docs(P11): complete schema-input-validation-hardening phase (v1.13.14)

---ci--- project: acdl phase: 11 milestone: v1.14 status: complete requirements: covered: [REQ-145] partial: [] ---/ci---
2026-07-29 20:57:56 +00:00
parent 099ed015ac
commit 986171a165
2 changed files with 71 additions and 7 deletions
@@ -96,4 +96,64 @@ def test_account_id_is_12_digits():
    for env_file in ENV_FILES:
        env = json.loads((ENV_DIR / env_file).read_text())
        assert len(env["account_id"]) == 12
-        assert env["account_id"].isdigit()
+        assert env["account_id"].isdigit()
+
+
+def test_v14_schema_rejects_undocumented_fields():
+    """v1.14 (REQ-145): additionalProperties: false rejects unknown fields."""
+    schema = json.loads(SCHEMA.read_text())
+    bad_env = {
+        "name": "dev",
+        "account_id": "123456789012",
+        "region": "us-east-1",
+        "state_backend": {"bucket": "test", "lock_table": "test"},
+        "network": {"vpc_cidr": "10.0.0.0/16", "azs": ["us-east-1a"]},
+        "runner_role_arn": "arn:aws:iam::123456789012:role/test",
+        "autonomy": "full",
+        "confidence_threshold": 0.5,
+        "rogue_field": "should be rejected"
+    }
+    with pytest.raises(jsonschema.ValidationError, match="Additional properties are not allowed"):
+        jsonschema.validate(bad_env, schema)
+
+
+def test_v14_schema_validates_bucket_name_format():
+    """v1.14 (REQ-145): state_backend.bucket must match S3 naming rules."""
+    schema = json.loads(SCHEMA.read_text())
+    bad_env = {
+        "name": "dev", "account_id": "123456789012", "region": "us-east-1",
+        "state_backend": {"bucket": "Invalid_Bucket!", "lock_table": "test"},
+        "network": {"vpc_cidr": "10.0.0.0/16", "azs": ["us-east-1a"]},
+        "runner_role_arn": "arn:aws:iam::123456789012:role/test",
+        "autonomy": "full", "confidence_threshold": 0.5
+    }
+    with pytest.raises(jsonschema.ValidationError, match="does not match"):
+        jsonschema.validate(bad_env, schema)
+
+
+def test_v14_schema_validates_arn_format():
+    """v1.14 (REQ-145): runner_role_arn must match ARN format."""
+    schema = json.loads(SCHEMA.read_text())
+    bad_env = {
+        "name": "dev", "account_id": "123456789012", "region": "us-east-1",
+        "state_backend": {"bucket": "test", "lock_table": "test"},
+        "network": {"vpc_cidr": "10.0.0.0/16", "azs": ["us-east-1a"]},
+        "runner_role_arn": "not-an-arn",
+        "autonomy": "full", "confidence_threshold": 0.5
+    }
+    with pytest.raises(jsonschema.ValidationError, match="does not match"):
+        jsonschema.validate(bad_env, schema)
+
+
+def test_v14_schema_validates_cidr_format():
+    """v1.14 (REQ-145): vpc_cidr must match CIDR format."""
+    schema = json.loads(SCHEMA.read_text())
+    bad_env = {
+        "name": "dev", "account_id": "123456789012", "region": "us-east-1",
+        "state_backend": {"bucket": "test", "lock_table": "test"},
+        "network": {"vpc_cidr": "not-a-cidr", "azs": ["us-east-1a"]},
+        "runner_role_arn": "arn:aws:iam::123456789012:role/test",
+        "autonomy": "full", "confidence_threshold": 0.5
+    }
+    with pytest.raises(jsonschema.ValidationError, match="does not match"):
+        jsonschema.validate(bad_env, schema)