Function test_l4_log_fields

e2e/python/test_sandbox_policy.py:604–636

L4-7: CONNECT log contains structured fields for allow and deny.

(
    sandbox: Callable[..., Sandbox],
)

def test_l4_log_fields(
    sandbox: Callable[..., Sandbox],
) -> None:
    """L4-7: CONNECT log contains structured fields for allow and deny."""
    policy = _base_policy(
        network_policies={
            "anthropic": sandbox_pb2.NetworkPolicyRule(
                name="anthropic",
                endpoints=[
                    sandbox_pb2.NetworkEndpoint(host="api.anthropic.com", port=443),
                ],
                binaries=[sandbox_pb2.NetworkBinary(path="/**")],
            ),
        },
    )
    spec = datamodel_pb2.SandboxSpec(policy=policy)
    with sandbox(spec=spec, delete_on_exit=True) as sb:
        # Generate an allow
        sb.exec_python(_proxy_connect(), args=("api.anthropic.com", 443))
        # Generate a deny
        sb.exec_python(_proxy_connect(), args=("example.com", 443))

        log_result = sb.exec_python(_read_openshell_log())
        assert log_result.exit_code == 0, log_result.stderr
        log = log_result.stdout

        # Verify OCSF shorthand fields in allow line
        assert "ALLOWED" in log, "Expected ALLOWED in OCSF shorthand"
        assert "api.anthropic.com" in log, "Expected destination host in log"
        assert "engine:opa" in log, "Expected engine:opa in log context"

        # Verify deny line exists
        assert "DENIED" in log, "Expected DENIED in OCSF shorthand"


# =============================================================================