acdl/tests/test_attestation_matrix.py

"""REQ-109: 8-concern attestation matrix."""
import datetime
import sys
from pathlib import Path

import pytest

ROOT = Path(__file__).resolve().parent.parent
sys.path.insert(0, str(ROOT))

from core.attestation_matrix import check, _is_fresh, _verify_signature, FRESHNESS_DAYS


def _fresh_artifact(concern, days_ago=0):
    ts = datetime.datetime.now(datetime.timezone.utc) - datetime.timedelta(days=days_ago)
    return {"timestamp": ts.isoformat(), "type": concern, "payload": {}, "signature": "sig"}


def test_dev_passes_autonomous():
    ok, reason = check("dev", {})
    assert ok is True
    assert "autonomous" in reason


def test_qa_offline_concerns_pass_with_valid_evidence():
    """qa concerns: functional_correctness, performance_baseline, security_posture, contract_nfrs.
    The offline-testable contract_nfrs passes by default; the operator-supplied
    ones require artifacts."""
    evidence = {
        "functional_correctness": _fresh_artifact("functional_correctness"),
        "performance_baseline": _fresh_artifact("performance_baseline"),
        "security_posture": _fresh_artifact("security_posture"),
        "contract_nfrs": {"valid": True},
    }
    ok, reason = check("qa", evidence)
    assert ok is True


def test_qa_blocks_on_missing_operator_concern():
    """A missing operator-supplied concern blocks qa."""
    evidence = {
        "performance_baseline": _fresh_artifact("performance_baseline"),
        "security_posture": _fresh_artifact("security_posture"),
        "contract_nfrs": {"valid": True},
        # functional_correctness missing
    }
    ok, reason = check("qa", evidence)
    assert ok is False
    assert "functional_correctness" in reason


def test_prod_blocks_on_missing_evidence():
    ok, reason = check("prod", {})
    assert ok is False
    assert "missing" in reason or "expired" in reason


def test_prod_passes_with_all_evidence():
    evidence = {
        "operational_readiness": _fresh_artifact("operational_readiness"),
        "incident_response": _fresh_artifact("incident_response"),
        "capacity_cost": _fresh_artifact("capacity_cost"),
        "resilience_dr_drill": _fresh_artifact("resilience_dr_drill"),
        "resilience_chaos": _fresh_artifact("resilience_chaos"),
        "resilience_backup": _fresh_artifact("resilience_backup"),
        "contract_nfrs": {"valid": True},
    }
    ok, reason = check("prod", evidence)
    assert ok is True


def test_expired_artifact_blocks():
    """An artifact older than its freshness window blocks."""
    evidence = {
        "operational_readiness": _fresh_artifact("operational_readiness", days_ago=31),
        "incident_response": _fresh_artifact("incident_response"),
        "capacity_cost": _fresh_artifact("capacity_cost"),
        "resilience_dr_drill": _fresh_artifact("resilience_dr_drill"),
        "resilience_chaos": _fresh_artifact("resilience_chaos"),
        "resilience_backup": _fresh_artifact("resilience_backup"),
        "contract_nfrs": {"valid": True},
    }
    ok, reason = check("prod", evidence)
    assert ok is False
    assert "operational_readiness" in reason


def test_dr_passes_with_evidence():
    evidence = {
        "dr_region_deploy": _fresh_artifact("dr_region_deploy"),
        "contract_nfrs": {"valid": True},
    }
    ok, reason = check("dr", evidence)
    assert ok is True


def test_dr_blocks_on_missing_dr_drill():
    ok, reason = check("dr", {"contract_nfrs": {"valid": True}})
    assert ok is False
    assert "dr_region_deploy" in reason


def test_signature_skip_when_key_unset(monkeypatch, capsys):
    """D-089: signature verification is skipped when the signing key is unset."""
    # P5 (REQ-164): dual-read fallback removed — NOVA_* only. Deleting
    # NOVA_ATTESTATION_SIGNING_KEY_ID is sufficient for the skip (the
    # ACDL_* fallback no longer exists in core/env.py).
    monkeypatch.delenv("NOVA_ATTESTATION_SIGNING_KEY_ID", raising=False)
    artifact = {"timestamp": datetime.datetime.now(datetime.timezone.utc).isoformat(),
                "type": "x", "payload": {}, "signature": "sig"}
    assert _verify_signature(artifact) is True
    captured = capsys.readouterr()
    assert "skipped" in captured.err


def test_signature_required_when_key_set(monkeypatch):
    """When the signing key is set, a missing signature fails."""
    monkeypatch.setenv("NOVA_ATTESTATION_SIGNING_KEY_ID", "kms-key-id")
    artifact = {"timestamp": datetime.datetime.now(datetime.timezone.utc).isoformat(),
                "type": "x", "payload": {}}  # no signature
    assert _verify_signature(artifact) is False


def test_freshness_within_window():
    artifact = _fresh_artifact("functional_correctness", days_ago=0)
    assert _is_fresh(artifact, "functional_correctness") is True


def test_freshness_outside_window():
    artifact = _fresh_artifact("functional_correctness", days_ago=2)
    assert _is_fresh(artifact, "functional_correctness") is False


def test_freshness_rejects_future_dated_artifact():
    """A future-dated artifact (negative age) must not bypass freshness (review fix)."""
    future = datetime.datetime.now(datetime.timezone.utc) + datetime.timedelta(days=100)
    artifact = {"timestamp": future.isoformat(), "type": "x", "payload": {}}
    assert _is_fresh(artifact, "operational_readiness") is False


def test_freshness_days_table_has_all_concerns():
    """The freshness table covers all operator-supplied concerns."""
    for concern in ["functional_correctness", "performance_baseline", "security_posture",
                    "operational_readiness", "incident_response", "capacity_cost",
                    "resilience_dr_drill", "dr_region_deploy"]:
        assert concern in FRESHNESS_DAYS