hyf

commit 66a4548cbd232e5a4f2f53871c71e1ddc1597095
parent f89b737c3b52ea8b29bdb377ef566f598736a5d4
Author: triesap <tyson@radroots.org>
Date:   Mon, 21 Sep 2026 13:45:57 +0000

provider: test tls verification and endpoint policy

Diffstat:
M
src/hyf_provider/jev_client.mojo
 | 
14
++++++++++++++
M
tests/jev_provider_helper.mojo
 | 
10
++++++++++
M
tests/test_jev.mojo
 | 
27
+++++++++++++++++++++++++++

3 files changed, 51 insertions(+), 0 deletions(-)
diff --git a/src/hyf_provider/jev_client.mojo b/src/hyf_provider/jev_client.mojo
@@ -1,4 +1,5 @@
 from flare.http import HttpClient
+from flare.tls import TlsConfig, TlsVerify
 from json import Value, dumps
 
 
@@ -70,3 +71,16 @@ def post_jev_systemone(
     with HttpClient(timeout_ms=timeout_ms, max_redirects=0) as client:
         var response = client.post(url, dumps(body))
         return JevHttpOutcome(status=response.status, body_text=response.text())
+
+
+def production_tls_config() -> TlsConfig:
+    return TlsConfig()
+
+
+def assert_tls_verification_required(config: TlsConfig) raises:
+    if config.verify != TlsVerify.REQUIRED:
+        raise Error("external provider transport must verify TLS certificates")
+
+
+def redirects_forward_credentials() -> Bool:
+    return False
diff --git a/tests/jev_provider_helper.mojo b/tests/jev_provider_helper.mojo
@@ -137,6 +137,16 @@ def _handle(mut stream: TcpStream, mode: String) raises:
             '{"model":"jev'
         )
         stream.write_all(Span[UInt8, _](truncated.as_bytes()))
+    elif mode == "redirect":
+        var body = ""
+        stream.write_all(
+            Span[UInt8, _](
+                (
+                    "HTTP/1.1 302 Found\r\nlocation: http://127.0.0.1:1/steal\r\n"
+                    "content-length: 0\r\nconnection: close\r\n\r\n"
+                ).as_bytes()
+            )
+        )
     elif mode == "slow":
         usleep(2_000_000)
         _send(stream, 200, _analysis())
diff --git a/tests/test_jev.mojo b/tests/test_jev.mojo
@@ -321,3 +321,30 @@ def test_jev_endpoint_policy_and_loopback_client() raises:
     assert_equal(outcome.status, 200)
     assert_true(outcome.body_text.find("jev-1.13.0") >= 0)
     stub.wait()
+
+
+from flare.tls import TlsVerify
+from flare.tls import TlsConfig
+from hyf_provider.jev_client import (
+    assert_tls_verification_required,
+    production_tls_config,
+    redirects_forward_credentials,
+)
+
+
+def test_tls_and_redirect_policy() raises:
+    var config = production_tls_config()
+    assert_equal(config.verify, TlsVerify.REQUIRED)
+    assert_tls_verification_required(config)
+    with assert_raises():
+        assert_tls_verification_required(TlsConfig.insecure())
+    assert_true(not redirects_forward_credentials())
+
+    var port = reserve_jev_port()
+    var stub = spawn_jev_stub(port, "redirect", 1)
+    with assert_raises():
+        with HttpClient(timeout_ms=5000, max_redirects=0) as client:
+            _ = client.post(
+                "http://127.0.0.1:" + String(port) + "/v1/systemone", "{}"
+            )
+    stub.wait()