fix(audit): durcir les validations de securite

tests/test_security_scan.py

@@ -0,0 +1,93 @@
+"""The security scanner must fail closed when its dependency audit cannot run."""
+
+import json
+import subprocess
+import urllib.error
+
+from app.supporting_scripts import security_scan
+
+
+def _result(returncode, stdout='', stderr=''):
+    return subprocess.CompletedProcess([], returncode, stdout=stdout, stderr=stderr)
+
+
+def test_debug_mode_fails_the_environment_check(monkeypatch):
+    monkeypatch.setenv('SECRET_KEY', 'x' * 32)
+    monkeypatch.setenv('DATABASE_URL', 'sqlite:///:memory:')
+    monkeypatch.setenv('FLASK_DEBUG', 'true')
+
+    assert security_scan.check_environment() is False
+
+
+def test_a_missing_database_url_fails_the_environment_check(monkeypatch):
+    monkeypatch.setenv('SECRET_KEY', 'x' * 32)
+    monkeypatch.delenv('DATABASE_URL', raising=False)
+    monkeypatch.setenv('FLASK_DEBUG', 'false')
+
+    assert security_scan.check_environment() is False
+
+
+def test_an_unreachable_http_target_cannot_report_success(monkeypatch):
+    def unreachable(*args, **kwargs):
+        raise urllib.error.URLError('connection refused')
+
+    monkeypatch.setattr(security_scan.urllib.request, 'urlopen', unreachable)
+
+    assert security_scan.check_https_headers('https://example.test') is False
+
+
+def test_a_clean_dependency_audit_passes(monkeypatch):
+    command = []
+
+    def clean_audit(args, **kwargs):
+        command.extend(args)
+        return _result(0)
+
+    monkeypatch.setattr(
+        security_scan.subprocess,
+        'run',
+        clean_audit,
+    )
+
+    assert security_scan.check_dependencies() is True
+    requirement_flag = command.index('--requirement')
+    assert command[requirement_flag + 1] == str(security_scan.REQUIREMENTS_FILE)
+
+
+def test_reported_vulnerabilities_fail_the_scan(monkeypatch):
+    report = {
+        'dependencies': [
+            {
+                'name': 'example',
+                'version': '1.0',
+                'vulns': [{'id': 'PYSEC-TEST'}],
+            }
+        ]
+    }
+    monkeypatch.setattr(
+        security_scan.subprocess,
+        'run',
+        lambda *args, **kwargs: _result(1, stdout=json.dumps(report)),
+    )
+
+    assert security_scan.check_dependencies() is False
+
+
+def test_an_audit_that_crashes_cannot_report_success(monkeypatch, capsys):
+    monkeypatch.setattr(
+        security_scan.subprocess,
+        'run',
+        lambda *args, **kwargs: _result(1, stderr='audit unavailable'),
+    )
+
+    assert security_scan.check_dependencies() is False
+    assert '[FAIL] audit unavailable' in capsys.readouterr().out
+
+
+def test_an_audit_timeout_cannot_report_success(monkeypatch):
+    def timeout(*args, **kwargs):
+        raise subprocess.TimeoutExpired('pip-audit', 60)
+
+    monkeypatch.setattr(security_scan.subprocess, 'run', timeout)
+
+    assert security_scan.check_dependencies() is False