contextsynapse 1.0.0__py3-none-any.whl

contextsynapse/tests/test_query_cache.py

@@ -0,0 +1,213 @@
+"""
+Tests for _QueryCache and fast-path SELECT shortcuts in AIQLExecutor.
+"""
+
+import os
+os.environ["CONTEXTSYNAPSE_GRAPH_BACKEND"] = "csr"  # tests need isolated in-memory graphs
+os.environ["AICONTEXTDB_GRAPH_BACKEND"] = "csr"  # backward compat
+
+import time
+import tempfile
+import shutil
+import pytest
+
+from contextsynapse.aiql.engine.executor import _QueryCache, _query_cache, AIQLExecutor
+from contextsynapse.core.registry import GraphRegistry
+
+
+# ────────────────────────────────────────────────────────────────────
+# Fixtures
+# ────────────────────────────────────────────────────────────────────
+
+@pytest.fixture()
+def cache():
+    """Fresh _QueryCache with small defaults for testing."""
+    return _QueryCache(max_size=4, ttl_seconds=1.0)
+
+
+@pytest.fixture()
+def tmp_storage(tmp_path):
+    """Temporary directory for GraphRegistry storage."""
+    return str(tmp_path / "graphs")
+
+
+@pytest.fixture()
+def executor(tmp_storage):
+    """AIQLExecutor wired to a temporary GraphRegistry with a test graph."""
+    registry = GraphRegistry(storage_dir=tmp_storage)
+    registry.create_graph("test")
+    ex = AIQLExecutor(graph_registry=registry)
+    ex.active_namespace = "test"
+
+    # Clear the module-level cache so tests start clean
+    _query_cache.clear()
+
+    # Seed a few nodes
+    ex.execute('CREATE NODE Person {name: "Alice", age: "30"}')
+    ex.execute('CREATE NODE Person {name: "Bob", age: "25"}')
+    ex.execute('CREATE NODE Task {name: "Deploy", status: "done"}')
+
+    # Clear again after writes so cached CREATE results don't interfere
+    _query_cache.clear()
+    return ex
+
+
+# ====================================================================
+# 1. _QueryCache unit tests
+# ====================================================================
+
+class TestQueryCache:
+    """Direct unit tests for the _QueryCache class."""
+
+    def test_put_and_get(self, cache):
+        cache.put("ns1", "SELECT * FROM Foo", {"rows": [1, 2, 3]})
+        result = cache.get("ns1", "SELECT * FROM Foo")
+        assert result == {"rows": [1, 2, 3]}
+
+    def test_get_miss_returns_none(self, cache):
+        assert cache.get("ns1", "SELECT 1") is None
+
+    def test_ttl_expiration(self, cache):
+        cache.put("ns1", "SELECT 1", "ok")
+        # Should be retrievable immediately
+        assert cache.get("ns1", "SELECT 1") == "ok"
+        # Wait for TTL (1 second) to expire
+        time.sleep(1.1)
+        assert cache.get("ns1", "SELECT 1") is None
+
+    def test_lru_eviction(self, cache):
+        """Oldest entries are evicted when max_size is exceeded."""
+        cache.put("ns", "q1", "r1")
+        cache.put("ns", "q2", "r2")
+        cache.put("ns", "q3", "r3")
+        cache.put("ns", "q4", "r4")
+        assert cache.size == 4
+
+        # Adding a 5th entry should evict the oldest (q1)
+        cache.put("ns", "q5", "r5")
+        assert cache.size == 4
+        assert cache.get("ns", "q1") is None
+        assert cache.get("ns", "q5") == "r5"
+
+    def test_lru_access_refreshes_order(self, cache):
+        """Accessing an entry moves it to the end, protecting it from eviction."""
+        cache.put("ns", "q1", "r1")
+        cache.put("ns", "q2", "r2")
+        cache.put("ns", "q3", "r3")
+        cache.put("ns", "q4", "r4")
+
+        # Access q1 so it becomes most-recently used
+        cache.get("ns", "q1")
+
+        # Insert two more; q2 and q3 should be evicted (oldest untouched)
+        cache.put("ns", "q5", "r5")
+        cache.put("ns", "q6", "r6")
+
+        assert cache.get("ns", "q1") == "r1"  # survived because it was accessed
+        assert cache.get("ns", "q2") is None   # evicted
+        assert cache.get("ns", "q3") is None   # evicted
+
+    def test_invalidate_namespace(self, cache):
+        cache.put("ns1", "q1", "r1")
+        cache.put("ns1", "q2", "r2")
+        cache.put("ns2", "q1", "r3")
+        assert cache.size == 3
+
+        cache.invalidate("ns1")
+
+        assert cache.get("ns1", "q1") is None
+        assert cache.get("ns1", "q2") is None
+        assert cache.get("ns2", "q1") == "r3"
+        assert cache.size == 1
+
+    def test_clear(self, cache):
+        cache.put("ns1", "q1", "r1")
+        cache.put("ns2", "q2", "r2")
+        assert cache.size == 2
+
+        cache.clear()
+        assert cache.size == 0
+        assert cache.get("ns1", "q1") is None
+
+    def test_namespaces_isolated(self, cache):
+        """Same query string in different namespaces returns different results."""
+        cache.put("alpha", "SELECT *", {"from": "alpha"})
+        cache.put("beta", "SELECT *", {"from": "beta"})
+
+        assert cache.get("alpha", "SELECT *") == {"from": "alpha"}
+        assert cache.get("beta", "SELECT *") == {"from": "beta"}
+
+    def test_invalidate_one_namespace_keeps_other(self, cache):
+        cache.put("alpha", "SELECT *", "a")
+        cache.put("beta", "SELECT *", "b")
+
+        cache.invalidate("alpha")
+
+        assert cache.get("alpha", "SELECT *") is None
+        assert cache.get("beta", "SELECT *") == "b"
+
+
+# ====================================================================
+# 2. Fast-path SELECT shortcut tests (via AIQLExecutor)
+# ====================================================================
+
+class TestFastPathSelects:
+    """Integration tests for fast-path SELECT shortcuts and SHOW GRAPHS."""
+
+    def test_select_star_returns_all_nodes(self, executor):
+        result = executor.execute("SELECT *")
+        assert result["nodes"] is not None
+        assert len(result["nodes"]) == 3  # Alice, Bob, Deploy
+
+    def test_select_star_from_label(self, executor):
+        result = executor.execute("SELECT * FROM Person")
+        assert len(result["nodes"]) == 2
+        names = {n["properties"]["name"] for n in result["nodes"]}
+        assert names == {"Alice", "Bob"}
+
+    def test_select_star_from_label_case_insensitive(self, executor):
+        result = executor.execute("SELECT * FROM person")
+        assert len(result["nodes"]) == 2
+
+    def test_select_star_where_property(self, executor):
+        result = executor.execute('SELECT * WHERE name = "Alice"')
+        assert len(result["nodes"]) == 1
+        assert result["nodes"][0]["properties"]["name"] == "Alice"
+
+    def test_select_star_where_no_match(self, executor):
+        result = executor.execute('SELECT * WHERE name = "Nobody"')
+        assert len(result["nodes"]) == 0
+
+    def test_show_graphs(self, executor):
+        result = executor.execute("SHOW GRAPHS")
+        graphs = result["data"]["graphs"]
+        names = [g["name"] for g in graphs]
+        assert "test" in names
+
+    def test_cache_hit_on_second_call(self, executor):
+        """Second identical read should come from cache."""
+        _query_cache.clear()
+
+        r1 = executor.execute("SELECT *")
+        assert _query_cache.size >= 1  # stored after first call
+
+        r2 = executor.execute("SELECT *")
+        # Results should be identical (same object from cache)
+        assert r1 is r2
+
+    def test_write_invalidates_cache(self, executor):
+        """A write query should invalidate cached reads for the namespace."""
+        _query_cache.clear()
+
+        executor.execute("SELECT *")
+        assert _query_cache.size >= 1
+
+        # Write invalidates the namespace cache
+        executor.execute('CREATE NODE Person {name: "Charlie", age: "40"}')
+        # Cache for "test" namespace should have been cleared
+        cached = _query_cache.get("test", "SELECT *")
+        assert cached is None
+
+        # Fresh read should now include 4 nodes
+        result = executor.execute("SELECT *")
+        assert len(result["nodes"]) == 4

contextsynapse/tests/test_source_policy_auth.py

@@ -0,0 +1,348 @@
+"""Tests for source policy domain matching and auth error message safety."""
+
+from __future__ import annotations
+
+import inspect
+import re
+
+import pytest
+
+from contextsynapse.context.source_policy import (
+    ALWAYS_BLOCKED_DOMAINS,
+    ALWAYS_BLOCKED_IP_PREFIXES,
+    check_source_allowed,
+)
+from contextsynapse.api import auth as auth_module
+
+
+# ---------------------------------------------------------------------------
+# Helpers
+# ---------------------------------------------------------------------------
+
+class FakeContext:
+    """Minimal context object with a config dict and optional attributes."""
+
+    def __init__(self, config=None, source=None, context_type=None):
+        self.config = config or {}
+        self.source = source
+        self.context_type = context_type
+
+
+def _policy(**overrides):
+    """Build a config dict wrapping a source_policy."""
+    return {"source_policy": overrides}
+
+
+# ===========================================================================
+# Source Policy — Domain Matching
+# ===========================================================================
+
+class TestExactDomainMatch:
+    def test_exact_domain_allowed(self):
+        ctx = FakeContext(config=_policy(allowed_domains=["example.com"]))
+        allowed, reason = check_source_allowed(ctx, source_url="https://example.com/page")
+        assert allowed is True
+
+    def test_exact_domain_rejected(self):
+        ctx = FakeContext(config=_policy(allowed_domains=["example.com"]))
+        allowed, reason = check_source_allowed(ctx, source_url="https://other.com/page")
+        assert allowed is False
+        assert "not in allowed" in reason
+
+
+class TestWwwPrefixStripping:
+    def test_www_prefix_stripped_and_matched(self):
+        ctx = FakeContext(config=_policy(allowed_domains=["example.com"]))
+        allowed, _ = check_source_allowed(ctx, source_url="https://www.example.com/page")
+        assert allowed is True
+
+    def test_allowed_has_www_source_does_not(self):
+        ctx = FakeContext(config=_policy(allowed_domains=["www.example.com"]))
+        allowed, _ = check_source_allowed(ctx, source_url="https://example.com/page")
+        assert allowed is True
+
+
+class TestSubdomainMatching:
+    def test_subdomain_of_allowed_domain(self):
+        ctx = FakeContext(config=_policy(allowed_domains=["example.com"]))
+        allowed, _ = check_source_allowed(ctx, source_url="https://docs.example.com/api")
+        assert allowed is True
+
+    def test_deep_subdomain_of_allowed_domain(self):
+        ctx = FakeContext(config=_policy(allowed_domains=["example.com"]))
+        allowed, _ = check_source_allowed(ctx, source_url="https://a.b.c.example.com/x")
+        assert allowed is True
+
+    def test_unrelated_domain_with_same_suffix_rejected(self):
+        ctx = FakeContext(config=_policy(allowed_domains=["example.com"]))
+        allowed, _ = check_source_allowed(ctx, source_url="https://notexample.com/page")
+        assert allowed is False
+
+
+class TestRelatedDomainMatch:
+    def test_related_domain_name_in_subdomain(self):
+        """timesofindia.com should match timesofindia.indiatimes.com."""
+        ctx = FakeContext(config=_policy(allowed_domains=["timesofindia.com"]))
+        allowed, _ = check_source_allowed(
+            ctx, source_url="https://timesofindia.indiatimes.com/article"
+        )
+        assert allowed is True
+
+    def test_related_domain_different_tld(self):
+        ctx = FakeContext(config=_policy(allowed_domains=["mycompany.com"]))
+        allowed, _ = check_source_allowed(
+            ctx, source_url="https://mycompany.co.uk/page"
+        )
+        assert allowed is True
+
+
+class TestShortDomainNoLooseMatch:
+    def test_short_name_three_chars_no_loose_match(self):
+        """Domain names <= 3 chars should NOT get the loose related-domain matching."""
+        ctx = FakeContext(config=_policy(allowed_domains=["abc.com"]))
+        # "abc.otherdomain.com" should NOT match because "abc" is only 3 chars
+        allowed, _ = check_source_allowed(
+            ctx, source_url="https://abc.otherdomain.com/page"
+        )
+        assert allowed is False
+
+    def test_four_char_name_does_match(self):
+        ctx = FakeContext(config=_policy(allowed_domains=["abcd.com"]))
+        allowed, _ = check_source_allowed(
+            ctx, source_url="https://abcd.otherdomain.com/page"
+        )
+        assert allowed is True
+
+
+class TestBlockedDomains:
+    def test_blocked_domain_rejected(self):
+        ctx = FakeContext(config=_policy(
+            allowed_domains=["example.com"],
+            blocked_domains=["evil.com"],
+        ))
+        allowed, reason = check_source_allowed(ctx, source_url="https://evil.com/x")
+        assert allowed is False
+        assert "blocked" in reason.lower()
+
+    def test_blocked_subdomain_rejected(self):
+        ctx = FakeContext(config=_policy(blocked_domains=["evil.com"]))
+        allowed, _ = check_source_allowed(ctx, source_url="https://sub.evil.com/x")
+        assert allowed is False
+
+    def test_blocked_takes_priority_over_allowed(self):
+        ctx = FakeContext(config=_policy(
+            allowed_domains=["evil.com"],
+            blocked_domains=["evil.com"],
+        ))
+        allowed, _ = check_source_allowed(ctx, source_url="https://evil.com/x")
+        assert allowed is False
+
+
+class TestPathPrefixMatching:
+    def test_path_prefix_allowed(self):
+        ctx = FakeContext(config=_policy(allowed_domains=["github.com/myorg"]))
+        allowed, _ = check_source_allowed(
+            ctx, source_url="https://github.com/myorg/repo"
+        )
+        assert allowed is True
+
+    def test_path_prefix_different_org_rejected(self):
+        ctx = FakeContext(config=_policy(allowed_domains=["github.com/myorg"]))
+        allowed, _ = check_source_allowed(
+            ctx, source_url="https://github.com/otherorg/repo"
+        )
+        assert allowed is False
+
+    def test_path_prefix_exact_path(self):
+        ctx = FakeContext(config=_policy(allowed_domains=["github.com/myorg"]))
+        allowed, _ = check_source_allowed(
+            ctx, source_url="https://github.com/myorg"
+        )
+        assert allowed is True
+
+
+class TestSecurityBlocklist:
+    def test_localhost_always_blocked(self):
+        ctx = FakeContext()  # No policy at all
+        allowed, reason = check_source_allowed(ctx, source_url="http://localhost/admin")
+        assert allowed is False
+        assert "restricted" in reason.lower() or "blocked" in reason.lower()
+
+    def test_aws_metadata_blocked(self):
+        ctx = FakeContext()
+        allowed, _ = check_source_allowed(
+            ctx, source_url="http://169.254.169.254/latest/meta-data/"
+        )
+        assert allowed is False
+
+    def test_gcp_metadata_blocked(self):
+        ctx = FakeContext()
+        allowed, _ = check_source_allowed(
+            ctx, source_url="http://metadata.google.internal/computeMetadata/v1/"
+        )
+        assert allowed is False
+
+    def test_private_ip_10_blocked(self):
+        ctx = FakeContext()
+        allowed, _ = check_source_allowed(ctx, source_url="http://10.0.0.1/secret")
+        assert allowed is False
+
+    def test_private_ip_192_168_blocked(self):
+        ctx = FakeContext()
+        allowed, _ = check_source_allowed(
+            ctx, source_url="http://192.168.1.1/admin"
+        )
+        assert allowed is False
+
+    def test_private_ip_172_16_blocked(self):
+        ctx = FakeContext()
+        allowed, _ = check_source_allowed(ctx, source_url="http://172.16.0.1/x")
+        assert allowed is False
+
+    def test_loopback_127_blocked(self):
+        ctx = FakeContext()
+        allowed, _ = check_source_allowed(ctx, source_url="http://127.0.0.1/x")
+        assert allowed is False
+
+    def test_security_blocklist_overrides_allowed_domains(self):
+        """Even if policy allows localhost, security blocklist wins."""
+        ctx = FakeContext(config=_policy(allowed_domains=["localhost"]))
+        allowed, _ = check_source_allowed(ctx, source_url="http://localhost/x")
+        assert allowed is False
+
+
+class TestNoPolicyOpenByDefault:
+    def test_no_policy_allows_external_url(self):
+        ctx = FakeContext()
+        allowed, reason = check_source_allowed(
+            ctx, source_url="https://anything.example.com/data"
+        )
+        assert allowed is True
+        assert "no source policy" in reason.lower()
+
+    def test_no_policy_allows_files(self):
+        ctx = FakeContext()
+        allowed, _ = check_source_allowed(ctx, filename="report.pdf")
+        assert allowed is True
+
+    def test_no_policy_still_blocks_security_threats(self):
+        ctx = FakeContext()
+        allowed, _ = check_source_allowed(ctx, source_url="http://0.0.0.0/x")
+        assert allowed is False
+
+
+class TestFileExtensionFiltering:
+    def test_allowed_extension_passes(self):
+        ctx = FakeContext(config=_policy(allowed_file_extensions=[".pdf", ".md"]))
+        allowed, _ = check_source_allowed(ctx, filename="report.pdf")
+        assert allowed is True
+
+    def test_disallowed_extension_rejected(self):
+        ctx = FakeContext(config=_policy(allowed_file_extensions=[".pdf", ".md"]))
+        allowed, reason = check_source_allowed(ctx, filename="malware.exe")
+        assert allowed is False
+        assert ".exe" in reason
+
+    def test_case_insensitive_extension(self):
+        ctx = FakeContext(config=_policy(allowed_file_extensions=[".pdf"]))
+        allowed, _ = check_source_allowed(ctx, filename="report.PDF")
+        assert allowed is True
+
+    def test_no_extension_filter_allows_all(self):
+        ctx = FakeContext(config=_policy(allowed_domains=["example.com"]))
+        allowed, _ = check_source_allowed(ctx, filename="anything.xyz")
+        assert allowed is True
+
+
+class TestFileSizeFiltering:
+    def test_within_limit_allowed(self):
+        ctx = FakeContext(config=_policy(max_file_size_mb=50))
+        allowed, _ = check_source_allowed(ctx, file_size_mb=25.0)
+        assert allowed is True
+
+    def test_exceeds_limit_rejected(self):
+        ctx = FakeContext(config=_policy(max_file_size_mb=50))
+        allowed, reason = check_source_allowed(ctx, file_size_mb=75.0)
+        assert allowed is False
+        assert "exceeds" in reason.lower()
+
+    def test_exact_limit_allowed(self):
+        ctx = FakeContext(config=_policy(max_file_size_mb=50))
+        allowed, _ = check_source_allowed(ctx, file_size_mb=50.0)
+        assert allowed is True
+
+    def test_no_size_limit_allows_large_files(self):
+        ctx = FakeContext(config=_policy(allowed_domains=["example.com"]))
+        allowed, _ = check_source_allowed(ctx, file_size_mb=9999.0)
+        assert allowed is True
+
+
+# ===========================================================================
+# Auth Error Messages — No Implementation Details Leaked
+# ===========================================================================
+
+def _collect_auth_error_messages() -> list[str]:
+    """Extract all HTTPException detail strings from the auth module source."""
+    source = inspect.getsource(auth_module)
+    # Match detail="..." and detail='...'
+    messages = re.findall(r'detail\s*=\s*["\']([^"\']+)["\']', source)
+    return messages
+
+
+class TestAuthErrorMessagesNoLeaks:
+    """Verify that error messages in auth.py do not leak implementation details."""
+
+    @pytest.fixture(autouse=True)
+    def _load_messages(self):
+        self.messages = _collect_auth_error_messages()
+        # Sanity: we should have found at least a few messages
+        assert len(self.messages) >= 3, (
+            f"Expected at least 3 error messages, found {len(self.messages)}"
+        )
+
+    def test_no_bearer_usage_instructions(self):
+        """Error messages must not tell attackers the exact auth header format."""
+        for msg in self.messages:
+            assert "Use: Authorization: Bearer" not in msg, (
+                f"Error message leaks auth format: {msg!r}"
+            )
+            assert "Authorization: Bearer" not in msg, (
+                f"Error message leaks auth header name: {msg!r}"
+            )
+
+    def test_no_env_var_names_leaked(self):
+        """Error messages must not reveal internal env var names."""
+        env_vars = [
+            "CONTEXTSYNAPSE_ADMIN_KEY",
+            "AICONTEXTDB_ADMIN_KEY",
+            "CONTEXTSYNAPSE_JWT_SECRET",
+            "AICONTEXTDB_JWT_SECRET",
+            "CONTEXTSYNAPSE_CORS_ORIGINS",
+            "AICONTEXTDB_CORS_ORIGINS",
+        ]
+        for msg in self.messages:
+            for var in env_vars:
+                assert var not in msg, (
+                    f"Error message leaks env var '{var}': {msg!r}"
+                )
+
+    def test_no_stack_trace_hints(self):
+        """Error messages should not contain stacktrace-like content."""
+        bad_patterns = ["traceback", "File \"", "line ", "raise ", "Exception("]
+        for msg in self.messages:
+            for pat in bad_patterns:
+                assert pat not in msg, (
+                    f"Error message contains implementation hint '{pat}': {msg!r}"
+                )
+
+    def test_messages_are_user_friendly(self):
+        """All error messages should be human-readable sentences (not code)."""
+        for msg in self.messages:
+            # Should end with a period (proper sentence)
+            assert msg.rstrip().endswith("."), (
+                f"Error message is not a proper sentence (no period): {msg!r}"
+            )
+            # Should not contain Python code artifacts
+            assert "==" not in msg
+            assert "!=" not in msg
+            assert "None" not in msg