|
| 1 | +""" |
| 2 | +Tests for `project_pending_info` — the queue-entry shape that |
| 3 | +`_get_csv_content` and `_action_get_pending_approvals` send to the |
| 4 | +WM frontend. |
| 5 | +
|
| 6 | +Origin: build 641 (2026-05-07). The WM approval banner displayed |
| 7 | +"<action> by <analyst> —" with no reason text for column_removal / |
| 8 | +remove_csv / remove_rule requests because the projection dropped |
| 9 | +the queue entry's `comment` field on the way to the frontend, while |
| 10 | +the auto-generated `description` field is empty for those action |
| 11 | +types. The frontend code at `wl_approval_ui.js:405` reads |
| 12 | +`pa.comment || pa.description || ""`, so both falsy → blank banner. |
| 13 | +
|
| 14 | +The Control Panel was unaffected because it uses the |
| 15 | +`get_approval_queue` action which returns the queue verbatim with |
| 16 | +no projection. |
| 17 | +
|
| 18 | +These tests pin the projection's contract so the regression cannot |
| 19 | +silently re-occur if someone adds another endpoint that constructs |
| 20 | +a similar shape inline. |
| 21 | +""" |
| 22 | + |
| 23 | +import os |
| 24 | +import sys |
| 25 | + |
| 26 | +import pytest |
| 27 | + |
| 28 | +_BIN = os.path.join(os.path.dirname(__file__), "..", "..", "bin") |
| 29 | +sys.path.insert(0, os.path.abspath(_BIN)) |
| 30 | + |
| 31 | +from wl_approval import project_pending_info # noqa: E402 |
| 32 | + |
| 33 | + |
| 34 | +@pytest.fixture |
| 35 | +def column_removal_entry(): |
| 36 | + """Realistic queue entry for an analyst-submitted column_removal. |
| 37 | +
|
| 38 | + Auto-`description` is empty (handler convention for this |
| 39 | + action type). The free-form analyst reason lives in `comment`. |
| 40 | + """ |
| 41 | + return { |
| 42 | + "request_id": "68d12bbb-8f37-4106-84d9-a5d34bd87a92", |
| 43 | + "timestamp": 1778025844, |
| 44 | + "analyst": "analyst1", |
| 45 | + "csv_file": "DR130_priv_escalation.csv", |
| 46 | + "app_context": "wl_manager", |
| 47 | + "detection_rule": "DR130_privilege_escalation", |
| 48 | + "action_type": "column_removal", |
| 49 | + "description": "", |
| 50 | + "comment": "Field deprecated by GRC team", |
| 51 | + "status": "pending", |
| 52 | + "payload": {}, |
| 53 | + "expected_mtime": None, |
| 54 | + "pending_highlight": {}, |
| 55 | + "resolved_by": None, |
| 56 | + "resolved_at": None, |
| 57 | + "rejection_reason": None, |
| 58 | + } |
| 59 | + |
| 60 | + |
| 61 | +def test_column_removal_comment_propagates(column_removal_entry): |
| 62 | + """The build-641 regression: `comment` must reach the frontend. |
| 63 | +
|
| 64 | + If this test fails the WM banner will render "column removal by |
| 65 | + analyst1 —" with nothing after the dash. |
| 66 | + """ |
| 67 | + out = project_pending_info(column_removal_entry, has_edit=True) |
| 68 | + assert out["comment"] == "Field deprecated by GRC team" |
| 69 | + assert "comment" in out |
| 70 | + |
| 71 | + |
| 72 | +def test_missing_comment_yields_empty_string(column_removal_entry): |
| 73 | + """Resilience: queue entries written by older app versions may |
| 74 | + not have a `comment` field at all. Projection must default to |
| 75 | + empty string rather than KeyError or None (the frontend's |
| 76 | + `||` short-circuit treats both empty string and undefined as |
| 77 | + falsy, which is the desired behavior).""" |
| 78 | + del column_removal_entry["comment"] |
| 79 | + out = project_pending_info(column_removal_entry, has_edit=True) |
| 80 | + assert out["comment"] == "" |
| 81 | + |
| 82 | + |
| 83 | +def test_required_fields_always_present(column_removal_entry): |
| 84 | + """Pin the eight contract fields the frontend banner consumes. |
| 85 | +
|
| 86 | + Adding fields is fine; removing one breaks the WM page silently |
| 87 | + (no JS error, just a missing banner element).""" |
| 88 | + out = project_pending_info(column_removal_entry, has_edit=True) |
| 89 | + expected = { |
| 90 | + "request_id", "action_type", "description", "comment", |
| 91 | + "analyst", "timestamp", "pending_highlight", "payload", |
| 92 | + } |
| 93 | + assert set(out.keys()) == expected |
| 94 | + |
| 95 | + |
| 96 | +def test_non_editor_cannot_see_payload(column_removal_entry): |
| 97 | + """RBAC contract: non-editors get who/when/what but not the |
| 98 | + row-level highlight or payload (which can carry CSV row content |
| 99 | + that the requester is asking to add/remove).""" |
| 100 | + column_removal_entry["payload"] = {"sensitive_row_data": "secret"} |
| 101 | + column_removal_entry["pending_highlight"] = {"row_keys": ["a"]} |
| 102 | + out = project_pending_info(column_removal_entry, has_edit=False) |
| 103 | + assert out["payload"] == {} |
| 104 | + assert out["pending_highlight"] == {} |
| 105 | + # But the public fields still flow through |
| 106 | + assert out["analyst"] == "analyst1" |
| 107 | + assert out["comment"] == "Field deprecated by GRC team" |
| 108 | + |
| 109 | + |
| 110 | +def test_editor_sees_payload_and_highlight(column_removal_entry): |
| 111 | + """Symmetric check: editor view exposes payload + highlight.""" |
| 112 | + column_removal_entry["payload"] = {"col": "ticket_id"} |
| 113 | + column_removal_entry["pending_highlight"] = {"col": "ticket_id"} |
| 114 | + out = project_pending_info(column_removal_entry, has_edit=True) |
| 115 | + assert out["payload"] == {"col": "ticket_id"} |
| 116 | + assert out["pending_highlight"] == {"col": "ticket_id"} |
| 117 | + |
| 118 | + |
| 119 | +@pytest.mark.parametrize("action_type", [ |
| 120 | + "column_removal", "remove_csv", "remove_rule", |
| 121 | + "bulk_row_removal", "bulk_row_addition", "revert", |
| 122 | + "csv_import_replace", "bulk_row_edit", |
| 123 | + "create_csv", "create_rule", |
| 124 | +]) |
| 125 | +def test_comment_propagates_for_all_action_types( |
| 126 | + column_removal_entry, action_type): |
| 127 | + """The `comment` projection must work for every action type the |
| 128 | + frontend banner can render.""" |
| 129 | + column_removal_entry["action_type"] = action_type |
| 130 | + out = project_pending_info(column_removal_entry, has_edit=True) |
| 131 | + assert out["comment"] == "Field deprecated by GRC team" |
| 132 | + assert out["action_type"] == action_type |
0 commit comments