tegwick
1e1e077b27
TokenReview-based caller identity with audience-scoped tokens and exact resource.system to ServiceAccount bindings, per ops-warden's recommendation. Deletes the unwired tenant-engine live-roles adapter (T03) and adds make verify-posture (T05). Source implements A2; running digest is still A0 until promotion, so tenancy.current.A stays 0. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
72 lines
2.8 KiB
Go
72 lines
2.8 KiB
Go
package callerauth
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
type fakeReviewer struct {
|
|
identity Identity
|
|
err error
|
|
}
|
|
|
|
func (f fakeReviewer) Review(context.Context, string) (Identity, error) {
|
|
return f.identity, f.err
|
|
}
|
|
|
|
func TestAuthenticatorEnforcesAudienceAndSystemBinding(t *testing.T) {
|
|
authenticator, err := New(ModeEnforce, fakeReviewer{identity: Identity{
|
|
Username: "system:serviceaccount:tenant-engine:tenant-engine",
|
|
Audiences: []string{"flex-auth"},
|
|
}}, "flex-auth", map[string]string{
|
|
"tenant-engine": "system:serviceaccount:tenant-engine:tenant-engine",
|
|
}, nil)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := authenticator.Authorize(context.Background(), "Bearer caller-token", []string{"tenant-engine"}); err != nil {
|
|
t.Fatalf("Authorize: %v", err)
|
|
}
|
|
if err := authenticator.Authorize(context.Background(), "Bearer caller-token", []string{"user-engine"}); !errors.Is(err, ErrForbidden) {
|
|
t.Fatalf("system mismatch error = %v; want forbidden", err)
|
|
}
|
|
|
|
wrongAudience, _ := New(ModeEnforce, fakeReviewer{identity: Identity{
|
|
Username: "system:serviceaccount:tenant-engine:tenant-engine",
|
|
Audiences: []string{"kubernetes"},
|
|
}}, "flex-auth", map[string]string{"tenant-engine": "system:serviceaccount:tenant-engine:tenant-engine"}, nil)
|
|
if err := wrongAudience.Authorize(context.Background(), "Bearer caller-token", []string{"tenant-engine"}); !errors.Is(err, ErrUnauthenticated) {
|
|
t.Fatalf("audience error = %v; want unauthenticated", err)
|
|
}
|
|
}
|
|
|
|
func TestAuthenticatorRejectsMissingTokenAndReviewerFailure(t *testing.T) {
|
|
bindings := map[string]string{"tenant-engine": "principal"}
|
|
authenticator, _ := New(ModeEnforce, fakeReviewer{identity: Identity{Username: "principal", Audiences: []string{"flex-auth"}}}, "flex-auth", bindings, nil)
|
|
if err := authenticator.Authorize(context.Background(), "", []string{"tenant-engine"}); !errors.Is(err, ErrUnauthenticated) {
|
|
t.Fatalf("missing token error = %v; want unauthenticated", err)
|
|
}
|
|
|
|
unavailable, _ := New(ModeEnforce, fakeReviewer{err: errors.New("apiserver down")}, "flex-auth", bindings, nil)
|
|
if err := unavailable.Authorize(context.Background(), "Bearer token", []string{"tenant-engine"}); !errors.Is(err, ErrUnavailable) {
|
|
t.Fatalf("reviewer error = %v; want unavailable", err)
|
|
}
|
|
}
|
|
|
|
func TestAuthenticatorWarnModePermitsButRecordsFailure(t *testing.T) {
|
|
var warning string
|
|
authenticator, err := New(ModeWarn, fakeReviewer{}, "flex-auth", map[string]string{"tenant-engine": "principal"}, func(format string, _ ...any) {
|
|
warning = format
|
|
})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := authenticator.Authorize(context.Background(), "", []string{"tenant-engine"}); err != nil {
|
|
t.Fatalf("warn mode returned error: %v", err)
|
|
}
|
|
if !strings.Contains(warning, "warning") {
|
|
t.Fatalf("warning = %q", warning)
|
|
}
|
|
}
|