test: add 43 new tests across 6 test files

- Added Settings config tests (comma-separated parsing, validation)
- Added extended scope enforcer tests (URL with no hostname, wildcards)
- Added rate limiter tests (TokenBucket with lock, low rate)
- Added crypto extended tests (entropy, SHA, secret detection)
- Added agent base tests (AgentContext, AgentResult)
- Added knowledge graph extended tests (clear, merge, paths, chain)
- Added schema string constant tests
- Fixed test regressions matching actual API
- Coverage increased from 52 to 95 tests

Author: bot

tests/test_agents.py

@@ -0,0 +1,42 @@
+from __future__ import annotations
+
+from bugfinder.agents.base import AgentContext, AgentResult
+from bugfinder.knowledge_graph.graph import KnowledgeGraph
+
+
+class TestAgentBase:
+    def test_agent_context_defaults(self) -> None:
+        kg = KnowledgeGraph()
+        ctx = AgentContext(
+            target="https://example.com",
+            target_type="website",
+            scan_id="test-1",
+            knowledge_graph=kg,
+        )
+        assert ctx.target == "https://example.com"
+        assert ctx.target_type == "website"
+        assert ctx.scan_id == "test-1"
+        assert ctx.ai_client is None
+        assert ctx.repository is None
+
+    def test_agent_result_defaults(self) -> None:
+        r = AgentResult(agent_name="test", status="completed")
+        assert r.findings == []
+        assert r.assets == []
+        assert r.summary == ""
+        assert r.error is None
+
+    def test_agent_result_with_findings(self) -> None:
+        r = AgentResult(agent_name="test", status="completed", findings=[{"id": "f-1"}])
+        assert len(r.findings) == 1
+        assert r.findings[0]["id"] == "f-1"
+
+    def test_agent_context_with_ai_and_repo(self) -> None:
+        ctx = AgentContext(
+            target="https://example.com",
+            target_type="website",
+            scan_id="test-1",
+            knowledge_graph=KnowledgeGraph(),
+        )
+        assert ctx.ai_client is None
+        assert ctx.repository is None

tests/test_config.py

@@ -0,0 +1,40 @@
+from __future__ import annotations
+
+from bugfinder.core.config import Settings
+
+
+class TestSettings:
+    def test_defaults(self) -> None:
+        s = Settings()
+        assert s.ssl_verify is True
+        assert s.scope_enforcement is True
+        assert s.allowed_domains == []
+        assert s.rate_limit_per_second >= 1
+
+    def test_allowed_domains_comma_separated(self) -> None:
+        s = Settings(allowed_domains="example.com,api.example.com")
+        assert s.allowed_domains == ["example.com", "api.example.com"]
+
+    def test_allowed_domains_list(self) -> None:
+        s = Settings(allowed_domains=["example.com"])
+        assert s.allowed_domains == ["example.com"]
+
+    def test_allowed_domains_empty_string(self) -> None:
+        s = Settings(allowed_domains="")
+        assert s.allowed_domains == []
+
+    def test_allowed_domains_strips_whitespace(self) -> None:
+        s = Settings(allowed_domains=" example.com , sub.example.com ")
+        assert s.allowed_domains == ["example.com", "sub.example.com"]
+
+    def test_ssl_verify_default_true(self) -> None:
+        s = Settings()
+        assert s.ssl_verify is True
+
+    def test_ssl_verify_can_be_disabled(self) -> None:
+        s = Settings(ssl_verify=False)
+        assert s.ssl_verify is False
+
+    def test_nvidia_api_key_default_empty(self) -> None:
+        s = Settings()
+        assert s.nvidia_api_key == ""

tests/test_crypto_extended.py

@@ -0,0 +1,39 @@
+from __future__ import annotations
+
+from bugfinder.utils.crypto import detect_high_entropy_strings, md5, sha256, shannon_entropy
+
+
+class TestCryptoExtended:
+    def test_shannon_entropy_large_data_same_byte(self) -> None:
+        e = shannon_entropy(b"\x00" * 10000)
+        assert e == 0.0
+
+    def test_shannon_entropy_maximum(self) -> None:
+        data = bytes(range(256)) * 10
+        e = shannon_entropy(data)
+        assert e > 7.9
+
+    def test_shannon_entropy_unicode_string(self) -> None:
+        e = shannon_entropy("hello world this is a test string with unicode \u00e9")
+        assert e > 0
+
+    def test_sha256_empty(self) -> None:
+        assert sha256(b"") == "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+
+    def test_md5_empty(self) -> None:
+        assert md5(b"") == "d41d8cd98f00b204e9800998ecf8427e"
+
+    def test_detect_no_secrets(self) -> None:
+        results = detect_high_entropy_strings("plain text with no secrets")
+        assert len(results) == 0
+
+    def test_detect_multiple_github_tokens(self) -> None:
+        text = "token1: ghp_abcdefghijklmnopqrstuvwxyz0123456789abcd token2: ghp_123456789012345678901234567890123456"
+        results = detect_high_entropy_strings(text)
+        github_results = [r for r in results if r["pattern"] == "github_token"]
+        assert len(github_results) == 2
+
+    def test_detect_aws_key(self) -> None:
+        text = "AWS key: AKIAIOSFODNN7EXAMPLE"
+        results = detect_high_entropy_strings(text)
+        assert any(r["pattern"] == "aws_access_key" for r in results)

tests/test_knowledge_graph_extended.py

@@ -0,0 +1,76 @@
+from __future__ import annotations
+
+from bugfinder.knowledge_graph.graph import KnowledgeGraph
+from bugfinder.knowledge_graph.schema import EdgeType, NodeType
+
+
+class TestKnowledgeGraphExtended:
+    def test_get_node_nonexistent(self) -> None:
+        kg = KnowledgeGraph()
+        assert kg.get_node("nonexistent") is None
+
+    def test_get_neighbors_nonexistent(self) -> None:
+        kg = KnowledgeGraph()
+        assert kg.get_neighbors("nonexistent") == []
+
+    def test_add_duplicate_node(self) -> None:
+        kg = KnowledgeGraph()
+        kg.add_node("a", NodeType.DOMAIN, name="First")
+        kg.add_node("a", NodeType.DOMAIN, name="Second")
+        node = kg.get_node("a")
+        assert node is not None
+        assert node["name"] == "Second"
+
+    def test_find_paths_no_path(self) -> None:
+        kg = KnowledgeGraph()
+        kg.add_node("a", NodeType.DOMAIN)
+        kg.add_node("b", NodeType.IP_ADDRESS)
+        paths = kg.find_paths("a", "b")
+        assert paths == []
+
+    def test_find_paths_max_depth(self) -> None:
+        kg = KnowledgeGraph()
+        kg.add_node("a", NodeType.DOMAIN)
+        kg.add_node("b", NodeType.IP_ADDRESS)
+        kg.add_node("c", NodeType.FINDING)
+        kg.add_edge("a", "b", EdgeType.RESOLVES_TO)
+        kg.add_edge("b", "c", EdgeType.HAS_FINDING)
+        paths = kg.find_paths("a", "c", max_depth=1)
+        assert paths == []
+
+    def test_clear(self) -> None:
+        kg = KnowledgeGraph()
+        kg.add_node("a", NodeType.DOMAIN)
+        kg.clear()
+        assert kg.node_count == 0
+        assert kg.edge_count == 0
+
+    def test_to_dict_empty(self) -> None:
+        kg = KnowledgeGraph()
+        data = kg.to_dict()
+        assert data["nodes"] == []
+        assert data["edges"] == []
+
+    def test_get_nodes_by_type_none(self) -> None:
+        kg = KnowledgeGraph()
+        assert kg.get_nodes_by_type("nonexistent") == []
+
+    def test_get_finding_chain(self) -> None:
+        kg = KnowledgeGraph()
+        kg.add_node("finding-1", NodeType.FINDING)
+        kg.add_node("host-1", NodeType.HOST)
+        kg.add_edge("finding-1", "host-1", EdgeType.HAS_FINDING)
+        chain = kg.get_finding_chain("finding-1")
+        assert len(chain) == 1
+        assert chain[0]["node"] == "host-1"
+
+    def test_merge_keeps_existing_nodes(self) -> None:
+        kg1 = KnowledgeGraph()
+        kg1.add_node("a", NodeType.DOMAIN)
+        kg2 = KnowledgeGraph()
+        kg2.add_node("a", NodeType.DOMAIN, extra="data")
+        kg2.add_node("b", NodeType.DOMAIN)
+        kg1.merge(kg2)
+        assert kg1.node_count == 2
+        node = kg1.get_node("a")
+        assert node is not None

tests/test_schema.py

@@ -0,0 +1,14 @@
+from __future__ import annotations
+
+from bugfinder.knowledge_graph.schema import EdgeType, NodeType
+
+
+class TestSchema:
+    def test_node_type_strings(self) -> None:
+        assert NodeType.DOMAIN == "domain"
+        assert NodeType.IP_ADDRESS == "ip_address"
+        assert NodeType.FINDING == "finding"
+
+    def test_edge_type_strings(self) -> None:
+        assert EdgeType.RESOLVES_TO == "resolves_to"
+        assert EdgeType.HAS_FINDING == "has_finding"

tests/test_security_extended.py

@@ -0,0 +1,89 @@
+from __future__ import annotations
+
+import pytest
+
+from bugfinder.core.exceptions import ScopeViolationError
+from bugfinder.security.rate_limiter import RateLimiter, TokenBucket
+from bugfinder.security.scope import ScopeEnforcer
+
+
+class TestScopeEnforcerExtended:
+    def test_url_with_no_hostname_raises(self) -> None:
+        enforcer = ScopeEnforcer(allowed_domains=["example.com"])
+        with pytest.raises(ScopeViolationError):
+            enforcer.check_url("file:///etc/passwd")
+
+    def test_url_with_no_hostname_no_enforcement(self) -> None:
+        enforcer = ScopeEnforcer(allowed_domains=[])
+        enforcer.check_url("file:///etc/passwd")
+
+    def test_wildcard_includes_base_domain(self) -> None:
+        enforcer = ScopeEnforcer(allowed_domains=["*.example.com"])
+        enforcer.check_url("https://example.com")
+
+    def test_wildcard_rejects_other_domain(self) -> None:
+        enforcer = ScopeEnforcer(allowed_domains=["*.example.com"])
+        with pytest.raises(ScopeViolationError):
+            enforcer.check_url("https://other.com")
+
+    def test_multiple_allowed_domains(self) -> None:
+        enforcer = ScopeEnforcer(allowed_domains=["a.com", "b.com"])
+        enforcer.check_url("https://a.com")
+        enforcer.check_url("https://sub.b.com")
+        with pytest.raises(ScopeViolationError):
+            enforcer.check_url("https://c.com")
+
+    def test_case_insensitive(self) -> None:
+        enforcer = ScopeEnforcer(allowed_domains=["Example.COM"])
+        enforcer.check_url("https://example.com")
+        enforcer.check_url("https://EXAMPLE.COM")
+
+
+class TestRateLimiterExtended:
+    def test_rate_limiter_global_and_domain(self) -> None:
+        limiter = RateLimiter(rate_per_second=100)
+        import asyncio
+
+        async def test() -> None:
+            await limiter.acquire("example.com")
+            await limiter.acquire()
+            await limiter.acquire("other.com")
+
+        asyncio.run(test())
+
+    def test_token_bucket_consume(self) -> None:
+        import asyncio
+
+        async def test() -> None:
+            bucket = TokenBucket(rate=100, capacity=10)
+            for _ in range(10):
+                assert await bucket.consume()
+            assert not await bucket.consume()
+
+        asyncio.run(test())
+
+    def test_token_bucket_refills(self) -> None:
+        import asyncio
+
+        async def test() -> None:
+            bucket = TokenBucket(rate=1000, capacity=5)
+            for _ in range(5):
+                assert await bucket.consume()
+            await asyncio.sleep(0.01)
+            assert await bucket.consume()
+
+        asyncio.run(test())
+
+    def test_rate_limiter_low_rate(self) -> None:
+        limiter = RateLimiter(rate_per_second=1)
+        assert limiter.global_bucket.rate == 1.0
+        assert limiter.global_bucket.capacity >= 1
+
+    def test_rate_limiter_context_manager(self) -> None:
+        import asyncio
+
+        async def test() -> None:
+            async with RateLimiter(rate_per_second=100) as limiter:
+                await limiter.acquire("test.com")
+
+        asyncio.run(test())