Chris TonjesandClaude Opus 5.5
0c359c926a
Before flipping control-mapping rows, wire the Phase 0 promises that had
no code behind them yet:
- SI-11 / C.5.7.43: app-wide exception handler returns
{"error":"internal_error","request_id":...} and the X-Request-ID header.
Logs exception type + stack frames, not the message — driver errors
echo bound parameters and key values. Engine set to hide_parameters.
- AU-11 / SI-12 (plan §7 risk): create_app refuses to start if any
mapped table lacks a retention policy.
- CM-3: migrations/IMMUTABLE.sha256 pins every merged revision; a test
fails on any edit or on an unpinned new revision.
- migrations/env.py: fileConfig(disable_existing_loggers=False) so
in-process Alembic (the drift test) doesn't silence app loggers.
163 tests passing; ruff, mypy, bandit, gitleaks clean.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
35 lines
1.1 KiB
Python
35 lines
1.1 KiB
Python
"""NIST CM-3: merged migrations never change (CONTRIBUTING rule 1).
|
|
|
|
`migrations/IMMUTABLE.sha256` pins every revision file. Editing a merged
|
|
migration means editing that manifest too — visible in review, and the reason
|
|
belongs in the commit message.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import hashlib
|
|
from pathlib import Path
|
|
|
|
VERSIONS = Path(__file__).resolve().parents[1] / "migrations" / "versions"
|
|
MANIFEST = VERSIONS.parent / "IMMUTABLE.sha256"
|
|
|
|
|
|
def _manifest() -> dict[str, str]:
|
|
out: dict[str, str] = {}
|
|
for line in MANIFEST.read_text().splitlines():
|
|
if line.strip() and not line.startswith("#"):
|
|
digest, name = line.split()
|
|
out[name] = digest
|
|
return out
|
|
|
|
|
|
def test_every_revision_is_pinned() -> None:
|
|
files = {p.name for p in VERSIONS.glob("*.py")}
|
|
assert files - set(_manifest()) == set(), "add new migrations to IMMUTABLE.sha256"
|
|
|
|
|
|
def test_pinned_revisions_unchanged() -> None:
|
|
for name, digest in _manifest().items():
|
|
actual = hashlib.sha256((VERSIONS / name).read_bytes()).hexdigest()
|
|
assert actual == digest, f"{name} changed after merge — add a new revision instead"
|