Function test_findings_for_github_policy

crates/openshell-prover/src/lib.rs:164–199

()

    // The prover output is categorical, not severity-graded.
    #[test]
    fn test_findings_for_github_policy() {
        use finding::category;

        let policy_path = testdata_dir().join("policy.yaml");
        let creds_path = testdata_dir().join("credentials.yaml");

        let pol = parse_policy(&policy_path).expect("parse policy");
        let cred_set = credentials::load_credential_set_embedded(&creds_path).expect("load creds");
        let bin_reg = registry::load_embedded_binary_registry().expect("load registry");

        let z3_model = build_model(pol, cred_set, bin_reg);
        let findings = run_all_queries(&z3_model);

        let categories: std::collections::HashSet<&str> =
            findings.iter().map(|f| f.query.as_str()).collect();
        assert!(
            categories.contains(category::L7_BYPASS_CREDENTIALED),
            "expected l7_bypass_credentialed finding for bypass-L7 binary with credential in scope; \
             got categories: {categories:?}"
        );
        // Every emitted category must be one of the four v1 categories.
        let allowed: std::collections::HashSet<&str> = [
            category::LINK_LOCAL_REACH,
            category::L7_BYPASS_CREDENTIALED,
            category::CREDENTIAL_REACH_EXPANSION,
            category::CAPABILITY_EXPANSION,
        ]
        .into_iter()
        .collect();
        for c in &categories {
            assert!(
                allowed.contains(*c),
                "unexpected category {c} emitted by the prover"
            );
        }
    }

    #[test]
    fn test_wildcard_endpoint_covering_credential_host_emits_credential_reach() {