51 lines
1.7 KiB
Python
51 lines
1.7 KiB
Python
"""Rule 4: no seed or private key in the package, in logs, or in reprs."""
|
|
from __future__ import annotations
|
|
|
|
import pathlib
|
|
import re
|
|
|
|
import pytest
|
|
|
|
from hermes_nano_x402.signer import EnvSigner, SignerUnavailable
|
|
|
|
PKG = pathlib.Path(__file__).resolve().parents[1] / "hermes_nano_x402"
|
|
SEED = "0" * 64
|
|
|
|
|
|
def test_signer_without_seed_refuses_clearly(monkeypatch):
|
|
monkeypatch.delenv("NANO_SEED", raising=False)
|
|
with pytest.raises(SignerUnavailable):
|
|
EnvSigner()
|
|
|
|
|
|
def test_signer_repr_never_contains_the_seed(monkeypatch):
|
|
monkeypatch.delenv("NANO_SEED", raising=False)
|
|
signer = EnvSigner(SEED)
|
|
assert SEED not in repr(signer)
|
|
assert "address=" in repr(signer)
|
|
|
|
|
|
def test_package_never_prints_or_logs_a_secret():
|
|
offenders = []
|
|
for path in PKG.rglob("*.py"):
|
|
text = path.read_text(encoding="utf-8")
|
|
if re.search(r"print\([^)]*(seed|private_key)", text, re.I):
|
|
offenders.append(f"{path}: print of a secret")
|
|
if re.search(r"log(ger)?\.(info|debug|warning|error)\([^)]*(seed|private_key)", text, re.I):
|
|
offenders.append(f"{path}: log of a secret")
|
|
assert offenders == []
|
|
|
|
|
|
def test_no_hardcoded_seed_material_in_package():
|
|
pattern = re.compile(r"\b[0-9a-fA-F]{64}\b")
|
|
found = []
|
|
for path in PKG.rglob("*.py"):
|
|
for match in pattern.finditer(path.read_text(encoding="utf-8")):
|
|
found.append(f"{path.name}: {match.group(0)[:8]}...")
|
|
assert found == [], f"64-hex literals that look like seeds: {found}"
|
|
|
|
|
|
def test_plugin_package_ships_the_manifest():
|
|
manifest = (PKG / "plugin.yaml").read_text(encoding="utf-8")
|
|
assert "nano_x402_fetch" in manifest
|
|
assert "provides_tools" in manifest
|