tegwick
6d18f62a90
Operator decision 5ed3fb35-eca9-413a-82b9-95171ba85bf6 accepts tenant:platform
as the platform management, administration and services tenant, with no alias
to platform or tenant:coulomb and no implicit cross-tenant grant. This closes
the collision recorded in 5c87ba8, where the manifest served --tenant platform
while the requested registrations issued tenant:coulomb.
The store tenant is now exactly tenant:platform in the manifest, the CLI
default, and the Engine default, and the requested client registrations ask for
the same spelling. Exact JWT/store equality is retained: no mapping table, no
normalisation, no prefix handling.
Moving the defaults rather than only the manifest is deliberate. A default of
platform under a sanctioned value of tenant:platform is a trap, because a serve
that omits --tenant would come up healthy and then refuse every authenticated
call -- the exact failure this decision exists to prevent.
That default change broke ten tests whose identity fixtures hard-coded
platform. This is the hazard flex-auth reported as FLEX-DEC-2026-008: fixtures
that all carry one tenant prove nothing about the tenant field. Fixtures are
aligned to the exact spelling, and the field is now varied rather than merely
present. test_near_miss_tenant_spellings_are_forbidden refuses platform,
tenant:coulomb, case variants, whitespace variants and empty against a
tenant:platform store; test_exact_sanctioned_tenant_is_admitted pins the other
half so a reject-everything bug cannot pass it. 111 tests pass.
Also records the credential-independent half of the GLAS-WP-0015 image request:
the image builds non-root uid 10001 off the pinned base, carries schema v3 and
the new tenant default, migrates and verifies a fresh store to schema_version 3
with integrity ok, and refuses production without a persistent database or
authenticated audit delivery. No scan was run -- no scanner is installed here --
and no release digest exists, so T01 and T03 both stay open.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PM5HnEAhokxdfcPqBNpT7D
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 715850@bnt-lap001
Assistant-Session: eb557e93-7cb1-45d0-9e57-7d15b3edc60e
79 lines
2 KiB
Python
79 lines
2 KiB
Python
from datetime import datetime, timezone
|
|
|
|
import pytest
|
|
|
|
from approval_engine.api import App
|
|
from approval_engine.auth import Identity, StaticTokenAuthenticator
|
|
from approval_engine.store import Engine
|
|
|
|
FROZEN = datetime(2026, 8, 29, 12, 0, tzinfo=timezone.utc)
|
|
|
|
|
|
@pytest.fixture
|
|
def now():
|
|
return FROZEN
|
|
|
|
|
|
@pytest.fixture
|
|
def engine(now):
|
|
eng = Engine(":memory:", clock=lambda: now)
|
|
yield eng
|
|
eng.close()
|
|
|
|
|
|
@pytest.fixture
|
|
def app(engine):
|
|
identity = Identity(
|
|
subject="agt-secrets-engine",
|
|
issuer="https://keycape.example",
|
|
audiences=("approval-engine",),
|
|
principal_type="service",
|
|
tenant="tenant:platform",
|
|
roles=frozenset({"secrets-engine"}),
|
|
scopes=frozenset(
|
|
{
|
|
"approval:create",
|
|
"approval:read",
|
|
"approval:approve",
|
|
"approval:revoke",
|
|
"approval:supersede",
|
|
"approval:consume",
|
|
"approval:observe",
|
|
"approval:emit",
|
|
}
|
|
),
|
|
assurance={"level": "aal1", "methods": ["test"], "source": "test"},
|
|
evidence_ref="test-identity:test-token",
|
|
)
|
|
return App(engine, StaticTokenAuthenticator({"test-token": identity}))
|
|
|
|
|
|
def binding(**overrides):
|
|
base = {
|
|
"action": "secrets.kv.destroy",
|
|
"target": {"id": "lane-openbao-root", "stage": "prod"},
|
|
"actor": "agt-secrets-engine",
|
|
"principal": "bernd",
|
|
"purpose": "rotate-exposed-key",
|
|
}
|
|
base.update(overrides)
|
|
return base
|
|
|
|
|
|
def validity():
|
|
return {
|
|
"not_before": "2026-08-29T11:00:00+00:00",
|
|
"expires_at": "2026-08-29T15:00:00+00:00",
|
|
}
|
|
|
|
|
|
def approve(engine, required=1, extra_binding=None, pdp_digest=None):
|
|
obj = engine.create(
|
|
extra_binding or binding(),
|
|
validity(),
|
|
required_count=required,
|
|
pdp_digest=pdp_digest,
|
|
)
|
|
for i in range(required):
|
|
obj = engine.add_entry(obj.id, f"user:approver-{i}")
|
|
return obj
|