run_write_access_check.py

#!/usr/bin/env python3
"""Run only the policy-gated unauthenticated write-access check.

Usage:
    python run_write_access_check.py --config config.yaml

The config must enable both `write_access_test.enabled` and
`engagement_policy.allow_write_tests`. No target is hardcoded here.
"""
import argparse
import logging

from pentest.cleanup_ledger import CleanupRecoveryLedger
from pentest.config import load_config
from pentest.phases.write_access import WriteAccessPhase
from pentest.policy import EngagementPolicy, PolicyViolation

logging.basicConfig(level=logging.INFO, format="%(levelname)s %(name)s: %(message)s")


def main():
    parser = argparse.ArgumentParser(description="Policy-gated write-access check")
    parser.add_argument("--config", required=True)
    args = parser.parse_args()

    config = load_config(args.config)
    policy = EngagementPolicy(config.engagement_policy)
    policy.validate_static_scope(config)

    if not config.write_access_test.enabled:
        raise PolicyViolation("write_access_test.enabled must be true for this command.")
    if not policy.allows_write_tests():
        raise PolicyViolation(
            "engagement_policy.allow_write_tests must be true for this command."
        )

    policy.authorize_network_operations(4)
    ledger = CleanupRecoveryLedger(
        config.output_cleanup_ledger_path(), policy.policy_hash
    )
    findings = WriteAccessPhase(
        config.write_access_test, recovery_ledger=ledger
    ).run()

    print(f"Findings: {len(findings)}")
    for finding in findings:
        print(f"[{finding.severity}] {finding.title}")
        print(f"Evidence: {finding.evidence}")
    if not findings:
        print(
            "No finding was produced. The endpoint may be gated, unreachable, "
            "or inconclusive; review the logs."
        )


if __name__ == "__main__":
    main()