29 lines
883 B
Python
29 lines
883 B
Python
"""Sandbox security tests — the critical property is that model-generated code cannot read
|
|
account secrets. Pure (no network)."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import os
|
|
|
|
from tools.sandbox import scrubbed_env
|
|
|
|
|
|
def test_scrubbed_env_excludes_secrets(monkeypatch):
|
|
monkeypatch.setenv("ALPACA_NOVA_SECRET", "topsecret")
|
|
monkeypatch.setenv("FINNHUB_API_KEY", "fhkey")
|
|
monkeypatch.setenv("OMLX_API_KEY", "omlxkey")
|
|
env = scrubbed_env("/tmp/work")
|
|
# no secret-prefixed vars leak through
|
|
assert all(
|
|
not k.upper().startswith(("ALPACA", "FINNHUB", "OMLX", "EMAIL", "SMTP"))
|
|
for k in env
|
|
)
|
|
assert "ALPACA_NOVA_SECRET" not in env
|
|
|
|
|
|
def test_scrubbed_env_minimal_and_headless():
|
|
env = scrubbed_env("/home/x")
|
|
assert env["HOME"] == "/home/x"
|
|
assert env["MPLBACKEND"] == "Agg" # headless matplotlib
|
|
assert "PATH" in env
|