Delegate privileged authentication to sudo PAM

tests/test_app.py

@@ -0,0 +1,127 @@
+"""Tests for application-level authorization flow."""
+
+from contextlib import contextmanager
+from unittest.mock import Mock
+
+from textual.app import SuspendNotSupported
+
+from src.hosts.tui.app import HostsManagerApp
+
+
+@contextmanager
+def suspended_tui():
+    """Stand in for Textual's terminal suspension in action tests."""
+    yield
+
+
+class TestPrivilegedModeAuthorization:
+    """Test the user-visible privileged-mode authorization flow."""
+
+    def test_interactive_authorization_suspends_and_restores_the_tui(self):
+        """Test foreground PAM authorization runs while Textual is suspended."""
+        events = []
+
+        @contextmanager
+        def suspended_tui():
+            events.append("suspended")
+            yield
+            events.append("restored")
+
+        def authorize_interactively():
+            assert events == ["suspended"]
+            events.append("authorized")
+            return True, "Sudo access granted"
+
+        def finish_entering_edit_mode():
+            assert events == ["suspended", "authorized", "restored"]
+            events.append("edit mode enabled")
+            return True, "Edit mode enabled"
+
+        app = HostsManagerApp()
+        app.manager = Mock()
+        app.manager.enter_edit_mode.return_value = (
+            False,
+            "Interactive authorization required",
+        )
+        app.manager.authorize_interactively.side_effect = authorize_interactively
+        app.manager.finish_entering_edit_mode.side_effect = finish_entering_edit_mode
+        app.suspend = Mock(return_value=suspended_tui())
+        app.update_status = Mock()
+
+        app.action_toggle_edit_mode()
+
+        assert app.edit_mode
+        app.suspend.assert_called_once_with()
+        app.manager.enter_edit_mode.assert_called_once_with()
+        app.manager.authorize_interactively.assert_called_once_with()
+        app.manager.finish_entering_edit_mode.assert_called_once_with()
+        assert events == ["suspended", "authorized", "restored", "edit mode enabled"]
+        app.update_status.assert_called_once_with("Edit mode enabled")
+
+    def test_rejected_authorization_keeps_the_app_read_only(self):
+        """Test a rejected PAM conversation reports the required message."""
+        app = HostsManagerApp()
+        app.manager = Mock()
+        app.manager.enter_edit_mode.return_value = (
+            False,
+            "Interactive authorization required",
+        )
+        app.manager.authorize_interactively.return_value = (
+            False,
+            "Authorization was not granted",
+        )
+        app.suspend = Mock(return_value=suspended_tui())
+        app.update_status = Mock()
+
+        app.action_toggle_edit_mode()
+
+        assert not app.edit_mode
+        app.update_status.assert_called_once_with(
+            "Authorization was not granted; remaining in Read-only Mode."
+        )
+
+    def test_interrupted_authorization_keeps_the_app_read_only(self):
+        """Test interruption during PAM authorization restores read-only mode."""
+        events = []
+
+        @contextmanager
+        def suspended_tui():
+            events.append("suspended")
+            yield
+            events.append("restored")
+
+        app = HostsManagerApp()
+        app.manager = Mock()
+        app.manager.enter_edit_mode.return_value = (
+            False,
+            "Interactive authorization required",
+        )
+        app.manager.authorize_interactively.side_effect = KeyboardInterrupt()
+        app.suspend = Mock(return_value=suspended_tui())
+        app.update_status = Mock()
+
+        app.action_toggle_edit_mode()
+
+        assert not app.edit_mode
+        assert events == ["suspended", "restored"]
+        app.update_status.assert_called_once_with(
+            "Authorization was not granted; remaining in Read-only Mode."
+        )
+
+    def test_unsupported_suspension_keeps_the_app_read_only(self):
+        """Test the user receives an actionable suspension failure message."""
+        app = HostsManagerApp()
+        app.manager = Mock()
+        app.manager.enter_edit_mode.return_value = (
+            False,
+            "Interactive authorization required",
+        )
+        app.suspend = Mock(side_effect=SuspendNotSupported())
+        app.update_status = Mock()
+
+        app.action_toggle_edit_mode()
+
+        assert not app.edit_mode
+        app.update_status.assert_called_once_with(
+            "Interactive authorization requires terminal suspension; remaining in Read-only Mode."
+        )