audit-labs/control-coverage

 1"""Tests for loading an evidence corpus from audit-report JSON."""
 2
 3from pathlib import Path
 4
 5import pytest
 6
 7from control_coverage import corpus
 8
 9FIXTURES = Path(__file__).parent / "fixtures"
10GITHUB = FIXTURES / "github_audit_acme_2026-01-01.json"
11AWS = FIXTURES / "aws_audit_acme_2026-01-01.json"
12
13
14def test_one_observation_per_finding_control_pair():
15    obs = corpus.load_report(GITHUB)
16    # 4 findings with 3+3+3+3 controls = 12 observations.
17    assert len(obs) == 12
18
19
20def test_observation_carries_provenance():
21    obs = corpus.load_report(GITHUB)
22    o = next(o for o in obs if o.control == "SOC2:CC6.3")
23    assert o.status == corpus.FAIL
24    assert o.rule_id == "github.org.default-permission"
25    assert o.source == "github_audit_acme_2026-01-01"
26
27
28def test_load_corpus_flattens_multiple_reports():
29    obs = corpus.load_corpus([GITHUB, AWS])
30    sources = {o.source for o in obs}
31    assert sources == {"github_audit_acme_2026-01-01", "aws_audit_acme_2026-01-01"}
32
33
34def test_directory_is_expanded_to_json_files():
35    obs = corpus.load_corpus([FIXTURES])
36    assert len(obs) > 0
37    assert any(o.source.startswith("aws_") for o in obs)
38
39
40def test_empty_directory_raises(tmp_path):
41    with pytest.raises(ValueError, match="no audit-report JSON"):
42        corpus.load_corpus([tmp_path])