Function test_l7_tls_log_fields

e2e/python/test_sandbox_policy.py:1169–1205

L7-T7: L7 request logging includes structured fields.

(
    sandbox: Callable[..., Sandbox],
)

def test_l7_tls_log_fields(
    sandbox: Callable[..., Sandbox],
) -> None:
    """L7-T7: L7 request logging includes structured fields."""
    policy = _base_policy(
        network_policies={
            "anthropic": sandbox_pb2.NetworkPolicyRule(
                name="anthropic",
                endpoints=[
                    sandbox_pb2.NetworkEndpoint(
                        host="api.anthropic.com",
                        port=443,
                        protocol="rest",
                        tls="terminate",
                        enforcement="enforce",
                        access="full",
                    ),
                ],
                binaries=[sandbox_pb2.NetworkBinary(path="/**")],
            ),
        },
    )
    spec = datamodel_pb2.SandboxSpec(policy=policy)
    with sandbox(spec=spec, delete_on_exit=True) as sb:
        sb.exec_python(
            _proxy_connect_then_http(),
            args=("api.anthropic.com", 443, "GET", "/v1/models"),
        )

        log_result = sb.exec_python(_read_openshell_log())
        assert log_result.exit_code == 0, log_result.stderr
        log = log_result.stdout

        # OCSF shorthand: L7 requests show as HTTP:method events
        assert "HTTP:" in log, "Expected OCSF HTTP activity event in log"
        assert "ALLOWED" in log or "DENIED" in log, "Expected L7 decision in log"
        assert "policy:" in log, "Expected policy context in log"


def test_l7_query_matchers_enforced(