440 lines
15 KiB
Python
440 lines
15 KiB
Python
"""Focused RBAC, IDOR, and session-read audit regression tests."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import unittest
|
|
from typing import Any
|
|
from unittest.mock import AsyncMock, patch
|
|
|
|
from fastapi import HTTPException
|
|
|
|
from . import session_persistence
|
|
from .deps import Principal, Role
|
|
from .routes import sessions
|
|
from .services import persona as persona_service, state_machine
|
|
from .store import InProcSession, TurnRecord, store
|
|
|
|
|
|
def _principal(
|
|
*,
|
|
user_id: str,
|
|
role: Role = Role.LEARNER,
|
|
) -> Principal:
|
|
return Principal(
|
|
user_id=user_id,
|
|
role=role,
|
|
cohort_ids=["cohort-a"] if role == Role.TEACHER else [],
|
|
email=f"{role.value}-{user_id[-4:]}@example.test",
|
|
display_name=f"{role.value.title()} {user_id[-4:]}",
|
|
)
|
|
|
|
|
|
def _session(
|
|
*,
|
|
session_id: str,
|
|
learner_id: str,
|
|
) -> InProcSession:
|
|
card = persona_service.P1
|
|
return InProcSession(
|
|
session_id=session_id,
|
|
case_id=f"case-{session_id[-12:]}",
|
|
learner_id=learner_id,
|
|
persona_code=card.code,
|
|
theory_mode="humanistic",
|
|
persona=card,
|
|
state=state_machine.SessionState(
|
|
resistance=card.base_resistance(),
|
|
ideation_stage=card.ideation_baseline(),
|
|
),
|
|
)
|
|
|
|
|
|
def _turn(
|
|
*,
|
|
seq: int,
|
|
speaker: str,
|
|
text: str,
|
|
visible_to: tuple[str, ...] = ("client", "counselor", "evaluator"),
|
|
) -> TurnRecord:
|
|
return TurnRecord(
|
|
turn_seq=seq,
|
|
speaker=speaker,
|
|
stage="rapport",
|
|
text=text,
|
|
text_masked=text,
|
|
created_at=1_800_000_000.0 + seq,
|
|
visible_to=visible_to,
|
|
)
|
|
|
|
|
|
class _Acquire:
|
|
def __init__(self, conn: "_FakeConn") -> None:
|
|
self.conn = conn
|
|
|
|
async def __aenter__(self) -> "_FakeConn":
|
|
return self.conn
|
|
|
|
async def __aexit__(self, exc_type: object, exc: object, tb: object) -> None:
|
|
return None
|
|
|
|
|
|
class _FakeConn:
|
|
def __init__(
|
|
self,
|
|
*,
|
|
fetchrow_results: list[Any] | None = None,
|
|
fetch_results: list[list[Any]] | None = None,
|
|
) -> None:
|
|
self.fetchrow_results = list(fetchrow_results or [])
|
|
self.fetch_results = list(fetch_results or [])
|
|
self.executed: list[tuple[str, tuple[Any, ...]]] = []
|
|
|
|
async def fetchrow(self, *args: Any, **kwargs: Any) -> Any:
|
|
if not self.fetchrow_results:
|
|
raise AssertionError("unexpected fetchrow")
|
|
return self.fetchrow_results.pop(0)
|
|
|
|
async def fetch(self, *args: Any, **kwargs: Any) -> list[Any]:
|
|
if not self.fetch_results:
|
|
raise AssertionError("unexpected fetch")
|
|
return self.fetch_results.pop(0)
|
|
|
|
async def execute(self, query: str, *args: Any) -> str:
|
|
self.executed.append((query, args))
|
|
return "INSERT 0 1"
|
|
|
|
|
|
def _audit_calls(conn: _FakeConn) -> list[tuple[str, tuple[Any, ...]]]:
|
|
return [
|
|
call
|
|
for call in conn.executed
|
|
if "INSERT INTO audit.audit_log" in call[0]
|
|
]
|
|
|
|
|
|
class LearnerSessionIdorTest(unittest.IsolatedAsyncioTestCase):
|
|
async def asyncSetUp(self) -> None:
|
|
store._sessions.clear()
|
|
|
|
async def asyncTearDown(self) -> None:
|
|
store._sessions.clear()
|
|
|
|
async def test_get_session_detail_rejects_other_learner_session_id(self) -> None:
|
|
owner = _principal(
|
|
user_id="00000000-0000-0000-0000-000000000101",
|
|
)
|
|
intruder = _principal(
|
|
user_id="00000000-0000-0000-0000-000000000202",
|
|
)
|
|
sess = _session(
|
|
session_id="00000000-0000-0000-0000-00000000a101",
|
|
learner_id=owner.user_id,
|
|
)
|
|
sess.turns.append(
|
|
_turn(
|
|
seq=1,
|
|
speaker="counselor",
|
|
text="owner-visible turn must not grant access",
|
|
visible_to=("counselor", "evaluator"),
|
|
)
|
|
)
|
|
store.put(sess)
|
|
|
|
with (
|
|
patch.object(
|
|
sessions.session_persistence,
|
|
"load_session",
|
|
AsyncMock(return_value=None),
|
|
),
|
|
patch.object(sessions.turn_runtime, "runtime_fallback_allowed", return_value=True),
|
|
patch.object(
|
|
sessions,
|
|
"_review_ready",
|
|
AsyncMock(side_effect=AssertionError("review lookup should not run")),
|
|
) as review_ready,
|
|
):
|
|
with self.assertRaises(HTTPException) as caught:
|
|
await sessions.get_session_detail(sess.session_id, intruder)
|
|
|
|
self.assertEqual(caught.exception.status_code, 403)
|
|
self.assertIn("does not belong", caught.exception.detail)
|
|
review_ready.assert_not_awaited()
|
|
|
|
async def test_session_detail_filters_evaluator_only_turns(self) -> None:
|
|
owner = _principal(
|
|
user_id="00000000-0000-0000-0000-000000000111",
|
|
)
|
|
sess = _session(
|
|
session_id="00000000-0000-0000-0000-00000000e111",
|
|
learner_id=owner.user_id,
|
|
)
|
|
sess.turns.extend(
|
|
[
|
|
_turn(seq=1, speaker="counselor", text="learner normal turn"),
|
|
_turn(seq=2, speaker="client", text="client normal turn"),
|
|
_turn(
|
|
seq=3,
|
|
speaker="counselor",
|
|
text="SECRET_EVALUATOR_ONLY_DETAIL",
|
|
visible_to=("evaluator",),
|
|
),
|
|
]
|
|
)
|
|
store.put(sess)
|
|
|
|
with (
|
|
patch.object(
|
|
sessions.session_persistence,
|
|
"load_session",
|
|
AsyncMock(return_value=None),
|
|
),
|
|
patch.object(sessions.turn_runtime, "runtime_fallback_allowed", return_value=True),
|
|
patch.object(sessions, "_review_ready", AsyncMock(return_value=False)),
|
|
):
|
|
response = await sessions.get_session_detail(sess.session_id, owner)
|
|
|
|
self.assertEqual([turn.text for turn in response.turns], ["learner normal turn", "client normal turn"])
|
|
self.assertEqual([turn.speaker for turn in response.turns], ["learner", "client"])
|
|
|
|
async def test_session_review_filters_evaluator_only_turns_and_payload(self) -> None:
|
|
owner = _principal(
|
|
user_id="00000000-0000-0000-0000-000000000112",
|
|
)
|
|
sess = _session(
|
|
session_id="00000000-0000-0000-0000-00000000e112",
|
|
learner_id=owner.user_id,
|
|
)
|
|
sess.ended = True
|
|
sess.ended_at = 1_800_000_120.0
|
|
sess.turns.extend(
|
|
[
|
|
_turn(seq=1, speaker="counselor", text="visible learner review turn"),
|
|
_turn(seq=2, speaker="client", text="visible client review turn"),
|
|
_turn(
|
|
seq=3,
|
|
speaker="client",
|
|
text="SECRET_EVALUATOR_ONLY_REVIEW",
|
|
visible_to=("evaluator",),
|
|
),
|
|
]
|
|
)
|
|
store.put(sess)
|
|
evaluation_record = {
|
|
"status": "ready",
|
|
"payload": {
|
|
"strengths": ["SECRET_EVALUATOR_ONLY_REVIEW"],
|
|
"improvements": ["SECRET_EVALUATOR_ONLY_REVIEW"],
|
|
"supervisor_rationale": "SECRET_EVALUATOR_ONLY_REVIEW",
|
|
"alternative_utterances": ["SECRET_EVALUATOR_ONLY_REVIEW"],
|
|
},
|
|
}
|
|
|
|
with (
|
|
patch.object(
|
|
sessions.session_persistence,
|
|
"load_session",
|
|
AsyncMock(return_value=None),
|
|
),
|
|
patch.object(sessions.turn_runtime, "runtime_fallback_allowed", return_value=True),
|
|
patch.object(
|
|
sessions.session_persistence,
|
|
"load_session_evaluation",
|
|
AsyncMock(return_value=(evaluation_record, True)),
|
|
),
|
|
):
|
|
response = await sessions.get_session_review(sess.session_id, owner)
|
|
|
|
self.assertEqual([turn.text for turn in response.turns], ["visible learner review turn", "visible client review turn"])
|
|
self.assertFalse(response.reviewReady)
|
|
rendered = " ".join(
|
|
[
|
|
response.summary,
|
|
response.clientFeedback or "",
|
|
response.nextLine or "",
|
|
*[turn.text for turn in response.turns],
|
|
*[point.body for point in response.goodMoments],
|
|
*[point.body for point in response.growthPoints],
|
|
]
|
|
)
|
|
self.assertNotIn("SECRET_EVALUATOR_ONLY_REVIEW", rendered)
|
|
|
|
async def test_submit_turn_sends_only_client_visible_history_to_engine(self) -> None:
|
|
owner = _principal(
|
|
user_id="00000000-0000-0000-0000-000000000113",
|
|
)
|
|
sess = _session(
|
|
session_id="00000000-0000-0000-0000-00000000e113",
|
|
learner_id=owner.user_id,
|
|
)
|
|
sess.turns.extend(
|
|
[
|
|
_turn(seq=1, speaker="counselor", text="client-visible history"),
|
|
_turn(
|
|
seq=2,
|
|
speaker="client",
|
|
text="SECRET_EVALUATOR_ONLY_ENGINE_CONTEXT",
|
|
visible_to=("evaluator",),
|
|
),
|
|
]
|
|
)
|
|
store.put(sess)
|
|
captured_recent_turns: list[dict[str, str]] | None = None
|
|
|
|
async def successful_turn(ctx, engine, **kwargs):
|
|
nonlocal captured_recent_turns
|
|
captured_recent_turns = list(ctx.recent_turns)
|
|
assert ctx.state_after is not None
|
|
return sessions.orchestrator.TurnResult(
|
|
turn_seq=ctx.state_after.turn_seq,
|
|
stage=ctx.state_after.stage.value,
|
|
effective_openness=ctx.state_after.effective_openness,
|
|
client_reply="client reply",
|
|
safety_flagged=False,
|
|
state_after=ctx.state_after,
|
|
)
|
|
|
|
with (
|
|
patch.object(
|
|
sessions.session_persistence,
|
|
"load_session",
|
|
AsyncMock(return_value=None),
|
|
),
|
|
patch.object(sessions.turn_runtime, "runtime_fallback_allowed", return_value=True),
|
|
patch.object(sessions.orchestrator, "run_turn_generate", successful_turn),
|
|
):
|
|
await sessions.submit_turn(
|
|
sess.session_id,
|
|
sessions.TurnRequest(text="new learner turn"),
|
|
owner,
|
|
)
|
|
|
|
self.assertEqual(captured_recent_turns, [{"speaker": "counselor", "text": "client-visible history"}])
|
|
self.assertNotIn(
|
|
"SECRET_EVALUATOR_ONLY_ENGINE_CONTEXT",
|
|
" ".join(turn["text"] for turn in captured_recent_turns or []),
|
|
)
|
|
|
|
async def test_learner_session_list_filters_other_runtime_sessions(self) -> None:
|
|
owner = _principal(
|
|
user_id="00000000-0000-0000-0000-000000000303",
|
|
)
|
|
other = _principal(
|
|
user_id="00000000-0000-0000-0000-000000000404",
|
|
)
|
|
owned_session = _session(
|
|
session_id="00000000-0000-0000-0000-00000000b303",
|
|
learner_id=owner.user_id,
|
|
)
|
|
other_session = _session(
|
|
session_id="00000000-0000-0000-0000-00000000b404",
|
|
learner_id=other.user_id,
|
|
)
|
|
store.put(owned_session)
|
|
store.put(other_session)
|
|
|
|
with (
|
|
patch.object(
|
|
sessions.session_persistence,
|
|
"list_sessions",
|
|
AsyncMock(return_value=([], False)),
|
|
),
|
|
patch.object(sessions, "require_runtime_fallback_allowed", return_value=None),
|
|
patch.object(sessions, "_review_ready", AsyncMock(return_value=False)),
|
|
):
|
|
response = await sessions.list_learner_sessions(owner)
|
|
|
|
self.assertEqual(response.source, "runtime")
|
|
self.assertEqual([item.session_id for item in response.sessions], [owned_session.session_id])
|
|
|
|
|
|
class TeacherAdminAuditTest(unittest.IsolatedAsyncioTestCase):
|
|
async def test_teacher_list_sessions_inserts_read_audit_log(self) -> None:
|
|
teacher = _principal(
|
|
user_id="00000000-0000-0000-0000-000000000505",
|
|
role=Role.TEACHER,
|
|
)
|
|
session_id = "00000000-0000-0000-0000-00000000c505"
|
|
row = {"id": session_id}
|
|
sess = _session(
|
|
session_id=session_id,
|
|
learner_id="00000000-0000-0000-0000-000000000606",
|
|
)
|
|
conn = _FakeConn(
|
|
fetchrow_results=[None],
|
|
fetch_results=[[row], []],
|
|
)
|
|
acquire_calls: list[dict[str, Any]] = []
|
|
|
|
def fake_acquire(**kwargs: Any) -> _Acquire:
|
|
acquire_calls.append(kwargs)
|
|
return _Acquire(conn)
|
|
|
|
with (
|
|
patch.object(session_persistence, "get_pool", return_value=object()),
|
|
patch.object(session_persistence, "acquire", fake_acquire),
|
|
patch.object(session_persistence, "_session_from_rows", return_value=sess),
|
|
):
|
|
found, durable = await session_persistence.list_sessions(teacher)
|
|
|
|
self.assertTrue(durable)
|
|
self.assertEqual(found, [sess])
|
|
self.assertEqual(acquire_calls[0]["role"], "teacher")
|
|
audit = _audit_calls(conn)
|
|
self.assertEqual(len(audit), 1)
|
|
_, args = audit[0]
|
|
self.assertEqual(args[0], teacher.user_id)
|
|
self.assertEqual(args[1], "read_session")
|
|
self.assertEqual(args[2], "session_list")
|
|
self.assertEqual(args[3], "sessions")
|
|
self.assertEqual(args[4]["access"], "list_sessions")
|
|
self.assertEqual(args[4]["role"], "teacher")
|
|
self.assertEqual(args[4]["result_count"], 1)
|
|
|
|
async def test_admin_load_session_inserts_read_audit_log(self) -> None:
|
|
admin = _principal(
|
|
user_id="00000000-0000-0000-0000-000000000707",
|
|
role=Role.ADMIN,
|
|
)
|
|
session_id = "00000000-0000-0000-0000-00000000d707"
|
|
learner_id = "00000000-0000-0000-0000-000000000808"
|
|
sess = _session(session_id=session_id, learner_id=learner_id)
|
|
conn = _FakeConn(
|
|
fetchrow_results=[
|
|
{"id": session_id, "ended_at": None},
|
|
None,
|
|
],
|
|
fetch_results=[[]],
|
|
)
|
|
acquire_calls: list[dict[str, Any]] = []
|
|
|
|
def fake_acquire(**kwargs: Any) -> _Acquire:
|
|
acquire_calls.append(kwargs)
|
|
return _Acquire(conn)
|
|
|
|
with (
|
|
patch.object(session_persistence, "get_pool", return_value=object()),
|
|
patch.object(session_persistence, "acquire", fake_acquire),
|
|
patch.object(session_persistence, "_session_from_rows", return_value=sess),
|
|
):
|
|
found = await session_persistence.load_session(
|
|
session_id,
|
|
admin,
|
|
allow_ended=True,
|
|
)
|
|
|
|
self.assertEqual(found, sess)
|
|
self.assertEqual(acquire_calls[0]["role"], "admin")
|
|
audit = _audit_calls(conn)
|
|
self.assertEqual(len(audit), 1)
|
|
_, args = audit[0]
|
|
self.assertEqual(args[0], admin.user_id)
|
|
self.assertEqual(args[1], "read_session")
|
|
self.assertEqual(args[2], "session")
|
|
self.assertEqual(args[3], session_id)
|
|
self.assertEqual(args[4]["access"], "load_session")
|
|
self.assertEqual(args[4]["role"], "admin")
|
|
self.assertEqual(args[4]["learner_id"], learner_id)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|