DataOps-platform/tests/test_security_governance_contract.py

from pathlib import Path

from app.core.system.permissions import (
    SECURITY_GOVERNANCE_MANAGE,
    SECURITY_GOVERNANCE_OPERATE,
    SECURITY_GOVERNANCE_READ,
    permission_for_request,
    permissions_for_roles,
)

ROOT = Path(__file__).resolve().parents[1]


def test_security_migration_is_additive_forward_only_and_evidence_bearing():
    migration = (ROOT / "migrations/versions/20260802_460_security_governance.py").read_text()
    assert 'revision = "20260802_460"' in migration
    assert 'down_revision = "20260802_450"' in migration
    for table in (
        "security_classification_profiles", "security_classification_scans",
        "security_classification_findings", "security_access_policies",
        "security_access_decisions", "security_egress_requests",
        "security_retention_policies", "security_siem_sinks",
        "security_siem_deliveries", "security_sboms",
        "security_vulnerabilities", "security_governance_events",
        "access_control_audit_events",
    ):
        assert f"CREATE TABLE public.{table}" in migration
    assert "raise RuntimeError" in migration
    assert "DROP TABLE" not in migration.upper()


def test_security_permission_matrix_is_monotonic_and_risk_aware():
    assert SECURITY_GOVERNANCE_READ in permissions_for_roles(["viewer"])
    assert SECURITY_GOVERNANCE_OPERATE not in permissions_for_roles(["viewer"])
    assert SECURITY_GOVERNANCE_OPERATE in permissions_for_roles(["editor"])
    assert SECURITY_GOVERNANCE_MANAGE not in permissions_for_roles(["editor"])
    assert SECURITY_GOVERNANCE_MANAGE in permissions_for_roles(["admin"])
    assert permission_for_request("/api/system/security-governance/dashboard", "GET") == (SECURITY_GOVERNANCE_READ,)
    assert permission_for_request("/api/system/security-governance/scans", "POST") == (SECURITY_GOVERNANCE_OPERATE,)
    assert permission_for_request("/api/system/security-governance/findings/x/review", "POST") == (SECURITY_GOVERNANCE_MANAGE,)
    assert permission_for_request("/api/system/security-governance/egress/x/reconcile", "POST") == (SECURITY_GOVERNANCE_MANAGE,)
    assert permission_for_request("/api/system/security-governance/sboms", "POST") == (SECURITY_GOVERNANCE_MANAGE,)


def test_security_surface_reuses_work_center_and_expands_safe_audit_categories():
    repository = (ROOT / "app/core/system/security_governance_repository.py").read_text()
    service = (ROOT / "app/core/system/security_governance.py").read_text()
    audit = (ROOT / "app/core/system/governance_audit_repository.py").read_text()
    work_center = (ROOT / "app/core/governance/work_center.py").read_text()
    assert "UnifiedWorkCenterService" in repository
    assert '"data_egress"' in work_center
    assert '"security_request"' in work_center
    assert "highly_sensitive_egress_disabled" in service
    assert '"authorization"' in audit
    assert '"workflow_task"' in audit
    assert '"data_product"' in audit
    assert '"agent"' in audit
    assert '"security_governance"' in audit
    assert "sample_values" not in repository


def test_data_security_workbench_replaces_placeholder_with_operational_surfaces():
    client = (ROOT / "frontend/src/api/securityGovernance.js").read_text()
    view = (ROOT / "frontend/src/views/dataGovernance/dataSecurity/index.vue").read_text()
    routes = (ROOT / "frontend/src/router/routes.js").read_text()
    for operation in (
        "listSecurityFindings", "reviewSecurityFinding", "evaluateSecurityAccess",
        "createSecurityEgress", "reconcileSecurityEgress", "listSecurityRetention",
        "dispatchSecuritySiem", "registerSecuritySbom", "importSecurityVulnerabilities",
        "assignSecurityVulnerability", "resolveSecurityVulnerability", "closeSecurityVulnerability",
    ):
        assert operation in client
    for capability in (
        "数据安全治理", "分类发现与人工复核", "访问决策", "出域审批",
        "SBOM 与漏洞整改", "审计投递", "留存边界", "高敏感数据出域默认拒绝",
        "样本原值不落库", "不会自动删除",
    ):
        assert capability in view
    assert "功能将在后续迭代中建设" not in view
    assert "security-governance:read" in routes