| 1 | """Security-copy contract tests for local reads and credential destinations.""" |
| 2 | |
| 3 | from __future__ import annotations |
| 4 | |
| 5 | from pathlib import Path |
| 6 | |
| 7 | ROOT = Path(__file__).resolve().parents[1] |
| 8 | CONFIGURATION = ROOT / "CONFIGURATION.md" |
| 9 | README = ROOT / "README.md" |
| 10 | SKILL_MD = ROOT / "skills" / "last30days" / "SKILL.md" |
| 11 | UI_PY = ROOT / "skills" / "last30days" / "scripts" / "lib" / "ui.py" |
| 12 | |
| 13 | |
| 14 | def test_cookie_setup_requires_explicit_allow_flag_in_docs(): |
| 15 | config = CONFIGURATION.read_text(encoding="utf-8") |
| 16 | skill = SKILL_MD.read_text(encoding="utf-8") |
| 17 | assert "setup --allow-browser-cookies" in config |
| 18 | assert "setup --allow-browser-cookies" in skill |
| 19 | assert "Unset = no browser-cookie reads" in config |
| 20 | |
| 21 | |
| 22 | def test_project_config_trust_is_documented(): |
| 23 | config = CONFIGURATION.read_text(encoding="utf-8") |
| 24 | skill = SKILL_MD.read_text(encoding="utf-8") |
| 25 | assert "LAST30DAYS_TRUST_PROJECT_CONFIG=1" in config |
| 26 | assert "LAST30DAYS_TRUST_PROJECT_CONFIG=1" in skill |
| 27 | assert "Folder-mode hosts such as Codex desktop do not trust hidden project config by default" in config |
| 28 | |
| 29 | |
| 30 | def test_codex_auth_not_advertised_as_openai_fallback(): |
| 31 | config = CONFIGURATION.read_text(encoding="utf-8") |
| 32 | assert "Codex ChatGPT auth" in config |
| 33 | assert "intentionally not used" in config |
| 34 | assert "or Codex auth" not in config |
| 35 | |
| 36 | |
| 37 | def test_preflight_permission_contract_is_documented(): |
| 38 | config = CONFIGURATION.read_text(encoding="utf-8") |
| 39 | skill = SKILL_MD.read_text(encoding="utf-8") |
| 40 | readme = README.read_text(encoding="utf-8") |
| 41 | |
| 42 | for text in (config, skill, readme): |
| 43 | assert "--preflight" in text |
| 44 | assert "without reading browser cookies, writing setup/config/report files, or running research" in config |
| 45 | assert "does not read browser-cookie values" in skill |
| 46 | assert "without reading cookies, writing files, or running research" in readme |
| 47 | |
| 48 | |
| 49 | def test_security_copy_avoids_stale_cookie_and_endpoint_claims(): |
| 50 | skill = SKILL_MD.read_text(encoding="utf-8") |
| 51 | assert "no browser session access" not in skill |
| 52 | assert "OpenAI key only goes to api.openai.com" not in skill |
| 53 | assert "pass `--agent` for non-interactive report output" not in skill |
| 54 | assert "Codex ChatGPT auth" in skill |
| 55 | assert "Endpoint destinations follow configured provider base URLs" in skill |
| 56 | assert "do not read browser-cookie values" in skill |
| 57 | |
| 58 | |
| 59 | def test_scrapecreators_copy_uses_canonical_free_call_count(): |
| 60 | text = "\n".join( |
| 61 | [ |
| 62 | CONFIGURATION.read_text(encoding="utf-8"), |
| 63 | README.read_text(encoding="utf-8"), |
| 64 | SKILL_MD.read_text(encoding="utf-8"), |
| 65 | UI_PY.read_text(encoding="utf-8"), |
| 66 | ] |
| 67 | ) |
| 68 | assert "10,000 free calls" in text |
| 69 | assert "100 free credits" not in text |
| 70 | assert "1,000 free" not in text |
| 71 |