tegwick
c93628a017
expired stays a terminal exit from valid (state machine unchanged), but supersede() now also accepts it as a source status when the caller supplies a validity window, linking a new successor approval to the expired original instead of requiring a caller to mint an unlinked replacement from scratch. Without a fresh window, an expired source still conflicts exactly as before. The original's status becomes superseded (not left as a bare dead-end expired) and superseded_by points at the successor, so the link is documented rather than hidden -- informed-decision's overview already renders this automatically, no changes needed there. Prompted by the operator missing infd-20260927-b01's approval window during today's key-cape login outage (APPROVAL-WP-0003). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: sonnet Assistant-Process: 169987@bnt-lap001 Assistant-Session: 322ef1ef-9048-4021-8570-b6d6f6347999
106 lines
4.1 KiB
Python
106 lines
4.1 KiB
Python
"""Reissuing an expired approval: supersede() extended to link a fresh
|
|
successor to an already-`expired` approval, given a new validity window.
|
|
|
|
`expired` stays a terminal state (SCOPE.md's closed state machine is
|
|
unchanged) -- this never reopens the original in place. It only lets a new,
|
|
linked approval be created for the same binding, and marks the original
|
|
`superseded` (rather than leaving it a dead-end `expired`) so the link is
|
|
visible without deleting or overwriting the original record.
|
|
"""
|
|
import pytest
|
|
|
|
from approval_engine.errors import Conflict, Unprocessable
|
|
from tests.conftest import FROZEN, approve, binding, validity
|
|
|
|
|
|
def expired_validity():
|
|
return {
|
|
"not_before": "2026-08-29T09:00:00+00:00",
|
|
"expires_at": "2026-08-29T10:00:00+00:00", # before FROZEN (12:00)
|
|
}
|
|
|
|
|
|
def fresh_validity():
|
|
return {
|
|
"not_before": "2026-08-29T13:00:00+00:00",
|
|
"expires_at": "2026-08-29T18:00:00+00:00",
|
|
}
|
|
|
|
|
|
def test_reissue_links_successor_and_retires_original(engine):
|
|
obj = engine.create(binding(), expired_validity())
|
|
assert engine.get(obj.id).status == "expired"
|
|
|
|
result = engine.supersede(obj.id, validity=fresh_validity())
|
|
successor_id = result["successor_id"]
|
|
|
|
original = engine.get(obj.id)
|
|
assert original.status == "superseded" # not left as a bare dead-end "expired"
|
|
assert original.superseded_by == successor_id # link is documented, not hidden
|
|
|
|
successor = engine.get(successor_id)
|
|
assert successor.status == "requested"
|
|
assert successor.not_before == fresh_validity()["not_before"]
|
|
assert successor.expires_at == fresh_validity()["expires_at"]
|
|
# Same intent carried over: actor/principal/action/purpose/target unchanged.
|
|
assert successor.actor == original.actor
|
|
assert successor.principal == original.principal
|
|
assert successor.action == original.action
|
|
assert successor.purpose == original.purpose
|
|
assert successor.target == original.target
|
|
assert successor.binding_digest == original.binding_digest
|
|
|
|
|
|
def test_reissue_without_validity_conflicts(engine):
|
|
obj = engine.create(binding(), expired_validity())
|
|
assert engine.get(obj.id).status == "expired"
|
|
with pytest.raises(Conflict):
|
|
engine.supersede(obj.id)
|
|
|
|
|
|
def test_reissue_requires_expires_after_not_before(engine):
|
|
obj = engine.create(binding(), expired_validity())
|
|
engine.get(obj.id)
|
|
with pytest.raises(Unprocessable):
|
|
engine.supersede(obj.id, validity={
|
|
"not_before": "2026-08-29T18:00:00+00:00",
|
|
"expires_at": "2026-08-29T13:00:00+00:00",
|
|
})
|
|
# A failed reissue must not have mutated the original.
|
|
assert engine.get(obj.id).status == "expired"
|
|
|
|
|
|
def test_reissue_requires_expires_at(engine):
|
|
obj = engine.create(binding(), expired_validity())
|
|
engine.get(obj.id)
|
|
with pytest.raises(Unprocessable):
|
|
engine.supersede(obj.id, validity={"not_before": "2026-08-29T13:00:00+00:00"})
|
|
|
|
|
|
@pytest.mark.parametrize("terminal_verb", ["revoke"])
|
|
def test_cannot_reissue_other_terminal_states_even_with_validity(engine, terminal_verb):
|
|
obj = approve(engine)
|
|
getattr(engine, terminal_verb)(obj.id)
|
|
assert engine.get(obj.id).status == "revoked"
|
|
with pytest.raises(Conflict):
|
|
engine.supersede(obj.id, validity=fresh_validity())
|
|
|
|
|
|
def test_cannot_reissue_consumed_even_with_validity(engine):
|
|
obj = approve(engine)
|
|
engine.consume(obj.id, "sha256:" + "ab" * 32)
|
|
assert engine.get(obj.id).status == "consumed"
|
|
with pytest.raises(Conflict):
|
|
engine.supersede(obj.id, validity=fresh_validity())
|
|
|
|
|
|
def test_ordinary_supersession_of_an_active_approval_still_copies_the_window(engine):
|
|
"""Regression: reissue's validity override must not change the
|
|
unrelated, already-working case of superseding a still-active approval
|
|
(e.g. correcting a binding) -- that keeps inheriting the same window."""
|
|
obj = approve(engine)
|
|
result = engine.supersede(obj.id)
|
|
successor = engine.get(result["successor_id"])
|
|
original_window = validity()
|
|
assert successor.not_before == original_window["not_before"]
|
|
assert successor.expires_at == original_window["expires_at"]
|