| use super::CheckStatus; |
| use super::Evidence; |
| use super::classify_gatekeeper; |
| use super::classify_security_events; |
| use super::enforcement_check; |
| use pretty_assertions::assert_eq; |
| use std::os::unix::process::ExitStatusExt; |
| use std::process::ExitStatus; |
| use std::process::Output; |
|
|
| #[test] |
| fn only_matching_enforced_apple_security_events_are_failures() { |
| for (event, expected) in [ |
| ("denied com.openai.codex", Evidence::Blocked), |
| ( |
| "denied /Applications/Codex.app/Contents/MacOS/Codex", |
| Evidence::Blocked, |
| ), |
| ("malware detected ChatGPT.app", Evidence::Malware), |
| ("audit token blocked ChatGPT.app", Evidence::Blocked), |
| ( |
| "audit token XP_MALWARE_DETECTED ChatGPT.app", |
| Evidence::Malware, |
| ), |
| ("XP_MALWARE_REMEDIATED ChatGPT.app", Evidence::Malware), |
| ("denied .plugin-appserver", Evidence::Blocked), |
| ("audit would block ChatGPT.app", Evidence::Audit), |
| ("OSStatus 100024 ChatGPT.app", Evidence::Exhausted), |
| ("not blocked ChatGPT.app", Evidence::Clear), |
| ("denied EMFILE com.example.other", Evidence::Clear), |
| ("EMFILE\nmalware detected ChatGPT.app", Evidence::Malware), |
| ] { |
| assert_eq!(classify_security_events(event), expected, "{event}"); |
| } |
| } |
|
|
| #[test] |
| fn gatekeeper_failures_require_actionable_security_evidence() { |
| for (message, expected) in [ |
| ("ChatGPT.app: rejected", Evidence::Blocked), |
| ("operation not permitted", Evidence::Unavailable), |
| ] { |
| let output = Output { |
| status: ExitStatus::from_raw(1 << 8), |
| stdout: Vec::new(), |
| stderr: message.as_bytes().to_vec(), |
| }; |
| assert_eq!(classify_gatekeeper(Some(&output)), expected); |
| } |
| } |
|
|
| #[test] |
| fn exhaustion_and_unavailable_history_have_actionable_warnings() { |
| for (events, remedy) in [ |
| (Evidence::Exhausted, "restart"), |
| (Evidence::Unavailable, "unified security logs"), |
| ] { |
| let check = enforcement_check(Evidence::Clear, events); |
| assert_eq!(check.status, CheckStatus::Warning); |
| assert!( |
| check |
| .remediation |
| .as_deref() |
| .is_some_and(|value| value.contains(remedy)) |
| ); |
| } |
| } |
|
|
