test: prove the suite still opens no socket

The umbrella design verifies property 2 by running with sockets raising.
Now that a network module exists, that has to stay true for the WHOLE
suite rather than for everything except contacts: a network module that
can only be tested with a network is a module that stops being tested.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Wrfqr2xqQfhtXCscU7zrdz

1 files changed, 76 insertions, 0 deletions

diff --git a/tests/test_offline.py b/tests/test_offline.py
new file mode 100644
index 0000000..dfb9965
--- /dev/null
+++ b/tests/test_offline.py
@@ -0,0 +1,76 @@
+# Copyright (C) 2026 Danilo M. <danix@danix.xyz>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+"""The suite must pass with no network, including the network modules.
+
+A network module that can only be tested with a network is a module that
+stops being tested. rdap and contacts both take an injected fetch, and
+this asserts that the default is never reached by accident during a test
+run: parse stays pure, and nothing above it opens a socket unasked.
+"""
+
+import socket
+import unittest
+from unittest import mock
+
+from abusectl import contacts, parse, rdap
+
+
+class NothingOpensASocket(unittest.TestCase):
+    def setUp(self):
+        # socket.socket.connect, NOT socket.socket: replacing the class
+        # itself breaks the ssl module at import time and produces false
+        # failures that have nothing to do with network use.
+        patcher = mock.patch.object(
+            socket.socket, "connect",
+            side_effect=AssertionError("socket.socket.connect was called"),
+        )
+        patcher.start()
+        self.addCleanup(patcher.stop)
+
+        for name in ("create_connection", "getaddrinfo"):
+            patcher = mock.patch.object(
+                socket, name,
+                side_effect=AssertionError(f"socket.{name} was called"),
+            )
+            patcher.start()
+            self.addCleanup(patcher.stop)
+
+    def test_parsing_opens_no_socket(self):
+        raw = (b"Received: from relay.example.invalid ([192.0.2.10])\r\n"
+               b"From: sender@example.invalid\r\n"
+               b"Subject: test\r\n\r\nbody\r\n")
+        parse.iocs(raw, trusted=["192.0.2.0/24"])
+
+    def test_resolving_with_an_injected_fetch_opens_no_socket(self):
+        iocs = [{"id": "ioc-1", "type": "ipv4", "value": "198.51.100.7"}]
+        bootstraps = {
+            "ipv4": {"services": [[["198.51.100.0/24"],
+                                   ["https://rir.example.invalid/"]]]},
+            "ipv6": {"services": []},
+            "dns": {"services": []},
+        }
+        result = contacts.resolve(
+            iocs, bootstraps=bootstraps,
+            fetch=lambda url: {"handle": "NET-1", "entities": []},
+        )
+        self.assertEqual(len(result), 1)
+
+    def test_the_real_transport_is_never_the_default_in_a_test(self):
+        """Sanity: http_fetch exists and is the documented default."""
+        self.assertIs(contacts.resolve.__defaults__[-1], rdap.http_fetch)
+
+
+if __name__ == "__main__":
+    unittest.main()