According to the Repository Style Guide (Rule 2: Input Validation), any data loaded from external configuration files is untrusted and must be type-validated before indexing or calling dictionary lookup keys to avoid TypeError exceptions.

If data is not a dictionary, or if data["private_key"] is not a string, this check can raise a TypeError. We should explicitly verify that data is a dictionary and that data.get("private_key") is a string before passing it to crypt.is_mldsa_key.

1. Any data loaded from external configuration files (JSON, YAML, CSV) is untrusted. Always type-validate structure (e.g. check isinstance(data, dict) and isinstance(data.get("sub_key"), dict)) before indexing or calling dictionary lookup keys, avoiding TypeError exceptions. (link)

If the environment running the tests has an older version of cryptography where crypt.pqc is None or does not exist, attempting to set an attribute on crypt.pqc directly will raise an AttributeError.

To make the test robust across all environments, mock the pqc attribute on the crypt module instead.

    mock_pqc = mock.Mock()
    mock_pqc.mldsa = None
    monkeypatch.setattr(crypt, "pqc", mock_pqc)

Similarly to the previous test, directly setting attributes on crypt.pqc or crypt.pqc.serialization can raise an AttributeError if they are not present or are None in the current environment.

We should mock the entire pqc attribute on the crypt module to ensure the test is robust.

    mock_pqc = mock.Mock()
    mock_pqc.mldsa = mock_mldsa
    mock_pqc.serialization.load_pem_private_key = lambda key, password, backend: MockMLDSA65PrivateKey()
    monkeypatch.setattr(crypt, "pqc", mock_pqc)