phpwarden 2.0.3__tar.gz → 2.1.0__tar.gz

{phpwarden-2.0.3 → phpwarden-2.1.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: phpwarden
-Version: 2.0.3
+Version: 2.1.0
 Summary: PHP vulnerability scanner for Composer, WordPress and the PHP engine — findings ranked by real-world exploitation (CISA KEV, then EPSS), not CVSS. Offline, zero deps.
 Author: oroma-alfred
 License-Expression: Apache-2.0
@@ -100,6 +100,7 @@ phpwarden scan                       # assess this host (auto-detects version/SA
 phpwarden scan --version 8.3.10 --sapi fpm --os linux
 phpwarden deps composer.lock         # Composer dependencies, KEV → reachability → EPSS → CVSS
 phpwarden wordpress /var/www/html    # WordPress core, plugins, themes
+phpwarden integrity /var/www/html    # tampered or injected files (vs wordpress.org checksums)
 phpwarden detect /var/log/nginx/access.log   # exploit signatures in a log
 phpwarden rules --format nginx --out php-block.conf   # PHP-specific WAF rules (or modsecurity)
 phpwarden report web01.json web02.json --out fleet.html   # aggregate a fleet view

{phpwarden-2.0.3 → phpwarden-2.1.0}/README.md

@@ -78,6 +78,7 @@ phpwarden scan                       # assess this host (auto-detects version/SA
 phpwarden scan --version 8.3.10 --sapi fpm --os linux
 phpwarden deps composer.lock         # Composer dependencies, KEV → reachability → EPSS → CVSS
 phpwarden wordpress /var/www/html    # WordPress core, plugins, themes
+phpwarden integrity /var/www/html    # tampered or injected files (vs wordpress.org checksums)
 phpwarden detect /var/log/nginx/access.log   # exploit signatures in a log
 phpwarden rules --format nginx --out php-block.conf   # PHP-specific WAF rules (or modsecurity)
 phpwarden report web01.json web02.json --out fleet.html   # aggregate a fleet view

{phpwarden-2.0.3 → phpwarden-2.1.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "phpwarden"
-version = "2.0.3"
+version = "2.1.0"
 description = "PHP vulnerability scanner for Composer, WordPress and the PHP engine — findings ranked by real-world exploitation (CISA KEV, then EPSS), not CVSS. Offline, zero deps."
 readme = "README.md"
 requires-python = ">=3.8"

{phpwarden-2.0.3 → phpwarden-2.1.0}/src/phpwarden/__init__.py

@@ -5,4 +5,4 @@ environment against an evolving knowledge base of PHP CVEs (the feed), and can
 watch PHP-FPM for active exploitation. The engine is open; the CVE feed is the
 part a subscription keeps current.
 """
-__version__ = "2.0.3"
+__version__ = "2.1.0"

{phpwarden-2.0.3 → phpwarden-2.1.0}/src/phpwarden/cli.py

@@ -372,6 +372,39 @@ def _wordpress(args):
     return _combine(1 if findings else 0, _maybe_report(args, doc))
 
 
+def _integrity(args):
+    from phpwarden import integrity as integ
+    res = integ.check(args.path, locale=args.locale, plugins=not args.no_plugins)
+    doc = integ.to_doc(res)
+    if args.json:
+        print(json.dumps(doc, indent=2))
+        return 1 if res.tampered else 0
+    if not res.core_version:
+        print(f"{args.path}: no WordPress install detected at that path")
+        return 2
+    labels = {"php-in-uploads": "PHP file in uploads", "unexpected": "does not belong",
+              "modified": "modified", "missing": "missing"}
+    bad = [i for i in res.issues if i.kind != "missing"]
+    print(f"WordPress {res.core_version} at {args.path}: {res.files_checked} files compared with wordpress.org, "
+          f"{len(bad)} problem{'s' if len(bad) != 1 else ''}.")
+    for i in res.issues:
+        flag = "  SUSPICIOUS" if i.suspicious else ""
+        print(f"\n  {labels.get(i.kind, i.kind):20} {i.path}  ({i.component}){flag}")
+        for pid in i.suspicious:
+            print(f"      matches: {integ.describe(pid)}")
+    if res.verified:
+        print(f"\n  verified against official checksums: {len(res.verified)} component(s)")
+    if res.unverified:
+        print(f"  could not be verified: {len(res.unverified)} component(s)")
+        for u in res.unverified[:40]:
+            print(f"      {u['component']}: {u['reason']}")
+    if not res.issues:
+        print("\n  No modified or unexpected files in the components that could be verified.")
+    print("\n  This compares files with wordpress.org checksums and looks for common backdoor code.\n"
+          "  It is not a signature-based malware scanner.")
+    return 1 if res.tampered else 0
+
+
 def _report(args):
     rows = reportgen.load_rows(args.files)
     feed = FeedManager().current()
@@ -438,6 +471,14 @@ def main(argv=None):
     _report_args(wpc)
     wpc.set_defaults(func=_wordpress)
 
+    ig = sub.add_parser("integrity", help="check WordPress core and plugin files against wordpress.org "
+                                          "checksums; flag injected files and backdoor code")
+    ig.add_argument("path", help="path to the WordPress root")
+    ig.add_argument("--locale", default="en_US", help="WordPress locale of the install (default en_US)")
+    ig.add_argument("--no-plugins", action="store_true", help="check core and uploads only")
+    ig.add_argument("--json", action="store_true")
+    ig.set_defaults(func=_integrity)
+
     rp = sub.add_parser("report", help="aggregate JSON results into an HTML fleet dashboard")
     rp.add_argument("files", nargs="+", help="JSON files from scan/deps/wordpress --json")
     rp.add_argument("--out", help="write HTML to a file instead of stdout")

phpwarden-2.1.0/src/phpwarden/integrity.py

@@ -0,0 +1,254 @@
+"""File integrity check for a WordPress install.
+
+Answers "has this site's code been tampered with?" without malware signatures:
+
+  * WordPress core files are compared with the official checksums from
+    api.wordpress.org for the installed version;
+  * every wordpress.org plugin is compared with the plugin-checksums service;
+  * files that do not belong (extra PHP in wp-admin / wp-includes / a plugin, any
+    PHP under wp-content/uploads) are listed;
+  * modified and unexpected PHP files are checked for a small set of well-known
+    backdoor idioms (eval of decoded data, request input passed to a code or
+    command function, and so on).
+
+This is not a signature-based malware scanner. A changed core file or a PHP file
+in uploads is how most compromised sites show up; novel malware hidden in a
+premium plugin or a theme (which have no public checksums) is not covered, and
+the report says which components could not be verified.
+
+Needs network access to wordpress.org. Standard library only.
+"""
+from __future__ import annotations
+
+import hashlib
+import json
+import re
+import urllib.error
+import urllib.request
+from dataclasses import dataclass, field
+from pathlib import Path
+from typing import Callable, Dict, List, Optional
+
+from phpwarden import wordpress as wp
+
+CORE_URL = "https://api.wordpress.org/core/checksums/1.0/?version={version}&locale={locale}"
+PLUGIN_URL = "https://downloads.wordpress.org/plugin-checksums/{slug}/{version}.json"
+_UA = "phpwarden-integrity"
+_PHP_EXT = (".php", ".phtml", ".php5", ".php7", ".phar", ".pht")
+_SAFE = re.compile(r"^[A-Za-z0-9._-]+$")
+MAX_SCAN_BYTES = 2_000_000
+
+# (id, description, pattern). Deliberately few and specific: each one is rare in
+# legitimate code and common in real backdoors.
+_INPUT = r"\$_(?:GET|POST|REQUEST|COOKIE|SERVER|FILES)\b"
+_DECODE = r"(?:base64_decode|gzinflate|gzuncompress|gzdecode|str_rot13|hex2bin|strrev|convert_uudecode)"
+PATTERNS = [
+    ("eval-decoded", "eval() of decoded or decompressed data",
+     re.compile(r"\beval\s*\(\s*(?:@\s*)?" + _DECODE + r"\s*\(", re.I)),
+    ("eval-input", "eval()/assert() of request input",
+     re.compile(r"\b(?:eval|assert)\s*\(\s*(?:@\s*)?(?:stripslashes\s*\(\s*)?" + _INPUT, re.I)),
+    ("exec-input", "request input passed to a command function",
+     re.compile(r"\b(?:system|exec|shell_exec|passthru|popen|proc_open)\s*\(\s*(?:@\s*)?" + _INPUT, re.I)),
+    ("decode-input-exec", "decoded request input executed",
+     re.compile(r"\b(?:eval|assert|system|exec|shell_exec|passthru)\s*\(\s*" + _DECODE + r"\s*\(\s*" + _INPUT, re.I)),
+    ("preg-e", "preg_replace() with the /e (execute) modifier",
+     re.compile(r"preg_replace\s*\(\s*(['\"])(.)(?:(?!\1).)*\2[a-zA-Z]*e[a-zA-Z]*\1", re.I | re.S)),
+    ("create-function-input", "create_function() built from request input",
+     re.compile(r"\bcreate_function\s*\([^)]*" + _INPUT, re.I)),
+    ("variable-function-input", "request input called as a function",
+     re.compile(_INPUT + r"\s*\[[^\]]+\]\s*\(", re.I)),
+    ("upload-write", "uploaded file moved using a name taken from the request",
+     re.compile(r"move_uploaded_file\s*\([^,]+,\s*[^)]*" + _INPUT, re.I)),
+    ("long-encoded-blob", "very long encoded string passed to a decoder",
+     re.compile(_DECODE + r"\s*\(\s*['\"][A-Za-z0-9+/=\\x]{1500,}['\"]", re.I)),
+]
+
+
+@dataclass
+class Issue:
+    kind: str          # modified | unexpected | missing | php-in-uploads
+    component: str     # core | plugin:<slug> | uploads
+    path: str          # relative to the WordPress root
+    suspicious: List[str] = field(default_factory=list)   # pattern ids that matched
+
+
+@dataclass
+class Result:
+    root: str
+    core_version: Optional[str]
+    issues: List[Issue] = field(default_factory=list)
+    verified: List[str] = field(default_factory=list)      # components checked against checksums
+    unverified: List[dict] = field(default_factory=list)   # {"component", "reason"}
+    files_checked: int = 0
+
+    @property
+    def tampered(self) -> bool:
+        return any(i.kind in ("modified", "unexpected", "php-in-uploads") for i in self.issues)
+
+
+def _fetch_json(url: str, timeout: float = 20.0):
+    req = urllib.request.Request(url, headers={"User-Agent": _UA, "Accept": "application/json"})
+    with urllib.request.urlopen(req, timeout=timeout) as r:      # noqa: S310 — fixed https hosts
+        return json.loads(r.read().decode("utf-8", "replace"))
+
+
+def _md5(path: Path) -> str:
+    h = hashlib.md5()                                            # noqa: S324 — wordpress.org publishes md5
+    with open(path, "rb") as fh:
+        for chunk in iter(lambda: fh.read(1 << 16), b""):
+            h.update(chunk)
+    return h.hexdigest()
+
+
+def suspicious_patterns(path: Path) -> List[str]:
+    """Ids of the backdoor idioms found in a file (empty for non-PHP or huge files)."""
+    if path.suffix.lower() not in _PHP_EXT:
+        return []
+    try:
+        if path.stat().st_size > MAX_SCAN_BYTES:
+            return []
+        text = path.read_text(errors="replace")
+    except OSError:
+        return []
+    return [pid for pid, _, rx in PATTERNS if rx.search(text)]
+
+
+def _walk(base: Path):
+    """Regular files under base (no symlink following), as (relative posix path, Path)."""
+    if not base.is_dir():
+        return
+    stack = [base]
+    while stack:
+        d = stack.pop()
+        try:
+            entries = list(d.iterdir())
+        except OSError:
+            continue
+        for e in entries:
+            if e.is_symlink():
+                continue
+            if e.is_dir():
+                stack.append(e)
+            elif e.is_file():
+                yield e.relative_to(base).as_posix(), e
+
+
+def _is_php(rel: str) -> bool:
+    return rel.lower().endswith(_PHP_EXT)
+
+
+def _compare(result: Result, component: str, base: Path, root: Path, sums: Dict[str, List[str]],
+             unexpected_php_only: bool, skip: Callable[[str], bool] = lambda rel: False):
+    """Compare files under `base` with `sums` ({relative path: [accepted md5...]})."""
+    seen = set()
+    for rel, path in _walk(base):
+        if skip(rel):
+            continue
+        result.files_checked += 1
+        relroot = path.relative_to(root).as_posix()
+        want = sums.get(rel)
+        if want is None:
+            if unexpected_php_only and not _is_php(rel):
+                continue
+            result.issues.append(Issue("unexpected", component, relroot, suspicious_patterns(path)))
+            continue
+        seen.add(rel)
+        try:
+            got = _md5(path)
+        except OSError:
+            continue
+        if got not in want:
+            result.issues.append(Issue("modified", component, relroot, suspicious_patterns(path)))
+    for rel in sums:
+        if rel not in seen and not skip(rel) and _is_php(rel) and not (base / rel).exists():
+            result.issues.append(Issue("missing", component, (base / rel).relative_to(root).as_posix()))
+
+
+def check(wp_root, locale: str = "en_US", plugins: bool = True,
+          fetch: Callable[[str], dict] = _fetch_json) -> Result:
+    root = Path(wp_root)
+    core = wp.detect_core(root)
+    res = Result(str(root), core)
+    if not core:
+        res.unverified.append({"component": "core", "reason": "no WordPress install found at that path"})
+        return res
+
+    # ---- core
+    try:
+        doc = fetch(CORE_URL.format(version=core, locale=locale))
+        raw = doc.get("checksums") if isinstance(doc, dict) else None
+        if isinstance(raw, dict) and locale in raw and isinstance(raw[locale], dict):
+            raw = raw[locale]
+        if not isinstance(raw, dict) or not raw:
+            raise ValueError("no checksums for this version/locale")
+        sums = {k: [v] for k, v in raw.items() if isinstance(v, str)}
+        # wp-content is user territory (bundled themes/plugins get updated on their own)
+        _compare(res, "core", root, root, sums, unexpected_php_only=True,
+                 skip=lambda rel: rel.startswith("wp-content/") or rel in ("wp-config.php", ".htaccess")
+                 or not (rel.startswith("wp-admin/") or rel.startswith("wp-includes/") or "/" not in rel))
+        res.verified.append(f"core {core}")
+    except (urllib.error.URLError, OSError, ValueError) as e:
+        res.unverified.append({"component": f"core {core}", "reason": f"checksums unavailable: {_why(e)}"})
+
+    # ---- plugins
+    pdir = root / "wp-content" / "plugins"
+    if plugins and pdir.is_dir():
+        for slug, version in sorted(wp.detect_plugins(root).items()):
+            base = pdir / slug
+            if not base.is_dir():        # single-file plugin: nothing published to compare against
+                res.unverified.append({"component": f"plugin {slug}", "reason": "single-file plugin"})
+                continue
+            if not version or not _SAFE.match(slug) or not _SAFE.match(version):
+                res.unverified.append({"component": f"plugin {slug}", "reason": "version not detected"})
+                continue
+            try:
+                doc = fetch(PLUGIN_URL.format(slug=slug, version=version))
+                files = doc.get("files") if isinstance(doc, dict) else None
+                if not isinstance(files, dict) or not files:
+                    raise ValueError("empty checksum list")
+                sums = {}
+                for rel, meta in files.items():
+                    md5 = meta.get("md5") if isinstance(meta, dict) else None
+                    sums[rel] = [md5] if isinstance(md5, str) else [m for m in (md5 or []) if isinstance(m, str)]
+                _compare(res, f"plugin:{slug}", base, root, sums, unexpected_php_only=True)
+                res.verified.append(f"plugin {slug} {version}")
+            except urllib.error.HTTPError as e:
+                reason = ("not on wordpress.org (premium or custom), cannot be verified" if e.code == 404
+                          else f"checksums unavailable: HTTP {e.code}")
+                res.unverified.append({"component": f"plugin {slug} {version}", "reason": reason})
+            except (urllib.error.URLError, OSError, ValueError) as e:
+                res.unverified.append({"component": f"plugin {slug} {version}",
+                                       "reason": f"checksums unavailable: {_why(e)}"})
+
+    # ---- themes have no public checksums: say so rather than imply they were checked
+    for slug in sorted(wp.detect_themes(root)):
+        res.unverified.append({"component": f"theme {slug}", "reason": "no public checksums for themes"})
+
+    # ---- PHP where it should never be
+    up = root / "wp-content" / "uploads"
+    for rel, path in _walk(up):
+        if _is_php(rel):
+            res.issues.append(Issue("php-in-uploads", "uploads", path.relative_to(root).as_posix(),
+                                    suspicious_patterns(path)))
+    order = {"php-in-uploads": 0, "unexpected": 1, "modified": 2, "missing": 3}
+    res.issues.sort(key=lambda i: (0 if i.suspicious else 1, order.get(i.kind, 9), i.path))
+    return res
+
+
+def _why(e: Exception) -> str:
+    return str(getattr(e, "reason", "") or e)[:120] or e.__class__.__name__
+
+
+def describe(pattern_id: str) -> str:
+    for pid, text, _ in PATTERNS:
+        if pid == pattern_id:
+            return text
+    return pattern_id
+
+
+def to_doc(res: Result) -> dict:
+    return {"integrity": res.root, "core_version": res.core_version, "tampered": res.tampered,
+            "files_checked": res.files_checked,
+            "issues": [{"kind": i.kind, "component": i.component, "path": i.path, "suspicious": i.suspicious}
+                       for i in res.issues],
+            "verified": res.verified, "unverified": res.unverified}

{phpwarden-2.0.3 → phpwarden-2.1.0}/src/phpwarden.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: phpwarden
-Version: 2.0.3
+Version: 2.1.0
 Summary: PHP vulnerability scanner for Composer, WordPress and the PHP engine — findings ranked by real-world exploitation (CISA KEV, then EPSS), not CVSS. Offline, zero deps.
 Author: oroma-alfred
 License-Expression: Apache-2.0
@@ -100,6 +100,7 @@ phpwarden scan                       # assess this host (auto-detects version/SA
 phpwarden scan --version 8.3.10 --sapi fpm --os linux
 phpwarden deps composer.lock         # Composer dependencies, KEV → reachability → EPSS → CVSS
 phpwarden wordpress /var/www/html    # WordPress core, plugins, themes
+phpwarden integrity /var/www/html    # tampered or injected files (vs wordpress.org checksums)
 phpwarden detect /var/log/nginx/access.log   # exploit signatures in a log
 phpwarden rules --format nginx --out php-block.conf   # PHP-specific WAF rules (or modsecurity)
 phpwarden report web01.json web02.json --out fleet.html   # aggregate a fleet view

{phpwarden-2.0.3 → phpwarden-2.1.0}/src/phpwarden.egg-info/SOURCES.txt

@@ -9,6 +9,7 @@ src/phpwarden/engine.py
 src/phpwarden/env.py
 src/phpwarden/feed.py
 src/phpwarden/guard.py
+src/phpwarden/integrity.py
 src/phpwarden/report.py
 src/phpwarden/rules.py
 src/phpwarden/version.py
@@ -22,6 +23,7 @@ src/phpwarden.egg-info/top_level.txt
 src/phpwarden/data/php-cve-feed.json
 tests/test_accounts.py
 tests/test_advisories.py
+tests/test_agency.py
 tests/test_assignment.py
 tests/test_audit.py
 tests/test_billing.py
@@ -41,6 +43,7 @@ tests/test_feed_subscription.py
 tests/test_fleet.py
 tests/test_google_oauth.py
 tests/test_guard_live.py
+tests/test_integrity.py
 tests/test_mentions.py
 tests/test_reachability.py
 tests/test_saas.py
@@ -50,6 +53,7 @@ tests/test_settings.py
 tests/test_shield.py
 tests/test_slack.py
 tests/test_sso.py
+tests/test_store_connections.py
 tests/test_team.py
 tests/test_triage.py
 tests/test_webhook_idempotency.py

phpwarden-2.1.0/tests/test_agency.py

@@ -0,0 +1,259 @@
+#!/usr/bin/env python3
+"""Agency features end to end against a real server: site agent inventory, remote
+update commands, roles, partner API, embed widget, client report, schedules."""
+import json, os, re, sys, tempfile, threading, time, urllib.parse, urllib.request, urllib.error
+from pathlib import Path
+ROOT = Path(__file__).resolve().parent.parent
+sys.path.insert(0, str(ROOT)); sys.path.insert(0, str(ROOT / "src"))
+os.environ["PHPWARDEN_REPORT_SCHEDULER"] = "0"
+from saas.server import make_server  # noqa: E402
+from saas import auth, agency  # noqa: E402
+from phpwarden.deps import constraint_matches  # noqa: E402
+
+ok = True
+def check(name, cond):
+    global ok; ok = ok and bool(cond); print(("PASS " if cond else "FAIL ") + name)
+
+class NoRedirect(urllib.request.HTTPRedirectHandler):
+    def redirect_request(self, *a): return None
+opener = urllib.request.build_opener(NoRedirect)
+
+def req(url, method="GET", data=None, cookie="", headers=None, bearer=None):
+    h = dict(headers or {})
+    if cookie: h["Cookie"] = cookie
+    if bearer: h["Authorization"] = "Bearer " + bearer
+    if isinstance(data, (dict, list)) and bearer:
+        data = json.dumps(data).encode(); h["Content-Type"] = "application/json"
+    elif isinstance(data, (dict, list)):
+        data = urllib.parse.urlencode(data, doseq=True).encode()
+    if data is not None and "Content-Type" not in h:
+        h["Content-Type"] = "application/x-www-form-urlencoded"
+    r = urllib.request.Request(url, data=data, method=method, headers=h)
+    try:
+        resp = opener.open(r, timeout=10); return resp.status, resp.headers, resp.read()
+    except urllib.error.HTTPError as e:
+        return e.code, e.headers, e.read()
+
+def J(b):
+    try: return json.loads(b or b"{}")
+    except ValueError: return {}
+
+def csrf_of(body):
+    m = re.search(rb'name=["\']?csrf["\']?\s+value=["\']?([^"\'\s>]+)', body)
+    return m.group(1).decode() if m else ""
+
+def login(st, uid, base, path="/settings/agency"):
+    sess = st.create_session(uid)
+    s, h, b = req(base + path, cookie=f"pw_session={sess}")
+    cks = [v.split(";")[0] for v in (h.get_all("Set-Cookie") or [])]
+    return "; ".join([f"pw_session={sess}"] + cks), csrf_of(b), s, b
+
+with tempfile.TemporaryDirectory() as d:
+    srv = make_server(str(Path(d) / "s.db"), "127.0.0.1", 0, str(Path(d) / "alerts.log"))
+    threading.Thread(target=srv.serve_forever, daemon=True).start()
+    base = f"http://127.0.0.1:{srv.server_address[1]}"; st = srv.store
+
+    # a plugin version the feed knows to be vulnerable and exploited
+    adv = ver = None
+    for a in srv.feed.wp:
+        if a.type == "plugin" and a.known_exploited and a.fixed:
+            for v in ("0.0.1", "1.0.0", "1.0"):
+                try:
+                    if constraint_matches(v, a.affected): adv, ver = a, v; break
+                except Exception: pass
+        if adv: break
+    check("feed has an exploited plugin advisory to test with", adv is not None)
+    slug = adv.slug.replace("_", "-")
+
+    owner = st.create_user("owner@agency.io", auth.hash_password("pw-owner-123"))
+    st.consume_verification(st.create_verification(owner)); st.set_plan(owner, "team")
+    pid, token = st.create_project("Client A", owner_user_id=owner)
+    pid2, token2 = st.create_project("Client B", owner_user_id=owner)
+
+    def inv(remote, update="9.9.9"):
+        return {"agent": "phpwarden-wp/1.0.0", "site_url": "https://a.example", "php": {"version": "8.1.0", "sapi": "fpm-fcgi"},
+                "wordpress": {"core": "6.5.2", "plugins": [
+                    {"slug": slug, "file": f"{slug}/{slug}.php", "name": "Vuln Plugin", "version": ver, "active": True, "update": update},
+                    {"slug": "fine-plugin", "file": "fine-plugin/fine.php", "name": "Fine", "version": "1.0", "active": True, "update": None},
+                    {"slug": "../evil", "file": "../../wp-config.php", "version": "1", "active": True, "update": "2"}],
+                    "themes": [{"slug": "twentytwentyfour", "name": "TT4", "version": "1.0", "active": True, "update": "1.1"}]},
+                "remote_updates": remote}
+
+    # ---- agent inventory
+    s, _, b = req(f"{base}/v1/inventory", "POST", inv(False), bearer="nope")
+    check("inventory: bad token 401", s == 401 and J(b).get("error") == "invalid_token")
+    s, _, b = req(f"{base}/v1/inventory", "POST", inv(False), bearer=token); j = J(b)
+    check("inventory: accepted, findings matched server-side", s == 200 and j.get("ok") and j.get("kev", 0) >= 1 and j.get("stored", 0) >= 2)
+    check("inventory: no commands when remote updates are off", j.get("commands") == [])
+    fs = st.current_findings(pid)
+    wild = [i for i, f in enumerate(fs) if f.wild]
+    check("findings: exploited plugin found, exploited ones ranked first",
+          any(f.wild and f.ident.startswith(slug + " ") for f in fs) and wild == list(range(len(wild))))
+    check("findings: PHP engine findings stored too", any(f.source == "engine" for f in fs))
+    check("inventory: path-traversal slug dropped", all(p["slug"] != "../evil" for p in agency.get_inventory(st, pid)["wordpress"]["plugins"]))
+    s, _, b = req(f"{base}/v1/inventory", "POST", data=b"[1,2]", bearer=token, headers={"Content-Type": "application/json"})
+    check("inventory: non-object JSON rejected", s == 400)
+
+    cookie, csrf, s, b = login(st, owner, base)
+    check("agency settings page renders for Team owner", s == 200 and b"Report branding" in b and b"Partner API" in b)
+    s, _, b = req(f"{base}/app/project/{pid}/site", cookie=cookie)
+    check("site page: the exploited plugin is flagged as exploited", b"1 exploited" in b or b"exploited</span>" in b)
+    check("site page: lists components, read-only while remote updates off", s == 200 and b"Vuln Plugin" in b and b"Remote updates are <b>off</b>" in b and b">Update</button>" not in b)
+
+    # ---- queueing is refused while the site has remote updates off
+    s, _, b = req(f"{base}/app/project/{pid}/site/command", "POST", {"csrf": csrf, "action": "update_plugin", "slug": slug}, cookie=cookie)
+    check("command: refused when remote updates off", s == 400)
+    req(f"{base}/v1/inventory", "POST", inv(True), bearer=token)
+    s, _, b = req(f"{base}/app/project/{pid}/site/command", "POST", {"csrf": "bad", "action": "update_plugin", "slug": slug}, cookie=cookie)
+    check("command: bad CSRF 403", s == 403)
+    s, _, b = req(f"{base}/app/project/{pid}/site/command", "POST", {"csrf": csrf, "action": "update_plugin", "slug": "not-installed"}, cookie=cookie)
+    check("command: unknown component not queued", s == 200 and b"Nothing new to queue" in b)
+    s, _, b = req(f"{base}/app/project/{pid}/site/command", "POST", {"csrf": csrf, "action": "rm_rf", "slug": slug}, cookie=cookie)
+    check("command: unknown action not queued", b"Nothing new to queue" in b)
+    s, _, b = req(f"{base}/app/project/{pid}/site/command", "POST", {"csrf": csrf, "action": "update_plugin", "slug": slug}, cookie=cookie)
+    check("command: update queued", s == 200 and b"Queued 1 action" in b)
+    s, _, b = req(f"{base}/app/project/{pid}/site/command", "POST", {"csrf": csrf, "action": "update_plugin", "slug": slug}, cookie=cookie)
+    check("command: duplicate not queued twice", b"Nothing new to queue" in b)
+
+    s, _, b = req(f"{base}/v1/inventory", "POST", inv(True), bearer=token); cmds = J(b).get("commands") or []
+    check("agent receives exactly the queued command", len(cmds) == 1 and cmds[0]["action"] == "update_plugin" and cmds[0]["slug"] == slug and cmds[0]["file"] == f"{slug}/{slug}.php")
+    s, _, b = req(f"{base}/v1/inventory", "POST", inv(True), bearer=token)
+    check("command is not handed out twice", J(b).get("commands") == [])
+    cid = cmds[0]["id"]
+    s, _, b = req(f"{base}/v1/commands/{cid}/result", "POST", {"ok": True, "from": ver, "to": "9.9.9"}, bearer=token2)
+    check("result: another project's token cannot close it", s == 404)
+    s, _, b = req(f"{base}/v1/commands/{cid}/result", "POST", {"ok": True, "from": ver, "to": "9.9.9"}, bearer=token)
+    check("result: accepted", s == 200)
+    s, _, b = req(f"{base}/v1/commands/{cid}/result", "POST", {"ok": True}, bearer=token)
+    check("result: second report rejected", s == 404)
+    s, _, b = req(f"{base}/app/project/{pid}/site", cookie=cookie)
+    check("site page shows the finished action", b"9.9.9" in b and b">done<" in b)
+
+    # ---- fleet updates
+    req(f"{base}/v1/inventory", "POST", inv(True), bearer=token2)
+    s, _, b = req(f"{base}/fleet/updates", cookie=cookie)
+    check("fleet updates: lists the plugin across 2 sites", s == 200 and b"Update on 2 sites" in b and b"exploited on 2" in b)
+    s, _, b = req(f"{base}/fleet/updates/queue", "POST", {"csrf": csrf, "kind": "plugin", "slug": slug}, cookie=cookie)
+    check("fleet updates: queued on both sites", b"on 2 sites" in b)
+
+    # ---- roles
+    op = st.create_user("op@agency.io", auth.hash_password("pw-op-12345")); st.consume_verification(st.create_verification(op))
+    cl = st.create_user("client@a.example", auth.hash_password("pw-cl-12345")); st.consume_verification(st.create_verification(cl))
+    for uid_, em in ((op, "op@agency.io"), (cl, "client@a.example")):
+        st.accept_invite(st.create_invite(owner, em), uid_)
+    check("default role: member sees all projects", st.can_access_project(op, pid) and st.can_access_project(op, pid2))
+    s, _, b = req(f"{base}/settings/agency/access", "POST", [("csrf", csrf), ("email", "op@agency.io"), ("role", "operator"), ("project", pid)], cookie=cookie)
+    check("owner sets operator on Client A", s == 200 and b"Access saved" in b)
+    s, _, b = req(f"{base}/settings/agency/access", "POST", [("csrf", csrf), ("email", "client@a.example"), ("role", "client"), ("project", pid), ("project", "not-mine")], cookie=cookie)
+    check("owner sets client on Client A", s == 200)
+    check("operator: assigned site only", st.can_access_project(op, pid) and not st.can_access_project(op, pid2) and st.can_write_project(op, pid))
+    check("client: read-only on assigned site only", st.can_access_project(cl, pid) and not st.can_write_project(cl, pid) and not st.can_access_project(cl, pid2))
+    ccookie, ccsrf, s, b = login(st, cl, base, f"/app/project/{pid}/site")
+    check("client can open the site page, sees view-only note", s == 200 and b"view-only" in b)
+    s, _, b = req(f"{base}/app/project/{pid2}/site", cookie=ccookie)
+    check("client cannot open another client's site", s == 403)
+    s, _, b = req(f"{base}/app/project/{pid}/site/command", "POST", {"csrf": ccsrf, "action": "update_theme", "slug": "twentytwentyfour"}, cookie=ccookie)
+    check("client cannot queue updates", s == 403)
+    s, _, b = req(f"{base}/app/project/{pid}/finding-state", "POST", {"csrf": ccsrf, "fkey": "x", "status": "fixed"}, cookie=ccookie)
+    check("client cannot change finding status", s == 403)
+    s, _, b = req(f"{base}/app/project/{pid}/message", "POST", {"csrf": ccsrf, "text": "hi"}, cookie=ccookie)
+    check("client cannot post to discussion", s == 403)
+    s, _, b = req(f"{base}/settings/agency/access", "POST", [("csrf", ccsrf), ("email", "op@agency.io"), ("role", "member")], cookie=ccookie)
+    check("non-Team member cannot edit access", s == 403)
+
+    # ---- report + branding
+    s, _, b = req(f"{base}/app/project/{pid}/report", cookie=ccookie)
+    check("client can open the report", s == 200 and b"Security report" in b and b"actively used by attackers" in b and slug.encode() in b)
+    logo = "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNkYPhfDwAChwGA60e6kgAAAABJRU5ErkJggg=="
+    s, _, b = req(f"{base}/settings/agency/brand", "POST", {"csrf": csrf, "name": "Acme <Web> Care", "logo": logo}, cookie=cookie)
+    check("branding saved", s == 200 and b"Branding saved" in b)
+    s, _, b = req(f"{base}/settings/agency/brand", "POST", {"csrf": csrf, "name": "x", "logo": "data:image/svg+xml;base64,PHN2Zz48c2NyaXB0Pg=="}, cookie=cookie)
+    check("SVG logo rejected", s == 400)
+    s, _, b = req(f"{base}/app/project/{pid}/report", cookie=cookie)
+    check("report carries the agency name (escaped) and logo", b"Acme &lt;Web&gt; Care" in b and b"data:image/png;base64" in b and b"<Web>" not in b)
+    s, _, b = req(f"{base}/app/project/{pid}/report")
+    check("report requires login", s in (302, 303))
+
+    # ---- schedules
+    s, _, b = req(f"{base}/settings/agency/schedule", "POST", {"csrf": csrf, "project": pid, "schedule": "weekly", "recipients": "client@a.example; bad, x@y.io"}, cookie=cookie)
+    check("schedule saved with cleaned recipients", s == 200 and agency.get_schedule(st, pid)["recipients"] == "client@a.example, x@y.io")
+    monday = time.mktime(time.strptime("2026-11-16 09:00", "%Y-%m-%d %H:%M")) - time.timezone
+    tuesday = monday + 86400
+    sent = []
+    n = agency.send_due_reports(st, lambda to, subj, text: sent.append((to, subj, text)), base, now=tuesday)
+    check("weekly report not sent on a Tuesday", n == 0)
+    n = agency.send_due_reports(st, lambda to, subj, text: sent.append((to, subj, text)), base, now=monday)
+    check("weekly report sent on Monday to both recipients", n == 2 and "Client A" in sent[0][1] and "ACTIVELY EXPLOITED" in sent[0][2])
+    n = agency.send_due_reports(st, lambda to, subj, text: sent.append((to, subj, text)), base, now=monday + 3600)
+    check("not sent twice the same day", n == 0)
+
+    # ---- partner API
+    s, _, b = req(f"{base}/settings/agency/partner-key", "POST", {"csrf": csrf}, cookie=cookie)
+    m = re.search(rb"(pwp_[A-Za-z0-9_-]+)", b); key = m.group(1).decode() if m else ""
+    check("partner key shown once", s == 200 and key.startswith("pwp_"))
+    s, _, b = req(f"{base}/v1/partner/projects", bearer="pwp_wrong")
+    check("partner: bad key 401", s == 401 and J(b).get("error") == "invalid_key")
+    s, _, b = req(f"{base}/v1/partner/projects", "POST", {"name": "shop.example", "external_id": "whmcs-77"}, bearer=key); p = J(b)
+    check("partner: create returns id + token", s == 201 and p.get("id") and p.get("token") and p.get("external_id") == "whmcs-77")
+    s, _, b = req(f"{base}/v1/partner/projects", "POST", {"name": "shop.example", "external_id": "whmcs-77"}, bearer=key); p2 = J(b)
+    check("partner: create is idempotent, no token on repeat", s == 200 and p2.get("id") == p["id"] and "token" not in p2)
+    s, _, b = req(f"{base}/v1/partner/projects", bearer=key)
+    check("partner: list includes all projects", s == 200 and len(J(b)["projects"]) == 3)
+    s, _, b = req(f"{base}/v1/partner/projects/{p['id']}/suspend", "POST", {}, bearer=key)
+    check("partner: suspend", s == 200 and J(b).get("suspended") is True)
+    s, _, b = req(f"{base}/v1/inventory", "POST", inv(False), bearer=p["token"])
+    check("suspended project rejects the agent", s == 403 and J(b).get("error") == "suspended")
+    s, _, b = req(f"{base}/v1/reports", "POST", {"vulnerable": []}, bearer=p["token"])
+    check("suspended project rejects CLI ingest", s == 403)
+    req(f"{base}/v1/partner/projects/{p['id']}/unsuspend", "POST", {}, bearer=key)
+    s, _, b = req(f"{base}/v1/inventory", "POST", inv(False), bearer=p["token"])
+    check("unsuspended project accepts the agent again", s == 200)
+    s, _, b = req(f"{base}/v1/partner/projects/{p['id']}/token", "POST", {}, bearer=key); newtok = J(b).get("token")
+    s2, _, _ = req(f"{base}/v1/inventory", "POST", inv(False), bearer=p["token"])
+    check("partner: rotate token kills the old one", s == 200 and newtok and s2 == 401)
+
+    other = st.create_user("other@host.io", auth.hash_password("pw-other-123")); st.set_plan(other, "team")
+    okey = agency.new_partner_key(st, other)
+    s, _, b = req(f"{base}/v1/partner/projects/{p['id']}", bearer=okey)
+    check("partner: another account's project is 404", s == 404)
+    s, _, b = req(f"{base}/v1/partner/projects/{p['id']}", "DELETE", bearer=okey)
+    check("partner: another account cannot delete it", s == 404 and st.project_owner(p["id"]) == owner)
+
+    # ---- embed widget
+    s, _, b = req(f"{base}/v1/partner/projects/{p['id']}/embed", "POST", {"ttl": 600}, bearer=key); e = J(b)
+    check("embed: url issued", s == 200 and "/embed/" in e.get("url", "") and e.get("expires", 0) > time.time())
+    s, h, b = req(e["url"])
+    csp = h.get("Content-Security-Policy", "")
+    check("embed: renders without a session, framable, no scripts allowed", s == 200 and b"exploited" in b.lower() and "frame-ancestors *" in csp and "script-src" not in csp and h.get("X-Frame-Options") is None)
+    s, _, b = req(e["url"].replace(p["id"], pid))
+    check("embed: token is bound to its project", s == 403)
+    s, _, b = req(e["url"][:-3] + "abc")
+    check("embed: tampered token rejected", s == 403)
+    check("embed: expired token rejected", not agency.embed_token_ok(srv.csrf_key, pid, f"{int(time.time()) - 5}.deadbeef"))
+    s, h, b = req(f"{base}/app/project/{pid}", cookie=cookie)
+    check("normal pages still forbid framing", h.get("X-Frame-Options") == "DENY" and b"Site &amp; updates" in b and b"Client report" in b)
+
+    s, _, b = req(f"{base}/v1/partner/projects/{p['id']}", "DELETE", bearer=key)
+    check("partner: delete", s == 200 and st.project_owner(p["id"]) is None)
+
+    # ---- alerts stay inside the project
+    seen = []
+    import saas.server as S
+    real = S.emailer.send
+    S.emailer.send = lambda to, subj, text: (seen.append(to), (True, "test"))[1]
+    try:
+        srv.alert(pid2, "wordpress", ["x / CVE-0000-0001"])
+    finally:
+        S.emailer.send = real
+    check("KEV alert for Client B goes to the owner only, not Client A's operator or client",
+          seen == ["owner@agency.io"])
+
+    # ---- plan gate
+    free = st.create_user("free@x.io", auth.hash_password("pw-free-1234"))
+    fkey = agency.new_partner_key(st, free)
+    s, _, b = req(f"{base}/v1/partner/projects", bearer=fkey)
+    check("partner API needs the Team plan", s == 402)
+    srv.shutdown()
+
+print("\nRESULT:", "ALL PASS" if ok else "FAILURES")
+sys.exit(0 if ok else 1)

phpwarden-2.1.0/tests/test_integrity.py

@@ -0,0 +1,109 @@
+#!/usr/bin/env python3
+"""Integrity check: modified core file, injected files, PHP in uploads, plugin
+tampering, unverifiable components, and the backdoor patterns (no false hits on
+ordinary code). The checksum service is faked; one optional live check runs when
+PHPWARDEN_LIVE_TESTS=1."""
+import hashlib, os, sys, tempfile, urllib.error
+from pathlib import Path
+ROOT = Path(__file__).resolve().parent.parent
+sys.path.insert(0, str(ROOT / "src"))
+from phpwarden import integrity as integ  # noqa: E402
+
+ok = True
+def check(name, cond):
+    global ok; ok = ok and bool(cond); print(("PASS " if cond else "FAIL ") + name)
+
+def md5(b): return hashlib.md5(b).hexdigest()
+
+CORE = {"index.php": b"<?php // index\n", "wp-load.php": b"<?php // load\n",
+        "wp-includes/version.php": b"<?php\n$wp_version = '6.5.2';\n",
+        "wp-includes/functions.php": b"<?php function wp_x(){ return 1; }\n",
+        "wp-admin/admin.php": b"<?php // admin\n", "wp-admin/css/a.css": b"body{}\n"}
+PLUG = {"good.php": b"<?php\n/*\nPlugin Name: Good\nVersion: 1.2.0\n*/\n", "inc/a.php": b"<?php // a\n", "readme.txt": b"hi\n"}
+
+def build(d):
+    r = Path(d) / "wp"
+    for rel, b in CORE.items():
+        (r / rel).parent.mkdir(parents=True, exist_ok=True); (r / rel).write_bytes(b)
+    for rel, b in PLUG.items():
+        p = r / "wp-content/plugins/good" / rel; p.parent.mkdir(parents=True, exist_ok=True); p.write_bytes(b)
+    prem = r / "wp-content/plugins/premium"; prem.mkdir(parents=True)
+    (prem / "premium.php").write_bytes(b"<?php\n/*\nPlugin Name: Premium\nVersion: 3.0\n*/\n")
+    (r / "wp-content/themes/mytheme").mkdir(parents=True)
+    (r / "wp-content/themes/mytheme/style.css").write_bytes(b"/*\nTheme Name: My\nVersion: 1.0\n*/\n")
+    (r / "wp-content/uploads/2026").mkdir(parents=True)
+    (r / "wp-content/uploads/2026/photo.jpg").write_bytes(b"\xff\xd8jpg")
+    (r / "wp-config.php").write_bytes(b"<?php // secrets\n")
+    return r
+
+def fake(url):
+    if "core/checksums" in url:
+        return {"checksums": {k: md5(v) for k, v in CORE.items()}}
+    if "/plugin-checksums/good/1.2.0.json" in url:
+        return {"files": {k: {"md5": md5(v), "sha256": "x"} for k, v in PLUG.items()}}
+    raise urllib.error.HTTPError(url, 404, "Not Found", {}, None)
+
+with tempfile.TemporaryDirectory() as d:
+    r = build(d)
+    res = integ.check(r, fetch=fake)
+    check("clean install: nothing reported", not res.issues and not res.tampered)
+    check("clean install: core and wordpress.org plugin verified", res.verified == ["core 6.5.2", "plugin good 1.2.0"])
+    un = {u["component"]: u["reason"] for u in res.unverified}
+    check("premium plugin reported as unverifiable, not as clean", "not on wordpress.org" in un.get("plugin premium 3.0", ""))
+    check("themes reported as unverifiable", "theme mytheme" in un)
+    check("wp-config.php and uploaded images are not flagged", True)
+
+    (r / "wp-includes/functions.php").write_bytes(CORE["wp-includes/functions.php"] + b"eval(base64_decode($_POST['x']));\n")
+    (r / "wp-admin/wp-tmp.php").write_bytes(b"<?php system($_GET['c']);")
+    (r / "wp-includes/extra.css").write_bytes(b"x")
+    (r / "wp-content/uploads/2026/shell.php").write_bytes(b"<?php @eval($_REQUEST['a']);")
+    (r / "wp-content/uploads/2026/note.PhP").write_bytes(b"<?php echo 1;")
+    (r / "wp-content/plugins/good/inc/a.php").write_bytes(b"<?php // changed\n")
+    (r / "wp-content/plugins/good/inc/backdoor.php").write_bytes(b"<?php $_COOKIE['f']($_COOKIE['a']);")
+    (r / "wp-load.php").unlink()
+    res = integ.check(r, fetch=fake)
+    by = {i.path: i for i in res.issues}
+    check("tampered install is flagged", res.tampered)
+    check("modified core file found, with the backdoor pattern", by["wp-includes/functions.php"].kind == "modified" and "decode-input-exec" in by["wp-includes/functions.php"].suspicious)
+    check("injected PHP in wp-admin found", by["wp-admin/wp-tmp.php"].kind == "unexpected" and "exec-input" in by["wp-admin/wp-tmp.php"].suspicious)
+    check("non-PHP extra file in core is not reported", "wp-includes/extra.css" not in by)
+    check("PHP in uploads found (case-insensitive extension)", by["wp-content/uploads/2026/shell.php"].kind == "php-in-uploads" and "wp-content/uploads/2026/note.PhP" in by)
+    check("modified plugin file found", by["wp-content/plugins/good/inc/a.php"].kind == "modified" and by["wp-content/plugins/good/inc/a.php"].component == "plugin:good")
+    check("injected plugin file found, variable-function backdoor", by["wp-content/plugins/good/inc/backdoor.php"].kind == "unexpected" and "variable-function-input" in by["wp-content/plugins/good/inc/backdoor.php"].suspicious)
+    check("deleted core file reported as missing", by["wp-load.php"].kind == "missing")
+    check("suspicious files are listed first", res.issues[0].suspicious and not res.issues[-1].suspicious)
+    doc = integ.to_doc(res)
+    check("JSON document shape", doc["tampered"] is True and doc["core_version"] == "6.5.2" and all({"kind", "component", "path", "suspicious"} <= set(i) for i in doc["issues"]))
+
+    def down(url): raise urllib.error.URLError("no network")
+    res = integ.check(r, fetch=down)
+    check("no network: core reported unverified, uploads still checked", any("core" in u["component"] for u in res.unverified) and any(i.kind == "php-in-uploads" for i in res.issues))
+    res = integ.check(Path(d) / "nothing", fetch=fake)
+    check("not a WordPress root: says so", res.core_version is None and not res.tampered)
+
+    # patterns: real backdoor idioms hit, ordinary code does not
+    def pat(code):
+        p = Path(d) / "t.php"; p.write_text(code); return integ.suspicious_patterns(p)
+    bad = {"eval-decoded": "<?php eval(gzinflate(base64_decode('abc')));", "eval-input": "<?php @eval($_POST['p']);",
+           "exec-input": "<?php passthru($_REQUEST['cmd']);", "preg-e": "<?php preg_replace('/.*/e', $x, '');",
+           "create-function-input": "<?php $f = create_function('', $_GET['c']);",
+           "upload-write": "<?php move_uploaded_file($_FILES['f']['tmp_name'], $_POST['name']);",
+           "long-encoded-blob": "<?php $x = base64_decode('" + "QUJD" * 500 + "');"}
+    for pid, code in bad.items():
+        check(f"pattern {pid} detected", pid in pat(code))
+    good = ["<?php $v = base64_decode($row['data']); echo esc_html($v);", "<?php $x = sanitize_text_field($_POST['name']);",
+            "<?php exec('convert ' . escapeshellarg($file));", "<?php preg_replace('/e+/', 'x', $s);",
+            "<?php // evaluate the result\n$evaluation = eval_score($a);", "<?php move_uploaded_file($_FILES['f']['tmp_name'], $dest);",
+            "<?php if (isset($_GET['page'])) { $page = (int) $_GET['page']; }"]
+    check("ordinary code produces no pattern hits", all(pat(c) == [] for c in good))
+    (Path(d) / "t.txt").write_text("eval(base64_decode('x'))")
+    check("non-PHP files are not pattern-scanned", integ.suspicious_patterns(Path(d) / "t.txt") == [])
+
+if os.environ.get("PHPWARDEN_LIVE_TESTS") == "1":
+    doc = integ._fetch_json(integ.CORE_URL.format(version="6.5.2", locale="en_US"))
+    check("live: wordpress.org core checksums reachable", len(doc.get("checksums") or {}) > 1000)
+    doc = integ._fetch_json(integ.PLUGIN_URL.format(slug="akismet", version="5.3"))
+    check("live: plugin checksums reachable", "akismet.php" in (doc.get("files") or {}))
+
+print("\nRESULT:", "ALL PASS" if ok else "FAILURES")
+sys.exit(0 if ok else 1)

phpwarden-2.1.0/tests/test_store_connections.py

@@ -0,0 +1,40 @@
+"""Regression: Store must not leak SQLite connections (file handles).
+
+On 2026-11-12 production hit its 1,024 open-file limit after leaking ~509
+connections, and every static marketing page returned 404."""
+import os
+import sys
+import tempfile
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parent.parent
+sys.path.insert(0, str(ROOT))
+from saas.store import Store  # noqa: E402
+
+ok = True
+
+
+def check(name, cond):
+    global ok
+    print(("PASS " if cond else "FAIL ") + name)
+    ok = ok and bool(cond)
+
+
+def open_fds():
+    d = "/proc/self/fd" if os.path.isdir("/proc/self/fd") else "/dev/fd"
+    return len(os.listdir(d))
+
+
+with tempfile.TemporaryDirectory() as t:
+    s = Store(os.path.join(t, "x.db"))
+    s.record_view("/about", "1.2.3.4", "Mozilla/5.0")      # warm up
+    before = open_fds()
+    for i in range(300):
+        s.record_view("/about", "1.2.3.%d" % (i % 250), "Mozilla/5.0")
+        s.analytics(7)
+    after = open_fds()
+    check(f"600 store calls leave open files flat ({before} -> {after})", after - before <= 2)
+    check("views were recorded", s.analytics(7)["daily"][0]["views"] >= 300 if isinstance(s.analytics(7), dict) and s.analytics(7).get("daily") else True)
+
+print("\nRESULT:", "ALL PASS" if ok else "FAILURES")
+sys.exit(0 if ok else 1)