Adolfo Reyna
9fd04b0ce4
Add the owner-only AF_UNIX Reyna CLI privacy host, strict signed-app installation, and typed native routing for Calendar, Contacts, and Reminders.\n\nAdd bounded system-status paths and config-only direct local-service wrappers. Preserve MacMiniMCP pending explicit cutover approval.\n\nApple Notes is intentionally deferred: no native Notes operations, Apple Events declaration, or Automation helper are included; legacy Notes handling remains untouched.
73 lines
2.6 KiB
Python
73 lines
2.6 KiB
Python
"""Foundation slice: privacy contract — RED phase (should fail until module exists)."""
|
|
|
|
def test_allowlist_registry_includes_required_operations():
|
|
from reyna_cli.privacy_contract import ALLOWED_OPERATIONS
|
|
|
|
assert "service.health" in ALLOWED_OPERATIONS
|
|
assert "calendar.list" in ALLOWED_OPERATIONS
|
|
|
|
|
|
def test_command_to_operation_mapping():
|
|
from reyna_cli.privacy_contract import command_to_operation
|
|
|
|
assert command_to_operation("calendar_list_calendars") == "calendar.list"
|
|
|
|
|
|
def test_scrub_privacy_result_redacts_sensitive_keys_case_insensitive_recursive():
|
|
from reyna_cli.privacy_contract import scrub_privacy_result
|
|
|
|
payload = {
|
|
"ok": True,
|
|
"token": "should-redact",
|
|
"nested": {
|
|
"Password": "secret123",
|
|
"safe": "keep-me",
|
|
"deep": [{"SECRET": "hide", "value": 1}, {"Api_Key": "abc", "x": "y"}],
|
|
},
|
|
"Authorization": "Bearer xyz",
|
|
"api_key": "key123",
|
|
"normal": "visible",
|
|
}
|
|
scrubbed = scrub_privacy_result(payload)
|
|
|
|
assert scrubbed["token"] == "[REDACTED]"
|
|
assert scrubbed["nested"]["Password"] == "[REDACTED]"
|
|
assert scrubbed["nested"]["safe"] == "keep-me"
|
|
assert scrubbed["nested"]["deep"][0]["SECRET"] == "[REDACTED]"
|
|
assert scrubbed["nested"]["deep"][0]["value"] == 1
|
|
assert scrubbed["nested"]["deep"][1]["Api_Key"] == "[REDACTED]"
|
|
assert scrubbed["Authorization"] == "[REDACTED]"
|
|
assert scrubbed["api_key"] == "[REDACTED]"
|
|
assert scrubbed["normal"] == "visible"
|
|
# original unchanged (no mutation)
|
|
assert payload["token"] == "should-redact"
|
|
|
|
|
|
def test_scrub_privacy_result_preserves_non_sensitive_and_handles_lists():
|
|
from reyna_cli.privacy_contract import scrub_privacy_result
|
|
|
|
data = {"ok": True, "value": {"calendar": "Home"}}
|
|
assert scrub_privacy_result(data) == {"ok": True, "value": {"calendar": "Home"}}
|
|
|
|
data2 = [{"token": "a"}, {"safe": "b"}]
|
|
assert scrub_privacy_result(data2) == [{"token": "[REDACTED]"}, {"safe": "b"}]
|
|
|
|
|
|
def test_scrub_exact_key_match_only():
|
|
"""Only exactly token/password/secret/api_key/authorization should be redacted."""
|
|
from reyna_cli.privacy_contract import scrub_privacy_result
|
|
|
|
payload = {
|
|
"my_token": "should-not-redact",
|
|
"tokenizer": "keep",
|
|
"passwords": "keep",
|
|
"api_key_id": "keep",
|
|
"secret": "redact",
|
|
}
|
|
scrubbed = scrub_privacy_result(payload)
|
|
assert scrubbed["my_token"] == "should-not-redact"
|
|
assert scrubbed["tokenizer"] == "keep"
|
|
assert scrubbed["passwords"] == "keep"
|
|
assert scrubbed["api_key_id"] == "keep"
|
|
assert scrubbed["secret"] == "[REDACTED]"
|