9331fc6eac
Add 29 new tests across auth/, crypt/, and trust/ packages: - auth: concurrent sessions, token uniqueness, challenge expiry boundary, empty password, long/unicode usernames, air-gapped round-trip, expired refresh - crypt: wrong passphrase, empty/large plaintext, KDF determinism, HKDF info separation, checksum edge cases - trust: concurrent registry operations, tier validation, token expiry boundary, empty ScopedRepos behaviour, unknown capabilities Add benchmark suites: - crypt: Argon2, ChaCha20, AES-GCM, HMAC (1KB/1MB payloads) - trust: PolicyEvaluate (100 agents), RegistryGet, RegistryRegister Security audit documented in FINDINGS.md: - F1: LTHN hash used for password verification (medium) - F2: PGP private keys not zeroed after use (low, upstream limitation) - F3: Empty ScopedRepos bypasses repo scope check (medium) - F4: go vet clean, no math/rand, no secrets in error messages All tests pass with -race. go vet clean. Co-Authored-By: Virgil <virgil@lethean.io> Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
69 lines
1.5 KiB
Go
69 lines
1.5 KiB
Go
package trust
|
|
|
|
import (
|
|
"fmt"
|
|
"testing"
|
|
)
|
|
|
|
// BenchmarkPolicyEvaluate measures policy evaluation across 100 registered agents.
|
|
func BenchmarkPolicyEvaluate(b *testing.B) {
|
|
r := NewRegistry()
|
|
for i := 0; i < 100; i++ {
|
|
tier := TierUntrusted
|
|
switch i % 3 {
|
|
case 0:
|
|
tier = TierFull
|
|
case 1:
|
|
tier = TierVerified
|
|
}
|
|
_ = r.Register(Agent{
|
|
Name: fmt.Sprintf("agent-%d", i),
|
|
Tier: tier,
|
|
ScopedRepos: []string{"host-uk/core", "host-uk/docs"},
|
|
})
|
|
}
|
|
pe := NewPolicyEngine(r)
|
|
|
|
caps := []Capability{
|
|
CapPushRepo, CapCreatePR, CapMergePR, CapCommentIssue,
|
|
CapCreateIssue, CapReadSecrets, CapRunPrivileged,
|
|
CapAccessWorkspace, CapModifyFlows,
|
|
}
|
|
|
|
b.ResetTimer()
|
|
for i := 0; i < b.N; i++ {
|
|
agentName := fmt.Sprintf("agent-%d", i%100)
|
|
cap := caps[i%len(caps)]
|
|
_ = pe.Evaluate(agentName, cap, "host-uk/core")
|
|
}
|
|
}
|
|
|
|
// BenchmarkRegistryGet measures agent lookup performance.
|
|
func BenchmarkRegistryGet(b *testing.B) {
|
|
r := NewRegistry()
|
|
for i := 0; i < 100; i++ {
|
|
_ = r.Register(Agent{
|
|
Name: fmt.Sprintf("agent-%d", i),
|
|
Tier: TierVerified,
|
|
})
|
|
}
|
|
|
|
b.ResetTimer()
|
|
for i := 0; i < b.N; i++ {
|
|
name := fmt.Sprintf("agent-%d", i%100)
|
|
_ = r.Get(name)
|
|
}
|
|
}
|
|
|
|
// BenchmarkRegistryRegister measures agent registration performance.
|
|
func BenchmarkRegistryRegister(b *testing.B) {
|
|
r := NewRegistry()
|
|
|
|
b.ResetTimer()
|
|
for i := 0; i < b.N; i++ {
|
|
_ = r.Register(Agent{
|
|
Name: fmt.Sprintf("bench-agent-%d", i),
|
|
Tier: TierVerified,
|
|
})
|
|
}
|
|
}
|