forked from cleveragents/cleveragents-core
48 lines
2.4 KiB
Plaintext
48 lines
2.4 KiB
Plaintext
*** Settings ***
|
|
Documentation Smoke tests for read-only action enforcement across all layers
|
|
Resource ${CURDIR}/common.resource
|
|
Suite Setup Setup Test Environment
|
|
Suite Teardown Cleanup Test Environment
|
|
|
|
*** Variables ***
|
|
${HELPER} ${CURDIR}/helper_security_readonly.py
|
|
|
|
*** Test Cases ***
|
|
ToolRuntime Blocks Write Tool On ReadOnly Plan
|
|
[Documentation] Verify ToolRuntime._enforce_capabilities raises ToolAccessDeniedError
|
|
${result}= Run Process ${PYTHON} ${HELPER} runtime-blocks-write cwd=${WORKSPACE}
|
|
Log ${result.stdout}
|
|
Log ${result.stderr}
|
|
Should Be Equal As Integers ${result.rc} 0
|
|
Should Contain ${result.stdout} runtime-blocks-write-ok
|
|
|
|
ToolRuntime Allows ReadOnly Tool On ReadOnly Plan
|
|
[Documentation] Verify ToolRuntime allows read-only tools under a read-only plan
|
|
${result}= Run Process ${PYTHON} ${HELPER} runtime-allows-readonly cwd=${WORKSPACE}
|
|
Should Be Equal As Integers ${result.rc} 0
|
|
Should Contain ${result.stdout} runtime-allows-readonly-ok
|
|
|
|
SkillContext WriteGuard Blocks Write
|
|
[Documentation] Verify SkillContext.enforce_write_guard raises on read-only
|
|
${result}= Run Process ${PYTHON} ${HELPER} skillctx-blocks-write cwd=${WORKSPACE}
|
|
Should Be Equal As Integers ${result.rc} 0
|
|
Should Contain ${result.stdout} skillctx-blocks-write-ok
|
|
|
|
ChangeSet ReadOnly Rejects Write Tool
|
|
[Documentation] Verify ChangeSetCapture raises ReadOnlyViolationError for write tools
|
|
${result}= Run Process ${PYTHON} ${HELPER} changeset-rejects-write cwd=${WORKSPACE}
|
|
Should Be Equal As Integers ${result.rc} 0
|
|
Should Contain ${result.stdout} changeset-rejects-write-ok
|
|
|
|
ChangeSet ReadOnly Passes ReadOnly Tool
|
|
[Documentation] Verify ChangeSetCapture passes read-only tools through unchanged
|
|
${result}= Run Process ${PYTHON} ${HELPER} changeset-passes-readonly cwd=${WORKSPACE}
|
|
Should Be Equal As Integers ${result.rc} 0
|
|
Should Contain ${result.stdout} changeset-passes-readonly-ok
|
|
|
|
Error Message Contains Tool Name
|
|
[Documentation] Verify that access-denied errors include the tool name
|
|
${result}= Run Process ${PYTHON} ${HELPER} error-contains-toolname cwd=${WORKSPACE}
|
|
Should Be Equal As Integers ${result.rc} 0
|
|
Should Contain ${result.stdout} error-contains-toolname-ok
|