From a53012ba35df90ff088d5243a33e131eedd25a23 Mon Sep 17 00:00:00 2001
From: Lloyd <lloyd@rightup.co.uk>
Date: Thu, 9 Apr 2026 09:17:59 +0100
Subject: [PATCH] test: enhance transport flood handling in tests with policy
 checks

---
 tests/test_engine.py | 47 ++++++++++++++++++++++----------------------
 1 file changed, 23 insertions(+), 24 deletions(-)

diff --git a/tests/test_engine.py b/tests/test_engine.py
index 060b88a..bb50883 100644
--- a/tests/test_engine.py
+++ b/tests/test_engine.py
@@ -365,7 +365,8 @@ class TestProcessPacket:
 
     def test_transport_flood_dispatched(self, handler):
         pkt = _make_transport_flood_packet()
-        result = handler.process_packet(pkt, snr=5.0)
+        with patch.object(handler, '_check_transport_codes', return_value=(True, "")):
+            result = handler.process_packet(pkt, snr=5.0)
         assert result is not None
         fwd_pkt, _ = result
         assert fwd_pkt.path[-1] == LOCAL_HASH
@@ -673,12 +674,22 @@ class TestUnscopedFloodPolicy:
         result = handler.direct_forward(pkt)
         assert result is not None  # direct is not blocked by flood policy
 
-    def test_transport_flood_checked_when_policy_off(self, handler):
+    def test_transport_flood_unaffected_by_unscoped_policy(self, handler):
+        # unscoped_flood_allow controls only plain FLOOD packets.
+        # Transport floods are validated via _check_transport_codes regardless.
+        # With a configured scope that allows, transport flood passes even when
+        # unscoped traffic is denied — the two settings are fully independent.
         handler.config["mesh"]["unscoped_flood_allow"] = False
         pkt = _make_transport_flood_packet()
-        # Will call _check_transport_codes which will fail (no storage keys)
-        result = handler.flood_forward(pkt)
-        assert result is None
+        with patch.object(handler, '_check_transport_codes', return_value=(True, "")):
+            result = handler.flood_forward(pkt)
+        assert result is not None  # transport flood passes; unscoped=False did not block it
+
+    def test_transport_flood_denied_with_no_keys(self, handler):
+        # Scope Not Configured = denied, regardless of unscoped_flood_allow.
+        pkt = _make_transport_flood_packet()
+        result = handler.flood_forward(pkt)  # no mocking — real _check_transport_codes
+        assert result is None  # denied because no transport keys configured
 
 
 class TestFloodLoopDetection:
@@ -837,7 +848,8 @@ class TestTransportForwarding:
 
     def test_transport_flood_appends_path(self, handler):
         pkt = _make_transport_flood_packet(path=b"\x11")
-        result = handler.process_packet(pkt, snr=5.0)
+        with patch.object(handler, '_check_transport_codes', return_value=(True, "")):
+            result = handler.process_packet(pkt, snr=5.0)
         assert result is not None
         fwd_pkt, _ = result
         assert fwd_pkt.path[-1] == LOCAL_HASH
@@ -852,7 +864,8 @@ class TestTransportForwarding:
 
     def test_transport_codes_preserved_after_flood(self, handler):
         pkt = _make_transport_flood_packet(transport_codes=(0xAAAA, 0xBBBB))
-        result = handler.process_packet(pkt, snr=5.0)
+        with patch.object(handler, '_check_transport_codes', return_value=(True, "")):
+            result = handler.process_packet(pkt, snr=5.0)
         assert result is not None
         fwd_pkt, _ = result
         assert fwd_pkt.transport_codes == [0xAAAA, 0xBBBB]
@@ -1126,23 +1139,9 @@ GOOD_PACKETS = [
      lambda: _make_direct_packet(payload=b"\xFF\xEE",
                                   path=bytes([LOCAL_HASH] + list(range(10))))),
 
-    ("good_transport_flood_basic",
-     "Transport flood, basic payload + transport codes",
-     lambda: _make_transport_flood_packet(payload=b"\x01\x02\x03\x04")),
-
-    ("good_transport_flood_with_path",
-     "Transport flood, existing 3-hop path",
-     lambda: _make_transport_flood_packet(payload=b"\xAA\xBB", path=b"\x11\x22\x33")),
-
-    ("good_transport_flood_max_codes",
-     "Transport flood, max uint16 transport codes",
-     lambda: _make_transport_flood_packet(payload=b"\xFF",
-                                           transport_codes=(0xFFFF, 0xFFFF))),
-
     ("good_transport_direct_basic",
      "Transport direct, basic hop to us",
      lambda: _make_transport_direct_packet(payload=b"\x01\x02")),
-
     ("good_transport_direct_long_path",
      "Transport direct, 5 remaining hops",
      lambda: _make_transport_direct_packet(
@@ -1203,10 +1202,10 @@ BAD_PACKETS = [
     ("bad_flood_policy_off",
      "Plain flood when unscoped_flood_allow=False (needs config override)",
      lambda: _make_flood_packet(payload=b"\x01\x02"),
-     "transport codes"),
+     "unscoped flood"),
 
-    ("bad_transport_flood_policy_off",
-     "Transport flood when policy off (no valid transport key)",
+    ("bad_transport_flood_no_keys",
+     "Transport flood with no configured transport keys — always denied",
      lambda: _make_transport_flood_packet(payload=b"\x01\x02"),
      "transport"),