S06-S08: Python spec, Go in-process leaf, tests and Forgejo CI

tests/test_sm.py

@@ -0,0 +1,83 @@
+"""Signed config, passthrough, error bundle, admin history."""
+
+from __future__ import annotations
+
+import json
+import tempfile
+import unittest
+from pathlib import Path
+
+from secure_messaging.admin_history import AdminHistory
+from secure_messaging.envelope import open_lab, seal
+from secure_messaging.error_bundle import build_bundle, log_summary, open_sender, open_system
+from secure_messaging.signed_config import UnsignedConfig, generate_signing_key, load_signed, save_signed, sign, verify
+
+
+class SignedConfigTests(unittest.TestCase):
+    def test_roundtrip_and_tamper(self):
+        priv = generate_signing_key()
+        pub = priv.public_key()
+        payload = {"crypto": {"mode": "lab-xor"}, "routing": {"mode": "passthrough"}}
+        signed = sign(payload, priv)
+        self.assertEqual(verify(signed.wrapper(), pub)["crypto"]["mode"], "lab-xor")
+        bad = signed.wrapper()
+        bad["payload"]["crypto"]["mode"] = "plain-lab"
+        with self.assertRaises(UnsignedConfig):
+            verify(bad, pub)
+        with tempfile.TemporaryDirectory() as td:
+            p = Path(td) / "c.json"
+            save_signed(p, signed)
+            self.assertEqual(load_signed(p, pub)["routing"]["mode"], "passthrough")
+            p.write_text(json.dumps({"payload": payload}))
+            with self.assertRaises(UnsignedConfig):
+                load_signed(p, pub)
+
+
+class EnvelopeTests(unittest.TestCase):
+    def test_lab_xor_roundtrip_lookup(self):
+        env = seal(
+            to="npe.inbox.abc",
+            sender="alice",
+            body={"note": "hello"},
+            mode="lab-xor",
+            lab_key=b"lab",
+        )
+        self.assertEqual(env.to, "npe.inbox.abc")
+        self.assertNotIn("alice", env.from_lookup_id)
+        self.assertEqual(open_lab(env, b"lab")["note"], "hello")
+
+
+class ErrorBundleTests(unittest.TestCase):
+    def test_sender_and_system_separate(self):
+        b = build_bundle(
+            lookup_id="lid1",
+            error_code="SM-DEAD-1",
+            dest_class="mailbox",
+            sender_pub=b"sender-pub",
+            system_pub=b"system-pub",
+            detail="undeliverable",
+        )
+        s = open_sender(b, b"sender-pub")
+        sysb = open_system(b, b"system-pub")
+        self.assertEqual(s["detail"], "undeliverable")
+        self.assertNotIn("detail", sysb)
+        self.assertTrue(sysb["respond"])
+        self.assertEqual(log_summary(b)["error_code"], "SM-DEAD-1")
+        with self.assertRaises(Exception):
+            open_sender(b, b"wrong")
+
+
+class HistoryTests(unittest.TestCase):
+    def test_prev_new_diff(self):
+        with tempfile.TemporaryDirectory() as td:
+            h = AdminHistory(Path(td) / "admin-history")
+            row = h.append_change(actor="alice", prev_text="a=1\n", new_text="a=2\n")
+            self.assertEqual(row["payload"]["type"], "admin-config")
+            self.assertIn("-a=1", row["payload"]["diff"])
+            self.assertIn("+a=2", row["payload"]["diff"])
+            with self.assertRaises(ValueError):
+                h.append_change(actor="", prev_text="", new_text="x")
+
+
+if __name__ == "__main__":
+    unittest.main()