From ec3b85ac1bf497f5b6fd3bee900e654dd999eed7 Mon Sep 17 00:00:00 2001 From: didericis Date: Fri, 17 Jul 2026 21:47:36 -0400 Subject: [PATCH] test(egress): set orchestrator URL for entrypoint tests; cover fail-closed guard The egress_entrypoint.sh fail-closed guard (this branch) exits 1 when BOT_BOTTLE_ORCHESTRATOR_URL is unset, which broke the argv-construction tests that ran the script without it. Set the URL in the shared _run_entrypoint helper (a precondition for reaching mitmdump now, like PATH) and add a test asserting the guard fails closed when it's absent. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01UoEZHDjv84ChoZbozQERhJ --- tests/unit/test_egress_entrypoint.py | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/tests/unit/test_egress_entrypoint.py b/tests/unit/test_egress_entrypoint.py index f3faaad..fc0bb12 100644 --- a/tests/unit/test_egress_entrypoint.py +++ b/tests/unit/test_egress_entrypoint.py @@ -42,6 +42,11 @@ def _run_entrypoint(env: dict[str, str]) -> str: shim.chmod(0o755) run_env = { "PATH": f"{shim_dir}:{os.environ['PATH']}", + # Resolver-only egress (PRD 0070): the entrypoint fails closed + # without an orchestrator URL, so it's a precondition for reaching + # the argv construction these tests assert on. Individual tests may + # override it (e.g. to exercise the fail-closed guard). + "BOT_BOTTLE_ORCHESTRATOR_URL": "http://orchestrator:9000", # cat needs to find ca-certificates.crt for the # trust-bundle branch; we don't test that path here. **env, @@ -93,6 +98,18 @@ class TestEgressEntrypointArgv(unittest.TestCase): argv = _run_entrypoint({}) self.assertIn("-s\n/app/egress_addon.py", argv) + def test_missing_orchestrator_url_fails_closed(self): + # Resolver-only egress (PRD 0070): with no policy source the entrypoint + # must refuse to launch mitmdump rather than come up as a bare + # TLS-bumping open proxy. Exits nonzero before any argv is emitted. + result = subprocess.run( + ["sh", str(_SCRIPT)], + capture_output=True, text=True, check=False, + env={"PATH": os.environ["PATH"], "BOT_BOTTLE_ORCHESTRATOR_URL": ""}, + ) + self.assertNotEqual(0, result.returncode) + self.assertIn("BOT_BOTTLE_ORCHESTRATOR_URL is required", result.stderr) + if __name__ == "__main__": unittest.main()