audit-labs/control-coverage

Control coverage and blind-spot analysis for audit evidence.
clone: git clone https://gitbay.org/audit-labs/control-coverage.git
v1.0.0: tests/test_crosswalk.py · raw
 1"""Tests for the evidence crosswalk and minimal-evidence set."""
 2
 3import json
 4from pathlib import Path
 5
 6from control_coverage import catalog, corpus, crosswalk
 7from control_coverage.coverage import evaluate
 8
 9FIXTURES = Path(__file__).parent / "fixtures"
10GITHUB = FIXTURES / "github_audit_acme_2026-01-01.json"
11AWS = FIXTURES / "aws_audit_acme_2026-01-01.json"
12
13
14def _crosswalk(frameworks):
15    obs = corpus.load_corpus([GITHUB, AWS])
16    cats = catalog.load_frameworks(frameworks)
17    return crosswalk.build(evaluate(cats, obs))
18
19
20def test_item_spans_multiple_frameworks():
21    xw = _crosswalk(["SOC2", "ISO", "NIST"])
22    twofa = next(i for i in xw.items if i.rule_id == "github.org.require-2fa")
23    # 2FA maps to SOC2:CC6.1, ISO:A.5.17, NIST:IA-2.
24    assert set(twofa.frameworks) == {"SOC2", "ISO", "NIST"}
25    assert "SOC2:CC6.1" in twofa.controls
26
27
28def test_items_sorted_by_leverage():
29    xw = _crosswalk(["SOC2", "ISO", "NIST"])
30    counts = [i.count for i in xw.items]
31    assert counts == sorted(counts, reverse=True)
32
33
34def test_minimal_cover_reaches_full_universe():
35    xw = _crosswalk(["SOC2", "ISO", "NIST"])
36    assert xw.cover  # non-empty
37    assert xw.cover[-1].cumulative == xw.universe_size
38    assert xw.cover[-1].cumulative_pct == 100.0
39
40
41def test_cover_is_monotonic_and_no_wasted_picks():
42    xw = _crosswalk(["SOC2"])
43    cumulative = [s.cumulative for s in xw.cover]
44    assert cumulative == sorted(cumulative)
45    assert all(s.new_controls > 0 for s in xw.cover)  # greedy never picks a no-op
46
47
48def test_markdown_has_both_sections():
49    md = crosswalk.render_markdown(_crosswalk(["SOC2", "ISO"]))
50    assert "## Minimal evidence set" in md
51    assert "## Evidence leverage" in md
52    assert "github.org.require-2fa" in md
53
54
55def test_json_structure():
56    doc = json.loads(crosswalk.render_json(_crosswalk(["SOC2", "ISO"])))
57    assert doc["universe_size"] > 0
58    assert "minimal_evidence_set" in doc
59    assert all("controls" in e for e in doc["evidence"])
60
61
62def test_html_is_self_contained():
63    html = crosswalk.render_html(_crosswalk(["SOC2", "ISO", "NIST"]))
64    assert html.startswith("<!doctype html>")
65    assert "<style>" in html
66    assert "http://" not in html and "https://" not in html
67    assert "github.org.require-2fa" in html