khyari hamza
2b09568cfa
Tighten ToolRuntime._enforce_capabilities() to block ANY tool with writes=True when plan_read_only is set, removing the not-cap.read_only loophole that allowed certain write tools through. Tool name is now always included in the ToolAccessDeniedError message. Add read_only flag to ChangeSetCapture with ReadOnlyViolationError raised when write-capable tools are wrapped on a read-only plan. Add CLI fail-fast guards on plan execute and plan apply commands that abort before calling the service layer if plan.read_only is True. SkillContext.enforce_write_guard() already included tool name correctly and required no changes. Includes 18 Behave scenarios (90 steps), Robot integration tests, ASV benchmarks, and docs/reference/read_only_actions.md. ISSUES CLOSED: #322
48 lines
2.4 KiB
Plaintext
48 lines
2.4 KiB
Plaintext
*** Settings ***
|
|
Documentation Smoke tests for read-only action enforcement across all layers
|
|
Resource ${CURDIR}/common.resource
|
|
Suite Setup Setup Test Environment
|
|
Suite Teardown Cleanup Test Environment
|
|
|
|
*** Variables ***
|
|
${HELPER} ${CURDIR}/helper_security_readonly.py
|
|
|
|
*** Test Cases ***
|
|
ToolRuntime Blocks Write Tool On ReadOnly Plan
|
|
[Documentation] Verify ToolRuntime._enforce_capabilities raises ToolAccessDeniedError
|
|
${result}= Run Process ${PYTHON} ${HELPER} runtime-blocks-write cwd=${WORKSPACE}
|
|
Log ${result.stdout}
|
|
Log ${result.stderr}
|
|
Should Be Equal As Integers ${result.rc} 0
|
|
Should Contain ${result.stdout} runtime-blocks-write-ok
|
|
|
|
ToolRuntime Allows ReadOnly Tool On ReadOnly Plan
|
|
[Documentation] Verify ToolRuntime allows read-only tools under a read-only plan
|
|
${result}= Run Process ${PYTHON} ${HELPER} runtime-allows-readonly cwd=${WORKSPACE}
|
|
Should Be Equal As Integers ${result.rc} 0
|
|
Should Contain ${result.stdout} runtime-allows-readonly-ok
|
|
|
|
SkillContext WriteGuard Blocks Write
|
|
[Documentation] Verify SkillContext.enforce_write_guard raises on read-only
|
|
${result}= Run Process ${PYTHON} ${HELPER} skillctx-blocks-write cwd=${WORKSPACE}
|
|
Should Be Equal As Integers ${result.rc} 0
|
|
Should Contain ${result.stdout} skillctx-blocks-write-ok
|
|
|
|
ChangeSet ReadOnly Rejects Write Tool
|
|
[Documentation] Verify ChangeSetCapture raises ReadOnlyViolationError for write tools
|
|
${result}= Run Process ${PYTHON} ${HELPER} changeset-rejects-write cwd=${WORKSPACE}
|
|
Should Be Equal As Integers ${result.rc} 0
|
|
Should Contain ${result.stdout} changeset-rejects-write-ok
|
|
|
|
ChangeSet ReadOnly Passes ReadOnly Tool
|
|
[Documentation] Verify ChangeSetCapture passes read-only tools through unchanged
|
|
${result}= Run Process ${PYTHON} ${HELPER} changeset-passes-readonly cwd=${WORKSPACE}
|
|
Should Be Equal As Integers ${result.rc} 0
|
|
Should Contain ${result.stdout} changeset-passes-readonly-ok
|
|
|
|
Error Message Contains Tool Name
|
|
[Documentation] Verify that access-denied errors include the tool name
|
|
${result}= Run Process ${PYTHON} ${HELPER} error-contains-toolname cwd=${WORKSPACE}
|
|
Should Be Equal As Integers ${result.rc} 0
|
|
Should Contain ${result.stdout} error-contains-toolname-ok
|