
    mj                        d dl mZ d dlmZ d dlZd dlmZmZ dd	Zdd
Z	ddZ
ddZddZddZddZddZddZej                            dg d          d d            ZddZddZddZddZddZddZddZdS )!    )annotations)PathN)assert_safe	scan_pathtmp_pathr   returnNonec                    | dz                       d           t          |           }t          d |D                       sJ d S )Nzfinance.sqlite3znot realc              3  (   K   | ]}d |j         v V  dS )forbidden_file_typeNreason.0fs     tests/unit/test_git_safety.py	<genexpr>z9test_git_safety_blocks_sqlite_database.<locals>.<genexpr>   s*      CCQ$0CCCCCC    
write_textr   anyr   findingss     r   &test_git_safety_blocks_sqlite_databaser   
   sR    !!--j999""HCC(CCCCCCCCCCr   c                0   | dz                       d           | dz                       d           t          |           }t          |          dk    sJ t          j        t
                    5  t          |            d d d            d S # 1 swxY w Y   d S )Nz.envz
TOKEN=demozclient_secret.json{}   )r   r   lenpytestraises
ValueErrorr   r   s     r   *test_git_safety_blocks_env_and_credentialsr"      s    ""<000$$00666""Hx==A	z	"	"  H                 s   .BBBc                    | dz  dz  }|                     d           |dz                      d           t          |           g k    sJ d S )Nexamples	syntheticTparentszaccounts.csvplatform_name
Demo
mkdirr   r   )r   r$   s     r   )test_git_safety_allows_synthetic_examplesr+      s^    *${2HNN4N   **+BCCCX"$$$$$$r   c                .   | dz  dz  }|                     d           |dz                      d           |dz                      d           | d	z  }|                                  |d
z                      d           t          |           g k    sJ d S )NtestsfixturesTr&   zsynthetic_accounts.csvr(   zsynthetic_payload.jsonz{"kind":"synthetic"}zconfig.examplezsettings.jsonz{"token":"replace-me"}r)   )r   r.   config_examples      r   Atest_git_safety_allows_tests_fixtures_and_config_example_csv_jsonr0       s    '!J.HNN4N   ((445LMMM((445KLLL 00No%112JKKKX"$$$$$$r   c                J     dz  dz  dz  j                             d                               d            dz  dz  }|                    d           t                     }t	           fd	|D                       rJ t	          d
 |D                       sJ d S )Ndocszfinance-manager-2.0z>FinanceManager_Umsetzungs_und_Zielkonzept_v2.2_2026-08-01.docxTr&   s   canonical concept placeholderz
other.docxs   must stay blockedc              3  x   K   | ]4}|j                                                                       k    V  5d S )N)pathrelative_toas_posix)r   r   	canonicalr   s     r   r   zQtest_git_safety_allows_only_the_canonical_product_concept_docx.<locals>.<genexpr>9   sD      ZZA16Y228<<EEGGGZZZZZZr   c              3  B   K   | ]}|j         d k    o
|j        dk    V  dS )zdocs/other.docxzforbidden_file_type:.docxNr4   r   r   s     r   r   zQtest_git_safety_allows_only_the_canonical_product_concept_docx.<locals>.<genexpr>:   s8      ii[\qv**Vqx;V/Viiiiiir   parentr*   write_bytesr   r   )r   blockedr   r7   s   `  @r   >test_git_safety_allows_only_the_canonical_product_concept_docxr>   +   s    
	
	  K	K  4(((:;;;,.G,---""HZZZZZQYZZZZZZZZii`hiiiiiiiiiir   c                    | dz  dz  dz  }|                     d           |dz                      d           t          |           g k    sJ d S )Nsrcjarvis_financeimportsTr&   znormal_module.pyzxfrom __future__ import annotations

def parse_token_name(token_name: str) -> str:
    return token_name.strip().lower()
r)   )r   r@   s     r   ;test_git_safety_does_not_false_positive_normal_source_filesrC   =   so    
U
-
-	
9CIIdI))	2  
 X"$$$$$$r   c                   | dz                                    | dz  dz                      d           | dz                      d           | dz                                    | dz  dz                      d           t          |           }d	 |D             }t          d
 |D                       sJ t          d |D                       sJ t          d |D                       sJ d S )Ndataportfolio.csvzreal-ishzGithub_token_secret.txtplaceholderruntimez
cache.jsonr   c                    g | ]	}|j         
S  r   r   s     r   
<listcomp>zOtest_git_safety_blocks_runtime_dirs_db_json_and_token_names.<locals>.<listcomp>O   s    ***Aqx***r   c              3     K   | ]}d |v V  	dS )&runtime_or_real_data_directory_blockedNrJ   r   rs     r   r   zNtest_git_safety_blocks_runtime_dirs_db_json_and_token_names.<locals>.<genexpr>P   s(      NN71<NNNNNNr   c              3     K   | ]}d |v V  	dS )forbidden_secret_like_filenameNrJ   rN   s     r   r   zNtest_git_safety_blocks_runtime_dirs_db_json_and_token_names.<locals>.<genexpr>Q   s(      FF/14FFFFFFr   c              3     K   | ]}d |v V  	dS )csv_json_only_allowedNrJ   rN   s     r   r   zNtest_git_safety_blocks_runtime_dirs_db_json_and_token_names.<locals>.<genexpr>R   s(      ==&!+======r   )r*   r   r   r   )r   r   reasonss      r   ;test_git_safety_blocks_runtime_dirs_db_json_and_token_namesrU   H   s   (44Z@@@))55mDDD	  """	L(44T:::""H*****GNNgNNNNNNNNFFgFFFFFFFF==W==========r   c                    | dz                       d           t          |           }t          d |D                       sJ d S )N	notes.txtz1token=github_pat_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAc              3  ,   K   | ]}|j         d k    V  dS )zsecret_pattern:github_patNr   r   s     r   r   z=test_git_safety_blocks_github_pat_patterns.<locals>.<genexpr>X   *      II1qx66IIIIIIr   r   r   s     r   *test_git_safety_blocks_github_pat_patternsrZ   U   sR    ''(FGGG""HIIIIIIIIIIIIr   c                    | dz                       d           t          |           }t          d |D                       sJ d S )NrW   z.token=ghp_BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBc              3  ,   K   | ]}|j         d k    V  dS )zsecret_pattern:github_ghpNr   r   s     r   r   z=test_git_safety_blocks_github_ghp_patterns.<locals>.<genexpr>^   rY   r   r   r   s     r   *test_git_safety_blocks_github_ghp_patternsr]   [   sR    ''(?@@@""HIIIIIIIIIIIIr   )labelcontent))bearer_tokenz6Authorization: Bearer AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA)
openai_keyz2OPENAI_API_KEY=sk-BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB)slack_tokenz1SLACK_TOKEN=xoxb-CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCr^   strr_   c                    | dz                       |           t          |           }t          fd|D                       sJ d S )NrW   c              3  4   K   | ]}|j         d  k    V  dS )zsecret_pattern:Nr   )r   r   r^   s     r   r   zNtest_git_safety_blocks_additional_cleartext_secret_patterns.<locals>.<genexpr>n   s3      GGqx4U444GGGGGGr   r   )r   r^   r_   r   s    `  r   ;test_git_safety_blocks_additional_cleartext_secret_patternsrf   a   sZ     ''000""HGGGGhGGGGGGGGGGr   c                    | dz                       d           t          |           }t          d |D                       sJ d S )Nz
id_rsa.txtz_-----BEGIN OPENSSH PRIVATE KEY-----
synthetic-not-a-real-key
-----END OPENSSH PRIVATE KEY-----
c              3  ,   K   | ]}|j         d k    V  dS )zsecret_pattern:private_keyNr   r   s     r   r   z6test_git_safety_blocks_private_keys.<locals>.<genexpr>x   s*      JJAqx77JJJJJJr   r   r   s     r   #test_git_safety_blocks_private_keysri   q   s\    ((	.  
 ""HJJJJJJJJJJJJr   c                    | dz                       d           | dz                       d           d t          |           D             }|                    d          dk    sJ d S )NrF   zaccount,balance
Demo,1
zexport.jsonz{"realistic":"blocked"}c                    g | ]	}|j         
S rJ   r   r   s     r   rK   zItest_git_safety_blocks_csv_json_outside_allowed_paths.<locals>.<listcomp>~   s    555Aqx555r   =csv_json_only_allowed_in_examples_synthetic_or_tests_fixturesr   )r   r   count)r   rT   s     r   5test_git_safety_blocks_csv_json_outside_allowed_pathsrn   {   sv    ++,GHHH))*CDDD558!4!4555G==XYY]^^^^^^^r   c                    dD ]3}| |z  }|                                  |dz                      d           4t          |           }d |D             }h d|k    sJ d S )N)rE   rH   exportsreportszpayload.txtznot allowed herec                2    h | ]}|j         d k    |j        S rM   r   r4   r   s     r   	<setcomp>zItest_git_safety_blocks_top_level_runtime_and_data_dirs.<locals>.<setcomp>   '    fff=e1e1eQV1e1e1er   >   data/payload.txtexports/payload.txtreports/payload.txtruntime/payload.txtr)   )r   dirnamefolderr   blocked_pathss        r   6test_git_safety_blocks_top_level_runtime_and_data_dirsr~      s    < @ @G#	-	++,>????""HffXfffMdddhuuuuuuur   c                    | j         dz  }|                    d           | dz                      |           t          |           }t	          d |D                       sJ d S )Nzoutside-sensitive.txtznot inspected
linked.txtc              3  B   K   | ]}|j         d k    o
|j        dk    V  dS )r   symlink_blockedNr9   r   s     r   r   zMtest_git_safety_blocks_symlinks_without_reading_the_target.<locals>.<genexpr>   s6      ZZAqv%G!(6G*GZZZZZZr   )r;   r   
symlink_tor   r   )r   outsider   s      r   :test_git_safety_blocks_symlinks_without_reading_the_targetr      ss    o 77G'''((111""HZZQYZZZZZZZZZZr   c                    | dz  dz  }|j                                          |                    d           t          |           }t	          d |D                       sJ t	          d |D                       sJ d S )Nrq   zcrypto_inventory.pdfs   %PDF-1.4 syntheticc              3  \   K   | ]'}t          |j                  d k    o
|j        dk    V  (dS )reports/crypto_inventory.pdfrM   Nrc   r4   r   r   s     r   r   zBtest_git_safety_blocks_reports_and_pdfs_in_repo.<locals>.<genexpr>   sW          	AF55 	AH@@     r   c              3  \   K   | ]'}t          |j                  d k    o
|j        dk    V  (dS )r   zforbidden_file_type:.pdfNr   r   s     r   r   zBtest_git_safety_blocks_reports_and_pdfs_in_repo.<locals>.<genexpr>   sQ         	AF55`!(F`:`     r   r:   )r   reportr   s      r   /test_git_safety_blocks_reports_and_pdfs_in_repor      s    	!$::F
M
,---""H          
            r   c                $   | dz  dz  }|j                                          |                    d           |j         dz                      d           t	          |           }d |D             }d|v sJ t          d |D                       sJ d S )	Nbackupsz+finance-runtime-db-20260101T000000Z.sqlite3s   sqlite backup placeholderz2finance-runtime-db-20260101T000000Z.sqlite3.sha256@0000000000000000000000000000000000000000000000000000000000000000c                2    h | ]}|j         d k    |j        S rs   rt   r   s     r   ru   z>test_git_safety_blocks_backup_files_in_repo.<locals>.<setcomp>   rv   r   3backups/finance-runtime-db-20260101T000000Z.sqlite3c              3  B   K   | ]}|j         d k    o
|j        dk    V  dS )r   zforbidden_file_type:.sqlite3Nr9   r   s     r   r   z>test_git_safety_blocks_backup_files_in_repo.<locals>.<genexpr>   sP          	
GG 	7H66     r   )r;   r*   r<   r   r   r   )r   backupr   r}   s       r   +test_git_safety_blocks_backup_files_in_repor      s    	!$QQF
M
3444]IIUUV^___""HffXfffM@MQQQQ            r   c                Z   | dz  }|dz                       d           |dz  dz                       d           |dz  dz                      d           |dz  dz  d	z                      d
           |dz                      d           |dz                      d           |dz                      d           |dz                      d           t          |           }d |D             }|d         dk    sJ |d         dk    sJ |d         dk    sJ d|vsJ d|vsJ d|vsJ d S )NfrontenddistTr&   node_modulespkgz
index.htmlz<div>built</div>zindex.jsz	export {}z.env.developmentz VITE_OPENFIGI_KEY=must-not-existzpackage.jsonz{"private":true}zpackage-lock.jsonz{"lockfileVersion":3}ztsconfig.jsonz{"compilerOptions":{}}c                (    i | ]}|j         |j        S rJ   r9   r   s     r   
<dictcomp>zQtest_git_safety_blocks_frontend_build_artifacts_and_env_files.<locals>.<dictcomp>   s    :::Aqvqx:::r   zfrontend/dist/index.htmlruntime_cache_file_blockedz"frontend/node_modules/pkg/index.jszfrontend/.env.developmentforbidden_secret_filenamezfrontend/package.jsonzfrontend/package-lock.jsonzfrontend/tsconfig.jsonr)   )r   r   r   reasons_by_paths       r   =test_git_safety_blocks_frontend_build_artifacts_and_env_filesr      s   *$Hd+++&--d-;;;%112DEEE&3??LLL""../QRRR**+=>>>##//0GHHH++,DEEE""H:::::O56:VVVVV?@D`````67;VVVVV"/9999'>>>>#?::::::r   )r   r   r   r	   )r   r   r^   rc   r_   rc   r   r	   )
__future__r   pathlibr   r   !jarvis_finance.quality.git_safetyr   r   r   r"   r+   r0   r>   rC   rU   rZ   r]   markparametrizerf   ri   rn   r~   r   r   r   r   rJ   r   r   <module>r      s   " " " " " "        D D D D D D D DD D D D   % % % %% % % %j j j j$% % % %
> 
> 
> 
>J J J JJ J J J    H H H HK K K K_ _ _ _v v v v[ [ [ [   $    ; ; ; ; ; ;r   