release: prepare v0.9.7

backend/tests/mesh/test_s7a_dm_middleware_tier.py

@@ -0,0 +1,57 @@
+"""Wormhole DM middleware tier alignment.
+
+Tests:
+- Wormhole DM routes resolve to private_control_only
+- Gate compose/decrypt routes now align with private_control_only
+- DM routes are no longer classified as private_strong-only
+"""
+
+from auth import _minimum_transport_tier
+
+
+def test_dm_compose_requires_private_control_only():
+    assert _minimum_transport_tier("/api/wormhole/dm/compose", "POST") == "private_control_only"
+
+
+def test_dm_decrypt_requires_private_control_only():
+    assert _minimum_transport_tier("/api/wormhole/dm/decrypt", "POST") == "private_control_only"
+
+
+def test_gate_message_compose_is_private_control_only():
+    assert _minimum_transport_tier("/api/wormhole/gate/message/compose", "POST") == "private_control_only"
+
+
+def test_gate_message_decrypt_is_private_control_only():
+    assert _minimum_transport_tier("/api/wormhole/gate/message/decrypt", "POST") == "private_control_only"
+
+
+def test_gate_messages_decrypt_is_private_control_only():
+    assert _minimum_transport_tier("/api/wormhole/gate/messages/decrypt", "POST") == "private_control_only"
+
+
+def test_existing_dm_support_routes_are_control_only():
+    for path in [
+        "/api/wormhole/dm/encrypt",
+        "/api/wormhole/dm/reset",
+        "/api/wormhole/dm/register-key",
+        "/api/wormhole/dm/prekey/register",
+        "/api/wormhole/dm/bootstrap-encrypt",
+        "/api/wormhole/dm/bootstrap-decrypt",
+        "/api/wormhole/dm/sender-token",
+        "/api/wormhole/dm/open-seal",
+        "/api/wormhole/dm/build-seal",
+        "/api/wormhole/dm/dead-drop-token",
+        "/api/wormhole/dm/pairwise-alias",
+        "/api/wormhole/dm/pairwise-alias/rotate",
+        "/api/wormhole/dm/dead-drop-tokens",
+        "/api/wormhole/dm/sas",
+    ]:
+        assert _minimum_transport_tier(path, "POST") == "private_control_only"
+
+
+def test_dm_compose_not_in_transitional_set():
+    assert _minimum_transport_tier("/api/wormhole/dm/compose", "POST") != "private_transitional"
+
+
+def test_dm_decrypt_not_in_transitional_set():
+    assert _minimum_transport_tier("/api/wormhole/dm/decrypt", "POST") != "private_transitional"