tegwick
57afafaced
Some checks failed
Use-case regression gate / usecase-regressions (push) Has been cancelled
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a10e2d-a5ef-7e92-b03d-b1694e915680
53 lines
2.3 KiB
Python
53 lines
2.3 KiB
Python
"""Synthetic owner-lane checks; run with python3 scripts/test_keycape_client_repair.py."""
|
|
import base64
|
|
import importlib.util
|
|
import json
|
|
import unittest
|
|
from pathlib import Path
|
|
|
|
import yaml
|
|
|
|
spec = importlib.util.spec_from_file_location(
|
|
"csoc_repair", Path(__file__).with_name("keycape-client-repair.py"),
|
|
)
|
|
adapter = importlib.util.module_from_spec(spec)
|
|
spec.loader.exec_module(adapter)
|
|
|
|
|
|
class RepairTests(unittest.TestCase):
|
|
def setUp(self):
|
|
self.rollout = adapter.configure(Path.home() / "net-kingdom/sso-mfa/k8s/keycape")
|
|
|
|
def fixture(self, clients):
|
|
raw = ("# keep comment\nauthelia:\n issuer: https://auth.example.invalid\n"
|
|
" clientSecret: synthetic-marker\nclients:\n" +
|
|
yaml.safe_dump(json.loads(json.dumps(clients)), sort_keys=False) +
|
|
"tokenLifetime: 15m\n")
|
|
return {"data": {"config.yaml": base64.b64encode(raw.encode()).decode(),
|
|
"key.pem": "synthetic-key"}}, raw
|
|
|
|
def test_insert_preserves_bytes_and_is_idempotent(self):
|
|
secret, raw = self.fixture([{"clientId": "existing", "clientType": "public"}])
|
|
encoded, changed = self.rollout.replacement(secret)
|
|
updated = base64.b64decode(encoded).decode()
|
|
self.assertTrue(changed)
|
|
self.assertTrue(updated.startswith(raw[:raw.index("tokenLifetime:")]))
|
|
self.assertTrue(updated.endswith("tokenLifetime: 15m\n"))
|
|
expected = yaml.safe_load(raw)
|
|
expected["clients"].append(self.rollout.portal.CLIENT)
|
|
self.assertEqual(yaml.safe_load(updated), expected)
|
|
self.assertEqual(secret["data"]["key.pem"], "synthetic-key")
|
|
secret["data"]["config.yaml"] = encoded
|
|
self.assertEqual(self.rollout.replacement(secret), (encoded, False))
|
|
|
|
def test_refuses_different_or_duplicate_registration(self):
|
|
client = self.rollout.portal.CLIENT
|
|
for clients in [[dict(client, redirectUris=["https://other.invalid/callback"])],
|
|
[dict(client, allowedScopes=["openid", "admin"])],
|
|
[client, client]]:
|
|
with self.subTest(clients=clients), self.assertRaises(self.rollout.Refused):
|
|
self.rollout.replacement(self.fixture(clients)[0])
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|