audit-labs/control-coverage

Control coverage and blind-spot analysis for audit evidence.
clone: git clone https://gitbay.org/audit-labs/control-coverage.git
v1.0.0: tests/test_reporters.py · raw
 1"""Tests for the Markdown, HTML, JSON, and SoA renderers."""
 2
 3import json as _json
 4from pathlib import Path
 5
 6from control_coverage import catalog, corpus, reporters, scope
 7from control_coverage.coverage import evaluate
 8
 9FIXTURES = Path(__file__).parent / "fixtures"
10
11
12def _report():
13    obs = corpus.load_corpus([FIXTURES / "github_audit_acme_2026-01-01.json"])
14    cats = catalog.load_frameworks(["SOC2"])
15    scp = scope.load(FIXTURES / "scope.yaml")
16    return evaluate(cats, obs, scope=scp, subject="Acme", generated_at="2026-01-01")
17
18
19def test_markdown_has_summary_and_blind_spots():
20    md = reporters.render(_report(), "md")
21    assert "# Control Coverage — Acme" in md
22    assert "## Summary" in md
23    assert "## Blind spots" in md
24    assert "CC1.1" in md  # a blind spot is listed
25
26
27def test_json_is_valid_and_structured():
28    doc = _json.loads(reporters.render(_report(), "json"))
29    assert doc["subject"] == "Acme"
30    soc2 = doc["frameworks"][0]
31    assert soc2["framework"] == "SOC2"
32    assert soc2["coverage_pct"] >= 0
33    states = {c["state"] for c in soc2["controls"]}
34    assert "unaddressed" in states
35
36
37def test_json_stamps_tool_and_catalog_provenance():
38    from control_coverage import __version__
39
40    doc = _json.loads(reporters.render(_report(), "json"))
41    assert doc["tool"] == {"name": "control-coverage", "version": __version__}
42    soc2 = doc["frameworks"][0]
43    assert len(soc2["sha256"]) == 64  # full SHA-256 hex digest of the catalog file
44
45
46def test_html_is_self_contained():
47    html = reporters.render(_report(), "html")
48    assert html.startswith("<!doctype html>")
49    assert "<style>" in html
50    assert "http://" not in html and "https://" not in html  # no external assets
51
52
53def test_soa_lists_applicability_and_status():
54    soa = reporters.render(_report(), "soa")
55    assert "Statement of Applicability" in soa
56    assert "Applicable" in soa
57    assert "Implemented" in soa or "Not evidenced" in soa
58
59
60def test_unknown_format_raises():
61    import pytest
62
63    with pytest.raises(ValueError, match="unknown format"):
64        reporters.render(_report(), "pdf")