(t *testing.T)
| 139 | } |
| 140 | |
| 141 | func TestScreenInbound_BlockQuarantines(t *testing.T) { |
| 142 | srv := testScreenServer() |
| 143 | agent := scanOnAgent() |
| 144 | agent.InboundScanReviewThreshold = 0.5 |
| 145 | agent.InboundScanBlockThreshold = 0.9 // hidden-injection ~0.925 → block band |
| 146 | res := srv.screenInbound(context.Background(), agent, "msg_h2", "alice@evil.com", |
| 147 | []byte(hiddenInjection), nil, inboundpolicy.Decision{}) |
| 148 | |
| 149 | if !res.Hold || res.AppliedAction != piguard.ActionBlock { |
| 150 | t.Fatalf("expected block, got hold=%v action=%v", res.Hold, res.AppliedAction) |
| 151 | } |
| 152 | if res.Denorm.Status != identity.MessageStatusReviewRejected { |
| 153 | t.Errorf("status = %q, want review_rejected", res.Denorm.Status) |
| 154 | } |
| 155 | if res.Denorm.ApprovalExpiresAt != nil { |
| 156 | t.Errorf("block is terminal — must not set approval_expires_at") |
| 157 | } |
| 158 | } |
| 159 | |
| 160 | func TestScreenInbound_GateReviewHolds(t *testing.T) { |
| 161 | srv := testScreenServer() |
nothing calls this directly
no test coverage detected