tegwick
be1a388a84
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
107 lines
3.8 KiB
Python
107 lines
3.8 KiB
Python
"""The published examples must satisfy the published schema.
|
|
|
|
flex-auth shipped two defects in one day from fixtures that contradicted their
|
|
own contracts, and secrets-engine built a validator against one of them. A
|
|
contract whose examples contradict its prose will be implemented as its
|
|
examples, so the examples are tested rather than trusted.
|
|
"""
|
|
|
|
import json
|
|
from pathlib import Path
|
|
|
|
import pytest
|
|
|
|
jsonschema = pytest.importorskip("jsonschema")
|
|
|
|
ROOT = Path(__file__).resolve().parent.parent
|
|
SCHEMA = json.loads((ROOT / "schemas" / "approval_claim.schema.json").read_text())
|
|
EXAMPLES = sorted((ROOT / "examples").glob("claim.*.json"))
|
|
|
|
|
|
def test_examples_exist():
|
|
assert EXAMPLES, "no claim examples found to validate"
|
|
|
|
|
|
@pytest.mark.parametrize("path", EXAMPLES, ids=lambda p: p.name)
|
|
def test_example_matches_schema(path):
|
|
jsonschema.validate(json.loads(path.read_text()), SCHEMA)
|
|
|
|
|
|
@pytest.mark.parametrize("path", EXAMPLES, ids=lambda p: p.name)
|
|
def test_example_states_pdp_digest_explicitly(path):
|
|
"""Absence must be a stated null, never a missing key."""
|
|
assert "pdp_digest" in json.loads(path.read_text())["binding"]
|
|
|
|
|
|
def test_examples_cover_both_pdp_binding_states():
|
|
"""An implementer must see both shapes, not infer one from the other."""
|
|
states = {
|
|
json.loads(p.read_text())["binding"]["pdp_digest"] is None for p in EXAMPLES
|
|
}
|
|
assert states == {True, False}
|
|
|
|
|
|
def test_examples_cover_both_pdp_path_declarations():
|
|
states = {json.loads(p.read_text())["binding"]["pdp_path"] for p in EXAMPLES}
|
|
assert states == {True, False}
|
|
|
|
|
|
def test_pdp_binding_is_not_confounded_with_validity():
|
|
"""Both shapes present is not enough if they only ever co-vary.
|
|
|
|
With only `claim.valid` (pdp_digest set, pdp_path true) and `claim.revoked`
|
|
(null, false), the two dimensions are perfectly correlated and an
|
|
implementer can reasonably infer that pdp_digest is null *because* the claim
|
|
is revoked, or that pdp_path tracks validity. Both inferences are wrong and
|
|
the example set is what teaches them.
|
|
|
|
The shape that must exist is a claim that is entirely valid -- `valid_now`
|
|
true, `reason_code` ok, not consumed -- and still carries no PDP binding.
|
|
That is the claim a privileged-lane PEP MUST refuse under
|
|
`GH-DEC-2026-008`, and it is the one a consumer would otherwise have to
|
|
invent a fixture for.
|
|
"""
|
|
claims = [json.loads(p.read_text()) for p in EXAMPLES]
|
|
valid_without_pdp = [
|
|
c
|
|
for c in claims
|
|
if c["valid_now"]
|
|
and c["reason_code"] == "ok"
|
|
and not c["consumed"]
|
|
and c["binding"]["pdp_digest"] is None
|
|
and c["binding"]["pdp_path"] is False
|
|
]
|
|
assert valid_without_pdp, (
|
|
"no example of a valid claim with no PDP binding; a consumer writing the "
|
|
"privileged-lane refusal has no published shape to test against"
|
|
)
|
|
|
|
|
|
def test_valid_claims_cover_both_pdp_path_declarations():
|
|
"""The decorrelation stated as coverage rather than as one instance."""
|
|
paths = {
|
|
c["binding"]["pdp_path"]
|
|
for c in (json.loads(p.read_text()) for p in EXAMPLES)
|
|
if c["valid_now"]
|
|
}
|
|
assert paths == {True, False}, (
|
|
f"valid examples declare only pdp_path={paths}; both are reachable states "
|
|
"for a valid approval"
|
|
)
|
|
|
|
|
|
@pytest.mark.parametrize("path", EXAMPLES, ids=lambda p: p.name)
|
|
def test_pdp_path_examples_always_carry_a_digest(path):
|
|
"""GH-DEC-2026-008: pdp_path true guarantees pdp_digest non-null."""
|
|
binding = json.loads(path.read_text())["binding"]
|
|
if binding["pdp_path"]:
|
|
assert binding["pdp_digest"] is not None
|
|
|
|
|
|
def test_valid_examples_distinguish_declared_human_control_from_ordinary_approval():
|
|
controls = {
|
|
c["binding"]["human_control"]
|
|
for c in (json.loads(p.read_text()) for p in EXAMPLES)
|
|
if c["valid_now"]
|
|
}
|
|
assert controls == {True, False}
|