test_policy.py

Go to the documentation of this file.

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
# tests/tests_git/test_policy.py
 
"""
Purpose
-------
Unit tests for :mod:`oct.git.policy` — the profile resolution and
exit-code derivation layer for ``oct git check`` (Phase 4B / G-B4).
 
Responsibilities
----------------
- Verify profile resolution precedence: protected branch > CLI >
  ``.octrc.json`` > default.
- Verify the :data:`~oct.git.policy.PROFILE_MATRIX` rows against the
  blueprint §5.3 / §7.1 specification, byte for byte.
- Verify the exit-code table 0..5 with every precedence permutation,
  including the "secrets always blocks" invariant.
 
Diagnostics
-----------
Domain: GIT (pure unit tests; logging exercised only incidentally)
    Levels:
        L2 — test lifecycle
        L3 — assertion details
        L4 — deep tracing
 
Contracts
---------
- Every test is hermetic — no filesystem access, no subprocess, no git.
- ``QualityGateResult`` stand-ins are built from :class:`types.SimpleNamespace`
  so these tests do not depend on :mod:`oct.git.quality_gate` being
  implemented yet (it lands later in the same phase).
"""
 
from types import SimpleNamespace
 
import pytest
 
from oct.git.policy import (
    DEFAULT_PROFILE,
    DEFAULT_PROTECTED_BRANCHES,
    PROFILE_MATRIX,
    SECRETS_ALWAYS_BLOCKS,
    VALID_PROFILES,
    apply_profile_policy,
    is_protected_branch,
    resolve_effective_profile,
)
 
 
# ---------------------------------------------------------------------
# Helpers
# ---------------------------------------------------------------------
 
 
def _gate_result(
    *,
    lint_violations: int = 0,
    format_violations: int = 0,
    secrets_findings: list | None = None,
    test_failures: int = 0,
) -> SimpleNamespace:
    """Return a minimal stand-in for ``QualityGateResult``.
 
    ``apply_profile_policy`` only reads the four attributes set here,
    so a SimpleNamespace is sufficient. Using SimpleNamespace lets the
    tests run before :mod:`oct.git.quality_gate` exists.
    """
    return SimpleNamespace(
        lint_violations=lint_violations,
        format_violations=format_violations,
        secrets_findings=list(secrets_findings or []),
        test_failures=test_failures,
    )
 
 
# ---------------------------------------------------------------------
# PROFILE_MATRIX invariants
# ---------------------------------------------------------------------
 
 
class TestProfileMatrix:
    def test_matrix_has_three_canonical_profiles(self):
        assert set(PROFILE_MATRIX.keys()) == {"proto", "compact", "strict"}
 
    def test_valid_profiles_tuple_matches_matrix(self):
        assert set(VALID_PROFILES) == set(PROFILE_MATRIX.keys())
 
    def test_secrets_always_blocks_invariant_flag(self):
        assert SECRETS_ALWAYS_BLOCKS is True
 
    def test_secrets_row_is_blocking_under_every_profile(self):
        # Blueprint §5.3 verbatim: "Secrets check is always blocking
        # regardless of profile. Safety above all."
        for profile, row in PROFILE_MATRIX.items():
            assert row["secrets"] == "blocking", (
                f"profile {profile} must have secrets=blocking"
            )
 
    def test_proto_row_matches_blueprint(self):
        # Blueprint §5.3: proto => lint warn, format skip, secrets blocking, tests skip
        row = PROFILE_MATRIX["proto"]
        assert row["lint"] == "warn"
        assert row["format"] == "skip"
        assert row["secrets"] == "blocking"
        assert row["tests"] == "skip"
 
    def test_compact_row_matches_blueprint(self):
        row = PROFILE_MATRIX["compact"]
        assert row["lint"] == "blocking"
        assert row["format"] == "blocking"
        assert row["secrets"] == "blocking"
        assert row["tests"] == "optional"
 
    def test_strict_row_matches_blueprint(self):
        row = PROFILE_MATRIX["strict"]
        assert row["lint"] == "blocking"
        assert row["format"] == "blocking"
        assert row["secrets"] == "blocking"
        assert row["tests"] == "blocking"
 
    def test_default_profile_is_compact(self):
        # Blueprint §7: project default is "compact".
        assert DEFAULT_PROFILE == "compact"
 
    def test_default_protected_branches(self):
        # Blueprint §7.2: default protected set is main + master.
        assert DEFAULT_PROTECTED_BRANCHES == ("main", "master")
 
 
# ---------------------------------------------------------------------
# is_protected_branch
# ---------------------------------------------------------------------
 
 
class TestIsProtectedBranch:
    def test_main_is_protected_by_default(self):
        assert is_protected_branch("main", None) is True
 
    def test_master_is_protected_by_default(self):
        assert is_protected_branch("master", None) is True
 
    def test_feature_branch_not_protected(self):
        assert is_protected_branch("feature/xyz", None) is False
 
    def test_none_branch_not_protected(self):
        assert is_protected_branch(None, None) is False
 
    def test_empty_branch_not_protected(self):
        assert is_protected_branch("", None) is False
 
    def test_detached_head_literal_not_protected(self):
        # oct.core.git.current_branch returns "HEAD" when detached.
        assert is_protected_branch("HEAD", None) is False
 
    def test_custom_protected_list_from_octrc(self):
        octrc = {"git": {"protected_branches": ["release/current"]}}
        assert is_protected_branch("release/current", octrc) is True
        # main is NOT in the custom list — not protected here
        assert is_protected_branch("main", octrc) is False
 
    def test_malformed_octrc_falls_back_to_defaults(self):
        # git.protected_branches is not a list -> ignored, use defaults
        octrc = {"git": {"protected_branches": "not-a-list"}}
        assert is_protected_branch("main", octrc) is True
 
    def test_non_string_entries_are_filtered(self):
        octrc = {"git": {"protected_branches": ["main", 42, None, "dev"]}}
        assert is_protected_branch("main", octrc) is True
        assert is_protected_branch("dev", octrc) is True
        assert is_protected_branch("feature/x", octrc) is False
 
 
# ---------------------------------------------------------------------
# resolve_effective_profile
# ---------------------------------------------------------------------
 
 
class TestResolveEffectiveProfile:
    def test_protected_branch_forces_strict(self):
        # Even with CLI override asking for proto, main is strict
        assert resolve_effective_profile("main", None, "proto") == "strict"
 
    def test_protected_branch_beats_octrc_default(self):
        octrc = {"git": {"pre_commit_profile": "proto"}}
        assert resolve_effective_profile("main", octrc, None) == "strict"
 
    def test_cli_override_beats_octrc(self):
        octrc = {"git": {"pre_commit_profile": "proto"}}
        assert resolve_effective_profile("feature/x", octrc, "strict") == "strict"
 
    def test_cli_unknown_value_falls_through(self):
        octrc = {"git": {"pre_commit_profile": "proto"}}
        # "banana" is not a valid profile -> fall through to octrc
        assert resolve_effective_profile("feature/x", octrc, "banana") == "proto"
 
    def test_git_pre_commit_profile_from_octrc(self):
        octrc = {"git": {"pre_commit_profile": "strict"}}
        assert resolve_effective_profile("feature/x", octrc, None) == "strict"
 
    def test_linter_profile_from_octrc_fallback(self):
        octrc = {"linter": {"profile": "proto"}}
        assert resolve_effective_profile("feature/x", octrc, None) == "proto"
 
    def test_git_config_takes_priority_over_linter_config(self):
        octrc = {
            "git": {"pre_commit_profile": "strict"},
            "linter": {"profile": "proto"},
        }
        assert resolve_effective_profile("feature/x", octrc, None) == "strict"
 
    def test_no_octrc_returns_default(self):
        assert resolve_effective_profile("feature/x", None, None) == DEFAULT_PROFILE
 
    def test_empty_octrc_returns_default(self):
        assert resolve_effective_profile("feature/x", {}, None) == DEFAULT_PROFILE
 
    def test_invalid_linter_profile_is_ignored(self):
        octrc = {"linter": {"profile": "not-a-profile"}}
        assert resolve_effective_profile("feature/x", octrc, None) == DEFAULT_PROFILE
 
    def test_detached_head_with_cli_override(self):
        # Detached HEAD is not protected -> CLI override wins
        assert resolve_effective_profile("HEAD", None, "strict") == "strict"
 
    def test_none_branch_with_cli_override(self):
        assert resolve_effective_profile(None, None, "proto") == "proto"
 
 
# ---------------------------------------------------------------------
# apply_profile_policy — exit code 0 (all green)
# ---------------------------------------------------------------------
 
 
class TestExitCodeZero:
    def test_clean_result_returns_zero(self):
        assert apply_profile_policy("compact", _gate_result()) == 0
 
    def test_zero_violations_under_every_profile(self):
        for profile in VALID_PROFILES:
            assert apply_profile_policy(profile, _gate_result()) == 0
 
    def test_unknown_profile_degrades_to_default(self):
        assert apply_profile_policy("nonsense", _gate_result()) == 0
 
 
# ---------------------------------------------------------------------
# apply_profile_policy — exit code 1 (lint)
# ---------------------------------------------------------------------
 
 
class TestExitCodeOne:
    def test_lint_only_under_compact(self):
        r = _gate_result(lint_violations=3)
        assert apply_profile_policy("compact", r) == 1
 
    def test_lint_only_under_strict(self):
        r = _gate_result(lint_violations=1)
        assert apply_profile_policy("strict", r) == 1
 
    def test_lint_under_proto_is_warn_not_blocking(self):
        # proto: lint=warn -> not in exit code
        r = _gate_result(lint_violations=5)
        assert apply_profile_policy("proto", r) == 0
 
 
# ---------------------------------------------------------------------
# apply_profile_policy — exit code 2 (format)
# ---------------------------------------------------------------------
 
 
class TestExitCodeTwo:
    def test_format_only_under_compact(self):
        r = _gate_result(format_violations=2)
        assert apply_profile_policy("compact", r) == 2
 
    def test_format_only_under_strict(self):
        r = _gate_result(format_violations=2)
        assert apply_profile_policy("strict", r) == 2
 
    def test_format_under_proto_is_skipped_not_blocking(self):
        # proto: format=skip -> never contributes to exit code
        r = _gate_result(format_violations=5)
        assert apply_profile_policy("proto", r) == 0
 
 
# ---------------------------------------------------------------------
# apply_profile_policy — exit code 3 (lint + format)
# ---------------------------------------------------------------------
 
 
class TestExitCodeThree:
    def test_lint_and_format_under_compact(self):
        r = _gate_result(lint_violations=1, format_violations=1)
        assert apply_profile_policy("compact", r) == 3
 
    def test_lint_and_format_under_strict(self):
        r = _gate_result(lint_violations=10, format_violations=3)
        assert apply_profile_policy("strict", r) == 3
 
    def test_lint_and_format_under_proto_collapse_to_zero(self):
        # proto blocks neither -> zero even with both non-zero
        r = _gate_result(lint_violations=4, format_violations=4)
        assert apply_profile_policy("proto", r) == 0
 
 
# ---------------------------------------------------------------------
# apply_profile_policy — exit code 4 (tests)
# ---------------------------------------------------------------------
 
 
class TestExitCodeFour:
    def test_test_failures_under_strict(self):
        r = _gate_result(test_failures=1)
        assert apply_profile_policy("strict", r) == 4
 
    def test_test_failures_under_compact_optional_are_non_blocking(self):
        # OI-531: compact sets tests="optional" — failures run and are
        # reported upstream but must NOT drive the exit code. Only
        # "blocking" (under strict) earns exit 4.
        r = _gate_result(test_failures=3)
        assert apply_profile_policy("compact", r) == 0
 
    def test_test_failures_under_proto_skipped(self):
        # proto: tests=skip -> not blocking
        r = _gate_result(test_failures=5)
        assert apply_profile_policy("proto", r) == 0
 
    def test_tests_precedence_over_lint_format(self):
        # 4 > 3: when tests and lint both fail, tests wins
        r = _gate_result(
            lint_violations=1,
            format_violations=1,
            test_failures=1,
        )
        assert apply_profile_policy("strict", r) == 4
 
 
# ---------------------------------------------------------------------
# apply_profile_policy — exit code 5 (secrets always blocks)
# ---------------------------------------------------------------------
 
 
class TestExitCodeFive:
    def test_secret_finding_under_strict(self):
        r = _gate_result(secrets_findings=[("f.py", 1, "password")])
        assert apply_profile_policy("strict", r) == 5
 
    def test_secret_finding_under_compact(self):
        r = _gate_result(secrets_findings=[("f.py", 1, "password")])
        assert apply_profile_policy("compact", r) == 5
 
    def test_secret_finding_under_proto_still_blocks(self):
        # The invariant: proto may warn on lint but MUST block on secrets
        r = _gate_result(secrets_findings=[("f.py", 1, "password")])
        assert apply_profile_policy("proto", r) == 5
 
    def test_secrets_beats_lint(self):
        r = _gate_result(
            lint_violations=1,
            secrets_findings=[("f.py", 1, "password")],
        )
        assert apply_profile_policy("compact", r) == 5
 
    def test_secrets_beats_format(self):
        r = _gate_result(
            format_violations=1,
            secrets_findings=[("f.py", 1, "password")],
        )
        assert apply_profile_policy("compact", r) == 5
 
    def test_secrets_beats_lint_and_format(self):
        r = _gate_result(
            lint_violations=3,
            format_violations=2,
            secrets_findings=[("f.py", 1, "password")],
        )
        assert apply_profile_policy("compact", r) == 5
 
    def test_secrets_beats_tests(self):
        r = _gate_result(
            test_failures=2,
            secrets_findings=[("f.py", 1, "password")],
        )
        assert apply_profile_policy("strict", r) == 5
 
    def test_secrets_beats_everything(self):
        r = _gate_result(
            lint_violations=5,
            format_violations=5,
            test_failures=5,
            secrets_findings=[
                ("f.py", 1, "password"),
                ("g.py", 2, "api_key"),
            ],
        )
        assert apply_profile_policy("strict", r) == 5