[verified] Add privacy and branding audit harness

script/privacy_audit_test.sh

@@ -0,0 +1,114 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+AUDIT="$SCRIPT_DIR/privacy_audit"
+ROOT=$(mktemp -d "${TMPDIR:-/tmp}/privacy-audit-test.XXXXXX")
+OUTSIDE=$(mktemp "${TMPDIR:-/tmp}/privacy-audit-outside.XXXXXX")
+OUTSIDE_DIR=$(mktemp -d "${TMPDIR:-/tmp}/privacy-audit-outside-dir.XXXXXX")
+TRACKED_ROOT=$(mktemp -d "${TMPDIR:-/tmp}/privacy-audit-tracked.XXXXXX")
+trap 'rm -rf "$ROOT" "$OUTSIDE" "$OUTSIDE_DIR" "$TRACKED_ROOT"' EXIT
+
+fail() {
+  printf 'FAIL: %s\n' "$1" >&2
+  exit 1
+}
+
+[ -x "$AUDIT" ] || fail 'privacy audit script missing or not executable'
+
+mkdir -p "$ROOT/app" "$ROOT/docs"
+printf '%s\n' 'https://hub.2.chatwoot.com/ping' > "$ROOT/app/forbidden.txt"
+
+set +e
+output=$(
+  python3 "$AUDIT" --root "$ROOT" 2>&1
+)
+status=$?
+set -e
+[ "$status" -ne 0 ] || fail 'forbidden URL must fail the audit'
+printf '%s\n' "${output}" | grep -F 'app/forbidden.txt:1:hub-url' >/dev/null || fail 'audit did not report the forbidden file and line'
+rm "$ROOT/app/forbidden.txt"
+
+printf '%s\n' 'docs/audit-record.md' > "$ROOT/allowlist.txt"
+printf '%s\n' 'https://hub.2.chatwoot.com/ping' > "$ROOT/docs/audit-record.md"
+python3 "$AUDIT" --root "$ROOT" --allowlist-file "$ROOT/allowlist.txt" >/dev/null || fail 'explicitly allowlisted audit document must pass'
+
+printf '%s\n' 'https://hub.2.chatwoot.com/ping' > "$OUTSIDE"
+set +e
+outside_allowlist_status=$(python3 "$AUDIT" --root "$ROOT" --allowlist-file "$OUTSIDE" >/dev/null 2>&1)
+outside_allowlist_exit=$?
+set -e
+[ "$outside_allowlist_exit" -eq 2 ] || fail 'allowlist outside root must return configuration error status 2'
+rm "$ROOT/docs/audit-record.md"
+ln -s "$OUTSIDE" "$ROOT/app/outside-link"
+set +e
+symlink_status=$(python3 "$AUDIT" --root "$ROOT" >/dev/null 2>&1)
+symlink_exit=$?
+set -e
+[ "$symlink_exit" -eq 0 ] || fail 'audit must not follow a symlink outside the root'
+
+mkdir -p "$ROOT/public"
+printf '%s\n' 'https://hub.2.chatwoot.com/ping' > "$OUTSIDE_DIR/bad.js"
+ln -s "$OUTSIDE_DIR" "$ROOT/public/vite"
+set +e
+built_symlink_output=$(python3 "$AUDIT" --root "$ROOT" 2>&1)
+built_symlink_exit=$?
+set -e
+[ "$built_symlink_exit" -eq 0 ] || fail 'audit must not traverse a symlinked built-artifact directory'
+
+mkdir -p "$ROOT/public/assets"
+printf '%s\n' 'https://hub.2.chatwoot.com/ping' > "$ROOT/public/assets/bundle.js"
+set +e
+built_output=$(python3 "$AUDIT" --root "$ROOT" 2>&1)
+built_exit=$?
+set -e
+[ "$built_exit" -ne 0 ] || fail 'audit must scan a real built artifact'
+printf '%s\n' "$built_output" | grep -F 'public/assets/bundle.js:1:hub-url' >/dev/null || fail 'audit did not report the built artifact finding'
+rm "$ROOT/public/assets/bundle.js"
+
+printf 'binary\0https://hub.2.chatwoot.com/ping\n' > "$ROOT/app/binary.dat"
+set +e
+binary_output=$(python3 "$AUDIT" --root "$ROOT" >/dev/null 2>&1)
+binary_status=$?
+set -e
+[ "$binary_status" -eq 0 ] || fail 'binary files must be skipped without failing the audit'
+rm "$ROOT/app/binary.dat"
+
+mkdir -p "$TRACKED_ROOT/app"
+git -C "$TRACKED_ROOT" init -q
+printf '%s\n' 'https://hub.2.chatwoot.com/ping' > "$OUTSIDE_DIR/tracked.js"
+ln -s "$OUTSIDE_DIR" "$TRACKED_ROOT/app/generated"
+git -C "$TRACKED_ROOT" add app/generated
+set +e
+tracked_symlink_output=$(python3 "$AUDIT" --root "$TRACKED_ROOT" 2>&1)
+tracked_symlink_exit=$?
+set -e
+[ "$tracked_symlink_exit" -eq 0 ] || fail 'audit must ignore tracked symlinks escaping the root'
+
+rm "$ROOT/app/outside-link"
+printf '%s\n' 'https://hub.2.chatwoot.com/ping' > "$ROOT/app/forbidden.txt"
+printf '%s\n' '../app/forbidden.txt' > "$ROOT/invalid-allowlist.txt"
+set +e
+invalid_allowlist_output=$(python3 "$AUDIT" --root "$ROOT" --allowlist-file "$ROOT/invalid-allowlist.txt" 2>&1)
+invalid_allowlist_exit=$?
+set -e
+[ "$invalid_allowlist_exit" -eq 2 ] || fail 'non-relative allowlist entries must return configuration error status 2'
+
+set +e
+report_output=$(
+  python3 "$AUDIT" --root "$ROOT" --report-only 2>&1
+)
+report_status=$?
+set -e
+[ "$report_status" -eq 0 ] || fail 'report-only mode must not fail on known findings'
+printf '%s\n' "$report_output" | grep -F 'app/forbidden.txt:1:hub-url' >/dev/null || fail 'report-only mode did not report the finding'
+
+REPO_ROOT=$(CDPATH= cd -- "$SCRIPT_DIR/.." && pwd)
+set +e
+repo_report=$(python3 "$AUDIT" --root "$REPO_ROOT" --report-only 2>&1)
+repo_status=$?
+set -e
+[ "$repo_status" -eq 0 ] || fail 'report-only mode must scan a git repository without crashing'
+printf '%s\n' "$repo_report" | grep -F 'privacy_audit: REPORT-ONLY' >/dev/null || fail 'git-root report-only summary missing'
+
+printf 'PASS: privacy audit harness\n'