DataOps-platform/tests/security/test_trusted_delivery_hardening_contract.py

"""Regression contracts for the final WP06 trusted-delivery hardening pass."""

from __future__ import annotations

import importlib
from pathlib import Path

ROOT = Path(__file__).resolve().parents[2]


def test_final_hardening_migration_serializes_asset_state_and_validates_active_grants():
    migration = importlib.import_module("migrations.versions.20260811_485_trusted_delivery_hardening")
    assert migration.down_revision == "20260811_484"
    source = "\n".join(value for value in migration.upgrade.__code__.co_consts if isinstance(value, str))
    for required in (
        "pg_advisory_xact_lock",
        "lock_trusted_delivery_asset",
        "enforce_trusted_delivery_grant_active",
        "enforce_trusted_delivery_subscription_guard",
        "trg_trusted_delivery_hold_asset_lock",
        "trg_trusted_delivery_destruction_asset_lock",
    ):
        assert required in source


def test_openapi_contract_uses_yaml_parser_and_final_hardening_is_deployed_byte_for_byte():
    contract = (ROOT / "tests/test_trusted_delivery_openapi_contract.py").read_text()
    assert "yaml.safe_load" in contract
    assert ".split(f'  \"{path}\":'" not in contract
    relative = "migrations/versions/20260811_485_trusted_delivery_hardening.py"
    assert (ROOT / relative).read_bytes() == (ROOT / "deployment" / relative).read_bytes()