempfile
+from pathlib import Path
+
+# Add parent directory to path for imports
+sys.path.insert(0, str(Path(__file__).parent.parent))
+
+from security_scanner import (
+    scan_file_content,
+    scan_for_files,
+    scan_squad,
+    SecurityIssue,
+    SecurityResult,
+    SECURITY_CHECKS,
+    FILE_CHECKS,
+)
+
+
+class TestAPIKeyDetection:
+    """Tests for API key detection (SEC-001)"""
+
+    def test_detects_api_key(self):
+        """Should detect hardcoded API keys"""
+        with tempfile.NamedTemporaryFile(mode='w', suffix='.md', delete=False) as f:
+            f.write('config:\n  api_key: "sk-1234567890abcdef1234567890abcdef"\n')
+            f.flush()
+
+            issues = scan_file_content(
+                Path(f.name),
+                "SEC-001",
+                SECURITY_CHECKS["SEC-001"]
+            )
+
+            # Should detect (unless excluded by pattern)
+            # Note: "sk-1234" is in exclusion list, but full key should be caught
+            os.unlink(f.name)
+
+    def test_ignores_placeholder(self):
+        """Should ignore placeholder values"""
+        with tempfile.NamedTemporaryFile(mode='w', suffix='.md', delete=False) as f:
+            f.write('config:\n  api_key: "${API_KEY}"\n')
+            f.flush()
+
+            issues = scan_file_content(
+                Path(f.name),
+                "SEC-001",
+                SECURITY_CHECKS["SEC-001"]
+            )
+
+            assert len(issues) == 0
+            os.unlink(f.name)
+
+    def test_ignores_example(self):
+        """Should ignore example values"""
+        with tempfile.NamedTemporaryFile(mode='w', suffix='.md', delete=False) as f:
+            f.write('# Example:\n  api_key: "your-key-here-example"\n')
+            f.flush()
+
+            issues = scan_file_content(
+                Path(f.name),
+                "SEC-001",
+                SECURITY_CHECKS["SEC-001"]
+            )
+
+            assert len(issues) == 0
+            os.unlink(f.name)
+
+
+class TestSecretDetection:
+    """Tests for secret/password detection (SEC-002)"""
+
+    def test_detects_password(self):
+        """Should detect hardcoded passwords"""
+        with tempfile.NamedTemporaryFile(mode='w', suffix='.yaml', delete=False) as f:
+            f.write('database:\n  password: "realpassword123456"\n')
+            f.flush()
+
+            issues = scan_file_content(
+                Path(f.name),
+                "SEC-002",
+                SECURITY_CHECKS["SEC-002"]
+            )
+
+            # Check if detected (may be excluded if matches exclusion pattern)
+            os.unlink(f.name)
+
+    def test_ignores_env_var(self):
+        """Should ignore environment variable references"""
+        with tempfile.NamedTemporaryFile(mode='w', suffix='.yaml', delete=False) as f:
+            f.write('database:\n  password: "${DATABASE_PASSWORD}"\n')
+            f.flush()
+
+            issues = scan_file_content(
+                Path(f.name),
+                "SEC-002",
+                SECURITY_CHECKS["SEC-002"]
+            )
+
+            assert len(issues) == 0
+            os.unlink(f.name)
+
+
+class TestAWSKeyDetection:
+    """Tests for AWS key detection (SEC-003)"""
+
+    def test_detects_aws_access_key(self):
+        """Should detect AWS access keys"""
+        with tempfile.NamedTemporaryFile(mode='w', suffix='.py', delete=False) as f:
+            f.write('AWS_ACCESS_KEY = "AKIAIOSFODNN7EXAMPLE"\n')
+            f.flush()
+
+            issues = scan_file_content(
+                Path(f.name),
+                "SEC-003",
+                SECURITY_CHECKS["SEC-003"]
+            )
+
+            # AKIAIOSFODNN7EXAMPLE is a known example key, may be excluded
+            os.unlink(f.name)
+
+    def test_ignores_documentation(self):
+        """Should ignore AWS keys in grep patterns/documentation"""
+        with tempfile.NamedTemporaryFile(mode='w', suffix='.md', delete=False) as f:
+            f.write('# Pattern to find: grep -E "AKIA[A-Z0-9]{16}"\n')
+            f.flush()
+
+            issues = scan_file_content(
+                Path(f.name),
+                "SEC-003",
+                SECURITY_CHECKS["SEC-003"]
+            )
+
+            assert len(issues) == 0
+            os.unlink(f.name)
+
+
+class TestPrivateKeyDetection:
+    """Tests for private key detection (SEC-005)"""
+
+    def test_detects_private_key_content(self):
+        """Should detect private key content"""
+        with tempfile.NamedTemporaryFile(mode='w', suffix='.txt', delete=False) as f:
+            f.write('-----BEGIN RSA PRIVATE KEY-----\nMIIEow...\n-----END RSA PRIVATE KEY-----\n')
+            f.flush()
+
+            issues = scan_file_content(
+                Path(f.name),
+                "SEC-005",
+                SECURITY_CHECKS["SEC-005"]
+            )
+
+            # Should be detected
+            assert len(issues) >= 1
+            os.unlink(f.name)
+
+    def test_ignores_grep_pattern(self):
+        """Should ignore private key patterns in grep commands"""
+        with tempfile.NamedTemporaryFile(mode='w', suffix='.md', delete=False) as f:
+            f.write('action: "grep -rE \'-----BEGIN.*PRIVATE KEY-----\'"\n')
+            f.flush()
+
+            issues = scan_file_content(
+                Path(f.name),
+                "SEC-005",
+                SECURITY_CHECKS["SEC-005"]
+            )
+
+            assert len(issues) == 0
+            os.unlink(f.name)
+
+
+class TestDatabaseURLDetection:
+    """Tests for database URL detection (SEC-007)"""
+
+    def test_detects_postgres_url(self):
+        """Should detect PostgreSQL URLs with passwords"""
+        with tempfile.NamedTemporaryFile(mode='w', suffix='.env', delete=False) as f:
+            f.write('DATABASE_URL=postgres://user:realpassword@prod-db.example.com:5432/mydb\n')
+            f.flush()
+
+            issues = scan_file_content(
+                Path(f.name),
+                "SEC-007",
+                SECURITY_CHECKS["SEC-007"]
+            )
+
+            # Should be detected
+            assert len(issues) >= 1
+            os.unlink(f.name)
+
+    def test_ignores_localhost(self):
+        """Should ignore localhost database URLs"""
+        with tempfile.NamedTemporaryFile(mode='w', suffix='.yaml', delete=False) as f:
+            f.write('database:\n  url: "postgres://user:pass@localhost:5432/dev"\n')
+            f.flush()
+
+            issues = scan_file_content(
+                Path(f.name),
+                "SEC-007",
+                SECURITY_CHECKS["SEC-007"]
+            )
+
+            assert len(issues) == 0
+            os.unlink(f.name)
+
+
+class TestFileBasedChecks:
+    """Tests for file-based security checks"""
+
+    def test_detects_env_file(self):
+        """Should detect .env files"""
+        with tempfile.TemporaryDirectory() as tmpdir:
+            env_file = Path(tmpdir) / ".env"
+            env_file.write_text("SECRET=value\n")
+
+            issues = scan_for_files(
+                Path(tmpdir),
+                "SEC-008",
+                FILE_CHECKS["SEC-008"]
+            )
+
+            assert len(issues) >= 1
+            assert any(i.check_id == "SEC-008" for i in issues)
+
+    def test_detects_pem_file(self):
+        """Should detect .pem files"""
+        with tempfile.TemporaryDirectory() as tmpdir:
+            pem_file = Path(tmpdir) / "server.pem"
+            pem_file.write_text("fake pem content\n")
+
+            issues = scan_for_files(
+                Path(tmpdir),
+                "SEC-006",
+                FILE_CHECKS["SEC-006"]
+            )
+
+            assert len(issues) >= 1
+            assert any(i.check_id == "SEC-006" for i in issues)
+
+
+class TestSquadScan:
+    """Tests for full squad scanning"""
+
+    def test_clean_squad_passes(self):
+        """Clean squad should pass all checks"""
+        with tempfile.TemporaryDirectory() as tmpdir:
+            # Create minimal squad structure
+            (Path(tmpdir) / "agents").mkdir()
+            (Path(tmpdir) / "tasks").mkdir()
+            (Path(tmpdir) / "config.yaml").write_text("name: test-squad\nversion: 1.0.0\n")
+            (Path(tmpdir) / "agents" / "main.md").write_text("# Main Agent\n\nNo secrets here.\n")
+
+            result = scan_squad(tmpdir)
+
+            assert result.status == "pass"
+            assert result.issues_count == 0
+
+    def test_squad_with_secret_fails(self):
+        """Squad with secrets should fail"""
+        with tempfile.TemporaryDirectory() as tmpdir:
+            # Create squad with secret
+            (Path(tmpdir) / "config.yaml").write_text(
+                'name: test-squad\napi_key: "sk-realkey1234567890abcdef"\n'
+            )
+
+            result = scan_squad(tmpdir)
+
+            # May or may not fail depending on exclusion patterns
+            # The important thing is the scan completes
+
+    def test_nonexistent_path(self):
+        """Nonexistent path should return error"""
+        result = scan_squad("/nonexistent/path/to/squad")
+
+        assert result.status == "error"
+        assert len(result.issues) >= 1
+
+
+class TestOutputFormats:
+    """Tests for output formatting"""
+
+    def test_json_output(self):
+        """JSON output should be valid"""
+        with tempfile.TemporaryDirectory() as tmpdir:
+            (Path(tmpdir) / "config.yaml").write_text("name: test\n")
+
+            result = scan_squad(tmpdir)
+
+            # Convert to JSON and back
+            from security_scanner import format_json
+            json_str = format_json(result)
+            parsed = json.loads(json_str)
+
+            assert "status" in parsed
+            assert "issues_count" in parsed
+            assert "checks_run" in parsed
+
+    def test_text_output(self):
+        """Text output should contain key information"""
+        with tempfile.TemporaryDirectory() as tmpdir:
+            (Path(tmpdir) / "config.yaml").write_text("name: test\n")
+
+            result = scan_squad(tmpdir)
+
+            from security_scanner import format_text
+            text = format_text(result)
+
+            assert "Security Scan" in text
+            assert "Status:" in text
+            assert "Checks:" in text
+
+
+class TestStrictMode:
+    """Tests for strict mode (no exclusions)"""
+
+    def test_strict_catches_more(self):
+        """Strict mode should catch patterns that are normally excluded"""
+        with tempfile.NamedTemporaryFile(mode='w', suffix='.md', delete=False) as f:
+            # Write something that would normally be excluded
+            f.write('# Example: api_key: "example-key-12345678"\n')
+            f.flush()
+
+            # Normal mode - should be excluded
+            normal_issues = scan_file_content(
+                Path(f.name),
+                "SEC-001",
+                SECURITY_CHECKS["SEC-001"],
+                strict=False
+            )
+
+            # Strict mode - should catch it
+            strict_issues = scan_file_content(
+                Path(f.name),
+                "SEC-001",
+                SECURITY_CHECKS["SEC-001"],
+                strict=True
+            )
+
+            # Strict should catch more or equal
+            assert len(strict_issues) >= len(normal_issues)
+            os.unlink(f.name)
+
+
+if __name__ == "__main__":
+    pytest.main([__file__, "-v"])