Merge pull request 'feat(reviewer-workflow): add hard wall against reviewer mutations through alternate profile or CLI side-channel' (#203) from feat/issue-194-reviewer-mutation-boundary into master

tests/conftest.py

@@ -0,0 +1,28 @@
+"""Shared pytest fixtures for the Gitea-Tools test suite."""
+import sys
+
+import pytest
+
+sys.path.insert(0, str(__import__("pathlib").Path(__file__).resolve().parent.parent))
+
+
+@pytest.fixture(autouse=True)
+def _reset_mutation_authority(monkeypatch):
+    """Isolate the in-process mutation authority between tests (#199).
+
+    The mutation-authority gate stays LIVE in every test — this fixture only
+    clears the per-process record and the session profile lock so one test's
+    seeded authority (or an intentionally mismatched one) cannot leak into
+    the next test. It must never replace verify_mutation_authority with a
+    no-op: individual tests that need a specific authority state set it up
+    explicitly.
+    """
+    monkeypatch.delenv("GITEA_SESSION_PROFILE_LOCK", raising=False)
+    try:
+        import mcp_server
+    except Exception:
+        yield
+        return
+    monkeypatch.setattr(mcp_server, "_MUTATION_AUTHORITY", None)
+    monkeypatch.setattr(mcp_server, "_IDENTITY_CACHE", {})
+    yield

tests/test_mcp_server.py

@@ -37,6 +37,8 @@ from mcp_server import (  # noqa: E402
 from gitea_auth import get_profile  # noqa: E402
 import gitea_config  # noqa: E402
 
+import mcp_server
+
 FAKE_AUTH = "Basic dGVzdDp0ZXN0"
 
 
@@ -2296,3 +2298,122 @@ class TestIssueCommentPermissionSeparation(unittest.TestCase):
             "gitea.issue.comment", reviewer["allowed_operations"],
             reviewer.get("forbidden_operations", []))
         self.assertTrue(ok)
+
+
+class TestVerifyMutationAuthority(unittest.TestCase):
+    """In-process mutation authority (#199, refs #194).
+
+    The authority record lives in mcp_server._MUTATION_AUTHORITY (per
+    process, reset between tests by conftest); the CLI side-channel is
+    covered by the GITEA_SESSION_PROFILE_LOCK environment lock. There is no
+    lock file — nothing here touches /tmp.
+    """
+
+    def setUp(self):
+        self.patch_profile = patch("mcp_server.get_profile")
+        self.mock_profile = self.patch_profile.start()
+        self.patch_username = patch("mcp_server._authenticated_username")
+        self.mock_username = self.patch_username.start()
+        self.mock_profile.return_value = {"profile_name": "prgs-reviewer"}
+        self.mock_username.return_value = "sysadmin"
+
+    def tearDown(self):
+        self.patch_profile.stop()
+        self.patch_username.stop()
+
+    def _authority(self, **overrides):
+        data = {
+            "initial_profile": "prgs-reviewer",
+            "initial_identity": "sysadmin",
+            "current_profile": "prgs-reviewer",
+            "current_identity": "sysadmin",
+            "remote": "prgs",
+            "task": "review_pr",
+            "role_pivot_authorized": False,
+            "role_pivot_record": None,
+            "pid": os.getpid(),
+        }
+        data.update(overrides)
+        mcp_server._MUTATION_AUTHORITY = data
+
+    def test_missing_authority_seeds_from_live_context(self):
+        # Approved preflight path (whoami → eligibility → mutation): the
+        # first mutation gate seeds the authority instead of failing closed,
+        # so the standard reviewer workflow keeps working.
+        mcp_server._MUTATION_AUTHORITY = None
+        mcp_server.verify_mutation_authority("prgs")
+        seeded = mcp_server._MUTATION_AUTHORITY
+        self.assertIsNotNone(seeded)
+        self.assertEqual(seeded["current_profile"], "prgs-reviewer")
+        self.assertEqual(seeded["current_identity"], "sysadmin")
+        self.assertEqual(seeded["remote"], "prgs")
+
+    def test_unresolved_profile_fails_closed(self):
+        self.mock_profile.return_value = {}
+        mcp_server._MUTATION_AUTHORITY = None
+        with self.assertRaises(RuntimeError) as ctx:
+            mcp_server.verify_mutation_authority("prgs")
+        self.assertIn("profile unresolved", str(ctx.exception))
+
+    def test_mismatched_remote_fails(self):
+        self._authority(remote="dadeschools")
+        with self.assertRaises(RuntimeError) as ctx:
+            mcp_server.verify_mutation_authority("prgs")
+        self.assertIn("does not match locked remote", str(ctx.exception))
+
+    def test_profile_flip_after_record_fails(self):
+        # Authority was recorded as author; the active profile now resolves
+        # as reviewer (e.g. an env-var flip mid-session) — refuse.
+        self._authority(
+            initial_profile="prgs-author",
+            initial_identity="jcwalker3",
+            current_profile="prgs-author",
+            current_identity="jcwalker3",
+        )
+        with self.assertRaises(RuntimeError) as ctx:
+            mcp_server.verify_mutation_authority("prgs")
+        self.assertIn("does not match locked authority", str(ctx.exception))
+
+    def test_session_lock_env_mismatch_fails(self):
+        # The launching session locked the environment to the author
+        # profile; the active profile resolves as reviewer — side-channel
+        # override rejected even with a matching in-process authority.
+        self._authority()
+        with patch.dict(os.environ,
+                        {"GITEA_SESSION_PROFILE_LOCK": "prgs-author"}):
+            with self.assertRaises(RuntimeError) as ctx:
+                mcp_server.verify_mutation_authority("prgs")
+        self.assertIn("side-channel override rejected", str(ctx.exception))
+
+    def test_foreign_pid_authority_is_not_trusted(self):
+        # An authority record from another process (fork leftovers) is
+        # discarded and reseeded from the live context, never reused.
+        self._authority(current_profile="prgs-author", pid=os.getpid() + 1)
+        mcp_server.verify_mutation_authority("prgs")
+        self.assertEqual(
+            mcp_server._MUTATION_AUTHORITY["current_profile"], "prgs-reviewer"
+        )
+        self.assertEqual(mcp_server._MUTATION_AUTHORITY["pid"], os.getpid())
+
+    def test_author_to_reviewer_pivot_blocked_without_authorization(self):
+        self._authority(
+            initial_profile="prgs-author",
+            initial_identity="jcwalker3",
+        )
+        with self.assertRaises(RuntimeError) as ctx:
+            mcp_server.verify_mutation_authority("prgs", required_role="reviewer")
+        self.assertIn("without authorized role pivot", str(ctx.exception))
+
+    def test_authorized_pivot_is_allowed(self):
+        self._authority(
+            initial_profile="prgs-author",
+            initial_identity="jcwalker3",
+            role_pivot_authorized=True,
+        )
+        mcp_server.verify_mutation_authority("prgs", required_role="reviewer")
+
+    def test_allowed_when_match(self):
+        self._authority()
+        with patch.dict(os.environ,
+                        {"GITEA_SESSION_PROFILE_LOCK": "prgs-reviewer"}):
+            mcp_server.verify_mutation_authority("prgs")

tests/test_review_pr.py

@@ -2,6 +2,8 @@
 
 Mocks api_request and credentials.
 """
+import io
+import os
 import sys
 import unittest
 from unittest.mock import patch
@@ -27,6 +29,11 @@ FAKE_PR_DATA = {
 
 class TestArgParsing(unittest.TestCase):
 
+    def setUp(self):
+        self.exists_patcher = patch("os.path.exists", return_value=False)
+        self.exists_patcher.start()
+        self.addCleanup(self.exists_patcher.stop)
+
     @patch("review_pr.get_auth_header", return_value=FAKE_CREDS)
     def test_missing_pr_number_exits(self, _auth):
         with self.assertRaises(SystemExit):
@@ -35,6 +42,11 @@ class TestArgParsing(unittest.TestCase):
 
 class TestAPIPayload(unittest.TestCase):
 
+    def setUp(self):
+        self.exists_patcher = patch("os.path.exists", return_value=False)
+        self.exists_patcher.start()
+        self.addCleanup(self.exists_patcher.stop)
+
     @patch("review_pr.api_request")
     @patch("review_pr.get_auth_header", return_value=FAKE_CREDS)
     def test_payload_fields_and_workflow(self, _auth, mock_api):
@@ -99,5 +111,55 @@ class TestAPIPayload(unittest.TestCase):
         self.assertIn("gitea_merge_pr", msg)
 
 
+class TestMutationAuthorityLock(unittest.TestCase):
+    """#199 (refs #194): the CLI refuses to run under a profile that differs
+    from the session profile lock exported by the launching MCP session."""
+
+    @patch("review_pr.get_profile")
+    def test_cli_blocked_on_session_lock_mismatch(self, mock_get_profile):
+        # An author-bound session exported the lock; the CLI resolves a
+        # reviewer profile (GITEA_MCP_PROFILE side-channel override) — reject
+        # before any API call.
+        mock_get_profile.return_value = {"profile_name": "prgs-reviewer"}
+        import io
+        buf = io.StringIO()
+        with patch.dict(os.environ,
+                        {"GITEA_SESSION_PROFILE_LOCK": "prgs-author"}), \
+             patch.object(sys, "stderr", buf):
+            rc = review_pr.main([
+                "--pr-number", "81", "--event", "APPROVE",
+            ])
+        self.assertEqual(rc, 3)
+        msg = buf.getvalue().lower()
+        self.assertIn("cli override rejected", msg)
+
+    @patch("review_pr.get_profile")
+    @patch("review_pr.api_request")
+    @patch("review_pr.get_auth_header", return_value=FAKE_CREDS)
+    def test_cli_allowed_on_profile_match(self, _auth, mock_api, mock_get_profile):
+        mock_get_profile.return_value = {"profile_name": "prgs-reviewer"}
+        mock_api.side_effect = [FAKE_PR_DATA, {}]
+        with patch.dict(os.environ,
+                        {"GITEA_SESSION_PROFILE_LOCK": "prgs-reviewer"}):
+            rc = review_pr.main([
+                "--pr-number", "81", "--event", "APPROVE",
+            ])
+        self.assertEqual(rc, 0)
+
+    @patch("review_pr.api_request")
+    @patch("review_pr.get_auth_header", return_value=FAKE_CREDS)
+    def test_cli_allowed_without_session_lock(self, _auth, mock_api):
+        # No lock in the environment = direct operator CLI use; the wall
+        # does not apply and the normal flow proceeds.
+        mock_api.side_effect = [FAKE_PR_DATA, {}]
+        env = {k: v for k, v in os.environ.items()
+               if k != "GITEA_SESSION_PROFILE_LOCK"}
+        with patch.dict(os.environ, env, clear=True):
+            rc = review_pr.main([
+                "--pr-number", "81", "--event", "APPROVE",
+            ])
+        self.assertEqual(rc, 0)
+
+
 if __name__ == "__main__":
     unittest.main()