coulomb/informed-decision
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Deploy verified-group T03 review surface and packet preparation

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
This commit is contained in:
tegwick 2026-09-14 02:47:31 +02:00
parent c5367a5a54
commit 6fb35d953b
14 changed files with 2876 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

5
tests/test_browser_auth.py
View file

@ -46,7 +46,7 @@ class IssuerFixture:
assert challenge == self.params["code_challenge"]
claims = {"iss": ISSUER, "sub": "human-fixture", "iat": self.now, "exp": self.now + 900,
"tenant": "tenant:platform", "tenant_source": "registration", "principal_type": "human",
"roles": [], "assurance": {"at": self.now - 120, "level": "aal2", "mfa": True,
"roles": [], "groups": ["net-kingdom-admins"], "assurance": {"at": self.now - 120, "level": "aal2", "mfa": True,
"methods": ["pwd", "otp"], "source": "key-cape"}}
payloads = {"id_token": {**copy.deepcopy(claims), "aud": CLIENT_ID, "nonce": self.params["nonce"]},
"access_token": {**copy.deepcopy(claims), "aud": "approval-engine",
@ -94,6 +94,7 @@ def test_pkce_nonce_scope_and_imported_human_session(login):
sid = finish(login)
session = login[0].session(sid)
assert session.subject == "human-fixture"
assert session.groups == ("net-kingdom-admins",)
assert session.principal_type.route is Route.AUTHENTICATION
assert session.tenant.route is Route.REGISTRATION
assert session.assurance["at"] == login[1].now - 120 # Authentication, never mint time.
@ -115,6 +116,8 @@ def test_pkce_nonce_scope_and_imported_human_session(login):
("both", "tenant_source", ["registration"]),
("access_token", "scope", "openid approval:read approval:approve approval:consume"),
("access_token", "scope", "openid approval:approve"), ("access_token", "scope", ["openid"]),
("access_token", "groups", None), ("access_token", "groups", "net-kingdom-admins"),
("access_token", "groups", [1]), ("access_token", "groups", [""]),
("access_token", "roles", None), ("access_token", "roles", [1]),
("both", "assurance", {}),
("access_token", "exp", 1), ("id_token", "exp", 1),

3
tests/test_policy_client.py
View file

@ -19,7 +19,7 @@ STAMP = lambda t: datetime.fromtimestamp(t, timezone.utc).isoformat()
def human():
return HumanSession("human-fixture", Claim("tenant:platform", Route.REGISTRATION),
Claim("human", Route.AUTHENTICATION), {"at": int(time.time()) - 20, "level": "aal2", "mfa": True,
"methods": ["pwd", "otp"], "source": "key-cape"}, time.time()+600, "synthetic-browser-token", roles=("Reviewer",))
"methods": ["pwd", "otp"], "source": "key-cape"}, time.time()+600, "synthetic-browser-token", roles=("Reviewer",), groups=("net-kingdom-admins",))
def envelope(request):
@ -56,6 +56,7 @@ def test_request_preserves_identity_routes_and_excludes_presentation_claims():
req=request(); attributes=req["subject"]["attributes"]
assert attributes["tenant_source"]=="registration-supplied" and attributes["principal_type_source"]=="authentication-derived"
assert attributes["roles"]==["Reviewer"]
assert attributes["groups"]==["net-kingdom-admins"]
assert set(req["context"])=={"memo_version","approval_id","approval_binding_digest"}
assert "synthetic-browser-token" not in json.dumps(req)
assert not any(k in json.dumps(req) for k in ["view_hash","presentation_id","acked_highlight_ids"])