From 23519a3b54ecb097bf3a3ccb46e2c99bfaca61e4 Mon Sep 17 00:00:00 2001 From: Dhevenddra Date: Thu, 27 Aug 2026 12:53:38 +0530 Subject: [PATCH] test: pin the loopback requirement in the install-denial constants ffb2f03 rewrote SECURITY_MESSAGE_FLAG_GIT_URL and SECURITY_MESSAGE_FLAG_PIP to state both halves of the gate. is_dedicated_install_allowed is `flag AND loopback`, so a message naming only the flag sends a non-loopback user back to re-check a setting they had already enabled. _assert_honest_copy already pins the other load-bearing parts of that copy: the flag name, config.ini, and the absence of security_level phrasings that would misattribute the cause. The loopback half is not pinned, so a later edit can drop it again without failing a test. Assert it alongside the existing checks. Verified against main: the suite passes unchanged, and removing the loopback wording from either constant fails the new assertion. --- tests/test_install_flags_gates.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/tests/test_install_flags_gates.py b/tests/test_install_flags_gates.py index 1dcac1abf..3935cb0c6 100644 --- a/tests/test_install_flags_gates.py +++ b/tests/test_install_flags_gates.py @@ -374,6 +374,10 @@ class DenialConstantsTest(unittest.TestCase): def _assert_honest_copy(self, const, flag_name): self.assertIn(flag_name, const, "constant must name the responsible flag") self.assertIn("config.ini", const, "constant must name config.ini") + # The gate is `flag AND loopback` (is_dedicated_install_allowed), so a + # message that stops at the flag sends non-loopback users to re-check a + # setting they already enabled. + self.assertIn("loopback", const, "constant must name the loopback requirement") for cause_phrasing in ( "is not allowed in this security_level", "set the security level",