From e04d7868404783a90578607815bd5e13878b55b5 Mon Sep 17 00:00:00 2001 From: Don Garrett Date: Mon, 7 Sep 2026 20:16:18 +0000 Subject: [PATCH] Assert the live Matrix tests run as a testing identity Two invariants only a live homeserver can check, now enforced rather than verified by hand: - The configured NISSE_MATRIX_USER_ID must be the token's real owner. MatrixTransport filters its own messages by comparing sender to that value, so a mismatch would make the bot read its own posts as operator input. - The account must be a testing identity, so a stray live run can never act as the production agent. Both hold today; this keeps them holding when the production nisse-dev account is created. Co-Authored-By: Claude Opus 5 --- tests/integration/test_matrix_live.py | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/tests/integration/test_matrix_live.py b/tests/integration/test_matrix_live.py index e835d4b..1bf8922 100644 --- a/tests/integration/test_matrix_live.py +++ b/tests/integration/test_matrix_live.py @@ -33,6 +33,27 @@ pytestmark = [ ] +def _assert_testing_identity(transport: MatrixTransport, config: MatrixConfig) -> None: + """Two invariants that only a live homeserver can check. + + The configured user id must be the token's real owner, because the + transport filters its own messages by comparing sender to that value — + a mismatch would make the bot read its own posts as operator input. + And tests must run as a testing identity, so a stray live run can never + act as the production agent. + """ + whoami = transport._http.get("/account/whoami") + whoami.raise_for_status() + actual = whoami.json()["user_id"] + assert actual == config.user_id, ( + f"NISSE_MATRIX_USER_ID is {config.user_id} but the token belongs to " + f"{actual}; the self-message filter would not match" + ) + assert "testing" in actual, ( + f"live tests must run as a testing identity, not {actual}" + ) + + def test_send_lands_in_test_room() -> None: missing = [var for var in ALSO_REQUIRED if not os.environ.get(var)] assert not missing, ( @@ -43,6 +64,7 @@ def test_send_lands_in_test_room() -> None: marker = f"transport smoke test {uuid.uuid4().hex}" transport = MatrixTransport(config) try: + _assert_testing_identity(transport, config) transport.send_message(marker) response = transport._http.get( f"/rooms/{config.room_id}/messages", -- 2.54.0