From 680c4764f898ece380b962f79c463ac20296d76f Mon Sep 17 00:00:00 2001 From: arpan Date: Sat, 12 Sep 2026 01:43:23 +0530 Subject: [PATCH] T182's sentinel could appear in a random id, so it asserted by value The employee number 4471 is four decimal digits, all of them hex digits too, so it appears by chance in a request id or a hash. CI failed the listing on one interpreter of four while the other three passed the same code. The check now walks the document and compares values, which is what it was for: putting claims back into the entry still fails it. --- tests/test_mcp_operator.py | 23 ++++++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-) diff --git a/tests/test_mcp_operator.py b/tests/test_mcp_operator.py index 6ee501e..9034e8b 100644 --- a/tests/test_mcp_operator.py +++ b/tests/test_mcp_operator.py @@ -14,8 +14,10 @@ import threading import urllib.error import urllib.request +from collections.abc import Iterator from datetime import UTC, datetime, timedelta from pathlib import Path +from typing import Any import pytest from click.testing import CliRunner @@ -330,8 +332,27 @@ def test_T182_the_pending_listing_withholds_claim_values(server, control, store) # The whole rendered document, not just the one key: a claim that leaked through some other # field would satisfy the assertion above. + # + # The employee number is checked by value rather than by substring. `4471` is four decimal + # digits, every one of them a hex digit too, so it appears by chance in a request id or a + # hash often enough to fail a correct listing: CI caught it on one interpreter of four while + # the other three passed the same code. The walk below still catches a leak through any + # field, which is what this check is for, and cannot be satisfied by a coincidence. rendered = json.dumps(document) - assert "4471" not in rendered + + def _values(node: Any) -> Iterator[Any]: + if isinstance(node, dict): + for key, value in node.items(): + yield key + yield from _values(value) + elif isinstance(node, list): + for value in node: + yield from _values(value) + else: + yield node + + assert 4471 not in list(_values(document)), "the employee number reached the listing" + assert "4471" not in list(_values(document)), "the employee number reached it as a string" assert "CASE-9" not in rendered assert "employee_no" not in rendered assert "issuer.example" not in rendered