mcp-forge/tests/builder/test_package_validator.py

"""Tests for Package Validator module."""

import pytest
from unittest.mock import Mock

from mcp_forge.builder.package_validator import (
    PackageValidator,
    ApprovalRequiredError,
    SecurityError
)
from mcp_forge.config.schema import PackageValidationConfig


@pytest.fixture
def allowlist_file(tmp_path):
    """Create temporary allowlist file."""
    allowlist = tmp_path / "allowlist.txt"
    allowlist.write_text("""
# Standard data science packages
numpy
pandas
scipy
scikit-learn
matplotlib

# Web and API
requests
httpx
aiohttp

# Utilities
pyyaml
python-dateutil
    """.strip())
    return allowlist


@pytest.fixture
def blocklist_file(tmp_path):
    """Create temporary blocklist file."""
    blocklist = tmp_path / "blocklist.txt"
    blocklist.write_text("""
# Security concerns
os-crypto
subprocess-wrapper
shell-exec

# Known malicious
malicious-package
evil-lib
    """.strip())
    return blocklist


@pytest.fixture
def validation_config(allowlist_file, blocklist_file, tmp_path):
    """Mock PackageValidationConfig."""
    config = Mock(spec=PackageValidationConfig)
    config.use_allowlist = True
    config.allowlist_path = allowlist_file
    config.blocklist_path = blocklist_file
    config.require_approval_patterns = [
        "^torch.*",  # PyTorch packages
        "^tensorflow.*",  # TensorFlow packages
        ".*-gpu$",  # GPU variants
    ]
    return config


@pytest.fixture
def validator(validation_config):
    """PackageValidator instance."""
    return PackageValidator(validation_config)


def test_extract_package_name_simple(validator):
    """Test extracting package name from simple spec."""
    assert validator.extract_package_name("numpy") == "numpy"
    assert validator.extract_package_name("pandas") == "pandas"


def test_extract_package_name_with_version(validator):
    """Test extracting package name with version specifiers."""
    assert validator.extract_package_name("numpy>=1.24.0") == "numpy"
    assert validator.extract_package_name("pandas==2.0.0") == "pandas"
    assert validator.extract_package_name("requests<=2.28.0") == "requests"
    assert validator.extract_package_name("scikit-learn~=1.3.0") == "scikit-learn"


def test_extract_package_name_with_extras(validator):
    """Test extracting package name with extras."""
    assert validator.extract_package_name("requests[security]") == "requests"
    assert validator.extract_package_name("pandas[excel,sql]") == "pandas"


def test_extract_package_name_complex(validator):
    """Test extracting package name from complex specs."""
    assert validator.extract_package_name("numpy>=1.24.0,<2.0.0") == "numpy"
    assert validator.extract_package_name("requests[security]>=2.28.0") == "requests"


def test_allowlisted_package_passes(validator):
    """Test that allowlisted packages pass validation."""
    validator.validate_package("numpy")
    validator.validate_package("pandas>=2.0.0")
    validator.validate_package("requests[security]")
    # Should not raise


def test_blocklisted_package_raises_error(validator):
    """Test that blocklisted packages raise SecurityError."""
    with pytest.raises(SecurityError, match="malicious-package"):
        validator.validate_package("malicious-package")
    
    with pytest.raises(SecurityError, match="evil-lib"):
        validator.validate_package("evil-lib>=1.0.0")


def test_unknown_package_with_allowlist_raises_error(validator):
    """Test that unknown packages raise error when allowlist is enabled."""
    with pytest.raises(SecurityError, match="unknown-package"):
        validator.validate_package("unknown-package")


def test_package_requiring_approval_raises_error(validator):
    """Test that packages matching approval patterns raise ApprovalRequiredError."""
    with pytest.raises(ApprovalRequiredError, match="torch"):
        validator.validate_package("torch")
    
    with pytest.raises(ApprovalRequiredError, match="tensorflow"):
        validator.validate_package("tensorflow-gpu")
    
    with pytest.raises(ApprovalRequiredError, match="gpu"):
        validator.validate_package("cupy-gpu")


def test_validate_packages_list(validator):
    """Test validating multiple packages at once."""
    packages = ["numpy>=1.24.0", "pandas", "requests"]
    validator.validate_packages(packages)
    # Should not raise


def test_validate_packages_enforces_max_limit(validator):
    """Test that validate_packages enforces maximum package count."""
    packages = ["numpy", "pandas", "scipy", "matplotlib"]
    
    with pytest.raises(ValueError, match="Maximum 3 packages"):
        validator.validate_packages(packages, max_packages=3)


def test_validate_packages_with_mixed_results(validator):
    """Test that validation stops at first error."""
    packages = ["numpy", "malicious-package", "pandas"]
    
    with pytest.raises(SecurityError, match="malicious-package"):
        validator.validate_packages(packages)


def test_validate_packages_with_approval_required(validator):
    """Test that validation stops at first approval requirement."""
    packages = ["numpy", "torch", "pandas"]
    
    with pytest.raises(ApprovalRequiredError, match="torch"):
        validator.validate_packages(packages)


def test_allowlist_loading(allowlist_file):
    """Test that allowlist is loaded correctly from file."""
    config = Mock(spec=PackageValidationConfig)
    config.use_allowlist = True
    config.allowlist_path = allowlist_file
    config.blocklist_path = None
    config.require_approval_patterns = []
    
    validator = PackageValidator(config)
    
    assert "numpy" in validator.allowlist
    assert "pandas" in validator.allowlist
    assert "requests" in validator.allowlist
    # Comments and empty lines should be ignored
    assert "# Standard data science packages" not in validator.allowlist


def test_blocklist_loading(blocklist_file):
    """Test that blocklist is loaded correctly from file."""
    config = Mock(spec=PackageValidationConfig)
    config.use_allowlist = False
    config.allowlist_path = None
    config.blocklist_path = blocklist_file
    config.require_approval_patterns = []
    
    validator = PackageValidator(config)
    
    assert "malicious-package" in validator.blocklist
    assert "evil-lib" in validator.blocklist


def test_disabled_allowlist_allows_all_except_blocklist(blocklist_file):
    """Test that disabling allowlist allows any package except blocklisted."""
    config = Mock(spec=PackageValidationConfig)
    config.use_allowlist = False
    config.allowlist_path = None
    config.blocklist_path = blocklist_file
    config.require_approval_patterns = []
    
    validator = PackageValidator(config)
    
    # Unknown packages should pass
    validator.validate_package("some-random-package")
    
    # But blocklisted packages should still fail
    with pytest.raises(SecurityError, match="malicious-package"):
        validator.validate_package("malicious-package")


def test_approval_pattern_matching(validator):
    """Test that approval patterns match correctly."""
    # torch* should match
    with pytest.raises(ApprovalRequiredError):
        validator.validate_package("torch")
    
    with pytest.raises(ApprovalRequiredError):
        validator.validate_package("torchvision")
    
    # *-gpu$ should match
    with pytest.raises(ApprovalRequiredError):
        validator.validate_package("something-gpu")


def test_empty_package_list(validator):
    """Test validating empty package list."""
    validator.validate_packages([])
    # Should not raise


def test_validate_packages_without_max_limit(validator):
    """Test validating many packages without limit."""
    packages = [f"package{i}" for i in range(100)]
    
    # Should raise because packages aren't in allowlist
    with pytest.raises(SecurityError):
        validator.validate_packages(packages)


def test_case_sensitivity(validator):
    """Test that package names are case-sensitive."""
    # numpy is in allowlist
    validator.validate_package("numpy")
    
    # NumPy (different case) should fail
    with pytest.raises(SecurityError, match="NumPy"):
        validator.validate_package("NumPy")


def test_whitespace_handling(validator):
    """Test that leading/trailing whitespace is handled."""
    validator.validate_package(" numpy ")
    validator.validate_package("  pandas>=2.0.0  ")


def test_file_not_found_handling(tmp_path):
    """Test handling of missing allowlist/blocklist files."""
    config = Mock(spec=PackageValidationConfig)
    config.use_allowlist = True
    config.allowlist_path = tmp_path / "nonexistent.txt"
    config.blocklist_path = None
    config.require_approval_patterns = []
    
    with pytest.raises(FileNotFoundError):
        PackageValidator(config)