my-pal-mcp-server/tests/test_docker_security.py

"""
Tests for Docker security configuration and best practices
"""

import os
from pathlib import Path
from unittest.mock import patch

import pytest


class TestDockerSecurity:
    """Test Docker security configuration"""

    @pytest.fixture(autouse=True)
    def setup(self):
        """Setup for each test"""
        self.project_root = Path(__file__).parent.parent
        self.dockerfile_path = self.project_root / "Dockerfile"
        self.compose_path = self.project_root / "docker-compose.yml"

    def test_non_root_user_configuration(self):
        """Test that container runs as non-root user"""
        if not self.dockerfile_path.exists():
            pytest.skip("Dockerfile not found")

        content = self.dockerfile_path.read_text()

        # Check for user creation or switching
        user_indicators = ["USER " in content, "useradd" in content, "adduser" in content, "RUN addgroup" in content]

        assert any(user_indicators), "Container should run as non-root user"

    def test_no_unnecessary_privileges(self):
        """Test that container doesn't request unnecessary privileges"""
        if not self.compose_path.exists():
            pytest.skip("docker-compose.yml not found")

        content = self.compose_path.read_text()

        # Check that dangerous options are not used
        dangerous_options = ["privileged: true", "--privileged", "cap_add:", "SYS_ADMIN"]

        for option in dangerous_options:
            assert option not in content, f"Dangerous option {option} should not be used"

    def test_read_only_filesystem(self):
        """Test read-only filesystem configuration where applicable"""
        if not self.compose_path.exists():
            pytest.skip("docker-compose.yml not found")

        content = self.compose_path.read_text()

        # Check for read-only configurations
        if "read_only:" in content:
            assert "read_only: true" in content, "Read-only filesystem should be properly configured"

    def test_environment_variable_security(self):
        """Test secure handling of environment variables"""
        # Ensure sensitive data is not hardcoded
        sensitive_patterns = ["password", "secret", "key", "token"]

        for file_path in [self.dockerfile_path, self.compose_path]:
            if not file_path.exists():
                continue

            content = file_path.read_text().lower()

            # Check that we don't have hardcoded secrets
            for pattern in sensitive_patterns:
                # Allow variable names but not actual values
                lines = content.split("\n")
                for line in lines:
                    if f"{pattern}=" in line and not line.strip().startswith("#"):
                        # Check if it looks like a real value vs variable name
                        if '"' in line or "'" in line:
                            value_part = line.split("=")[1].strip()
                            if len(value_part) > 10 and not value_part.startswith("$"):
                                pytest.fail(f"Potential hardcoded secret in {file_path}: {line.strip()}")

    def test_network_security(self):
        """Test network security configuration"""
        if not self.compose_path.exists():
            pytest.skip("docker-compose.yml not found")

        content = self.compose_path.read_text()

        # Check for custom network (better than default bridge)
        if "networks:" in content:
            assert (
                "driver: bridge" in content or "external:" in content
            ), "Custom networks should use bridge driver or be external"

    def test_volume_security(self):
        """Test volume security configuration"""
        if not self.compose_path.exists():
            pytest.skip("docker-compose.yml not found")

        content = self.compose_path.read_text()

        # Check that sensitive host paths are not mounted
        dangerous_mounts = ["/:/", "/var/run/docker.sock:", "/etc/passwd:", "/etc/shadow:", "/root:"]

        for mount in dangerous_mounts:
            assert mount not in content, f"Dangerous mount {mount} should not be used"

    def test_secret_management(self):
        """Test that secrets are properly managed"""
        # Check for Docker secrets usage in compose file
        if self.compose_path.exists():
            content = self.compose_path.read_text()

            # If secrets are used, they should be properly configured
            if "secrets:" in content:
                assert "external: true" in content or "file:" in content, "Secrets should be external or file-based"

    def test_container_capabilities(self):
        """Test container capabilities are properly restricted"""
        if not self.compose_path.exists():
            pytest.skip("docker-compose.yml not found")

        content = self.compose_path.read_text()

        # Check for capability restrictions
        if "cap_drop:" in content:
            assert "ALL" in content, "Should drop all capabilities by default"

        # If capabilities are added, they should be minimal
        if "cap_add:" in content:
            dangerous_caps = ["SYS_ADMIN", "NET_ADMIN", "SYS_PTRACE"]
            for cap in dangerous_caps:
                assert cap not in content, f"Dangerous capability {cap} should not be added"


class TestDockerSecretsHandling:
    """Test Docker secrets and API key handling"""

    def test_env_file_not_in_image(self):
        """Test that .env files are not copied into Docker image"""
        project_root = Path(__file__).parent.parent
        dockerfile = project_root / "Dockerfile"

        if dockerfile.exists():
            content = dockerfile.read_text()

            # .env files should not be copied
            assert "COPY .env" not in content, ".env file should not be copied into image"

    def test_dockerignore_for_sensitive_files(self):
        """Test that .dockerignore excludes sensitive files"""
        project_root = Path(__file__).parent.parent
        dockerignore = project_root / ".dockerignore"

        if dockerignore.exists():
            content = dockerignore.read_text()

            sensitive_files = [".env", "*.key", "*.pem", ".git"]

            for file_pattern in sensitive_files:
                if file_pattern not in content:
                    # Warning rather than failure for flexibility
                    import warnings

                    warnings.warn(f"Consider adding {file_pattern} to .dockerignore", UserWarning, stacklevel=2)

    @patch.dict(os.environ, {}, clear=True)
    def test_no_default_api_keys(self):
        """Test that no default API keys are present"""
        # Ensure no API keys are set by default
        api_key_vars = ["GEMINI_API_KEY", "OPENAI_API_KEY", "XAI_API_KEY", "ANTHROPIC_API_KEY"]

        for var in api_key_vars:
            assert os.getenv(var) is None, f"{var} should not have a default value"

    def test_api_key_format_validation(self):
        """Test API key format validation if implemented"""
        # Test cases for API key validation
        test_cases = [
            {"key": "", "valid": False},
            {"key": "test", "valid": False},  # Too short
            {"key": "sk-" + "x" * 40, "valid": True},  # OpenAI format
            {"key": "AIza" + "x" * 35, "valid": True},  # Google format
        ]

        for case in test_cases:
            # This would test actual validation if implemented
            # For now, just check the test structure
            assert isinstance(case["valid"], bool)
            assert isinstance(case["key"], str)


class TestDockerComplianceChecks:
    """Test Docker configuration compliance with security standards"""

    def test_dockerfile_best_practices(self):
        """Test Dockerfile follows security best practices"""
        project_root = Path(__file__).parent.parent
        dockerfile = project_root / "Dockerfile"

        if not dockerfile.exists():
            pytest.skip("Dockerfile not found")

        content = dockerfile.read_text()

        # Check for multi-stage builds (reduces attack surface)
        if "FROM" in content:
            from_count = content.count("FROM")
            if from_count > 1:
                assert "AS" in content, "Multi-stage builds should use named stages"

        # Check for specific user ID (better than name-only)
        if "USER" in content:
            user_lines = [line for line in content.split("\n") if line.strip().startswith("USER")]
            for line in user_lines:
                # Could be improved to check for numeric UID
                assert len(line.strip()) > 5, "USER directive should be specific"

    def test_container_security_context(self):
        """Test container security context configuration"""
        project_root = Path(__file__).parent.parent
        compose_file = project_root / "docker-compose.yml"

        if compose_file.exists():
            content = compose_file.read_text()

            # Check for security context if configured
            security_options = ["security_opt:", "no-new-privileges:", "read_only:"]

            # At least one security option should be present
            security_configured = any(opt in content for opt in security_options)

            if not security_configured:
                import warnings

                warnings.warn("Consider adding security options to docker-compose.yml", UserWarning, stacklevel=2)