tegwick
1e0df2f4a3
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
119 lines
7.2 KiB
Python
119 lines
7.2 KiB
Python
"""Real candidate Access Engine policy; authentication custody remains synthetic."""
|
|
from dataclasses import replace
|
|
import os
|
|
from pathlib import Path
|
|
import time
|
|
|
|
import pytest
|
|
|
|
from informed_decision.disposition import Actor, ActorKind
|
|
from informed_decision.lifecycle import Attribution, LifecycleRepository
|
|
from informed_decision.lifecycle_service import Caller, LifecycleError, LifecycleService
|
|
from informed_decision.records import dumps
|
|
from informed_decision.store import Store
|
|
from review_components import flex_component
|
|
from test_browser_auth import signing_key
|
|
from test_lifecycle import workspace
|
|
from test_policy_client import human
|
|
|
|
|
|
def test_initial_audience_collaborates_across_revisions_with_real_pdp(workspace, tmp_path, signing_key):
|
|
binary = os.environ.get('INFD_FLEX_AUTH_BINARY')
|
|
source = os.environ.get('INFD_FLEX_AUTH_SOURCE')
|
|
if not binary or not source:
|
|
pytest.skip('set INFD_FLEX_AUTH_BINARY and INFD_FLEX_AUTH_SOURCE for candidate owner policy')
|
|
fixture = Path(source) / 'examples/informed-decision-lifecycle'
|
|
pins = (fixture / 'pin.json').read_bytes()
|
|
with flex_component(binary, tmp_path, signing_key, fixture=fixture) as (pdp, calls):
|
|
repo, memo = workspace
|
|
app = LifecycleService(repo, pdp)
|
|
hub = Caller(Attribution('tenant:platform', Actor('system:serviceaccount:state-hub:state-hub', ActorKind.SERVICE)),
|
|
time.time() + 600, dumps({'principal_type_source': 'authentication-derived',
|
|
'tenant_source': 'registration-supplied', 'authentication_audience': 'informed-decision-lifecycle',
|
|
'workload_uid': 'synthetic-verified-uid'}))
|
|
person = Caller.from_human_session(human())
|
|
app.register(hub, memo, key='first')
|
|
with pytest.raises(LifecycleError):
|
|
app.retrieve(person, memo.id)
|
|
app.publish(hub, memo.id, 1, audience={'groups': ['net-kingdom-admins'], 'subjects': []}, key='publish')
|
|
app.annotate(person, memo.id, 1, kind='comment', body={'text': 'Consider the alternative'}, key='comment')
|
|
app.revise(person, memo.next_version(brief='Alternative assessed'), expected_version=1, summary='Refined', key='refine')
|
|
# The successor is unpublished; its editor and original author retain access.
|
|
assert app.retrieve(person, memo.id).version == 2
|
|
assert app.retrieve(hub, memo.id).version == 2
|
|
other = Caller.from_human_session(replace(human(), subject='another-admin'))
|
|
with pytest.raises(LifecycleError):
|
|
app.retrieve(other, memo.id)
|
|
app.publish(person, memo.id, 2, audience={'groups': ['net-kingdom-admins'], 'subjects': []}, key='republish')
|
|
assert app.retrieve(other, memo.id).version == 2
|
|
app.register(hub, replace(memo, id='second-decision'), key='second')
|
|
reopened = LifecycleService(LifecycleRepository(Store(repo.store.path)), pdp)
|
|
assert reopened.retrieve(person, memo.id).version == 2
|
|
foreign = replace(hub, attribution=Attribution('tenant:platform', Actor('system:serviceaccount:other:other', ActorKind.SERVICE)))
|
|
with pytest.raises(LifecycleError):
|
|
reopened.retrieve(foreign, memo.id)
|
|
assert calls and all(c['known'] and c['audiences'] == ['flex-auth'] for c in calls)
|
|
assert (fixture / 'pin.json').read_bytes() == pins
|
|
|
|
|
|
@pytest.mark.parametrize("stale_field", ["version", "package_digest"])
|
|
def test_stale_consumer_pin_fails_closed_until_exact_owner_repin(workspace, tmp_path, signing_key, stale_field):
|
|
binary = os.environ.get('INFD_FLEX_AUTH_BINARY')
|
|
source = os.environ.get('INFD_FLEX_AUTH_SOURCE')
|
|
if not binary or not source:
|
|
pytest.skip('set INFD_FLEX_AUTH_BINARY and INFD_FLEX_AUTH_SOURCE for candidate owner policy')
|
|
fixture = Path(source) / 'examples/informed-decision-lifecycle'
|
|
with flex_component(binary, tmp_path, signing_key, fixture=fixture) as (pdp, calls):
|
|
repo, memo = workspace
|
|
app = LifecycleService(repo, pdp)
|
|
hub = Caller(Attribution('tenant:platform', Actor('system:serviceaccount:state-hub:state-hub', ActorKind.SERVICE)),
|
|
time.time() + 600, dumps({'principal_type_source': 'authentication-derived',
|
|
'tenant_source': 'registration-supplied', 'authentication_audience': 'informed-decision-lifecycle',
|
|
'workload_uid': 'synthetic-verified-uid'}))
|
|
current = getattr(pdp, stale_field)
|
|
setattr(pdp, stale_field, 'v1' if stale_field == 'version' else
|
|
'sha256:cee6a79f74e81d0d389a2c2e2451a92be3434ea9dfcee4986e8c7e6cfdbb1827')
|
|
with pytest.raises(LifecycleError) as refused:
|
|
app.register(hub, memo, key='repin-proof')
|
|
assert refused.value.status == 503 and refused.value.code == 'invalid_decision'
|
|
with repo.store._connection() as db:
|
|
assert db.execute('SELECT count(*) FROM memos').fetchone()[0] == 0
|
|
assert db.execute('SELECT count(*) FROM lifecycle_events').fetchone()[0] == 0
|
|
setattr(pdp, stale_field, current)
|
|
app.register(hub, memo, key='repin-proof')
|
|
assert app.retrieve(hub, memo.id) == memo
|
|
assert calls and all(c['known'] and c['audiences'] == ['flex-auth'] for c in calls)
|
|
|
|
|
|
def test_real_enforcement_response_with_readback_purpose_cannot_authorize(workspace, tmp_path, signing_key):
|
|
binary = os.environ.get('INFD_FLEX_AUTH_BINARY')
|
|
source = os.environ.get('INFD_FLEX_AUTH_SOURCE')
|
|
if not binary or not source:
|
|
pytest.skip('set INFD_FLEX_AUTH_BINARY and INFD_FLEX_AUTH_SOURCE for candidate owner policy')
|
|
fixture = Path(source) / 'examples/informed-decision-lifecycle'
|
|
with flex_component(binary, tmp_path, signing_key, fixture=fixture) as (pdp, calls):
|
|
repo, memo = workspace
|
|
app = LifecycleService(repo, pdp)
|
|
hub = Caller(Attribution('tenant:platform', Actor('system:serviceaccount:state-hub:state-hub', ActorKind.SERVICE)),
|
|
time.time() + 600, dumps({'principal_type_source': 'authentication-derived',
|
|
'tenant_source': 'registration-supplied', 'authentication_audience': 'informed-decision-lifecycle',
|
|
'workload_uid': 'synthetic-verified-uid'}))
|
|
original = pdp.transport.request
|
|
def advisory_response(*args, **kwargs):
|
|
status, data = original(*args, **kwargs)
|
|
assert status == 200 and data['effect'] == 'allow'
|
|
assert data['binding'].get('purpose', '') == ''
|
|
# Keep the real request binding, digest, pins and TTL unchanged:
|
|
# even an otherwise exact allow cannot cross the advisory boundary.
|
|
data['binding']['purpose'] = 'readback'
|
|
return status, data
|
|
pdp.transport.request = advisory_response
|
|
with pytest.raises(LifecycleError) as refused:
|
|
app.register(hub, memo, key='advisory-proof')
|
|
assert refused.value.status == 503 and refused.value.code == 'invalid_decision'
|
|
with repo.store._connection() as db:
|
|
assert db.execute('SELECT count(*) FROM memos').fetchone()[0] == 0
|
|
assert db.execute('SELECT count(*) FROM lifecycle_events').fetchone()[0] == 0
|
|
pdp.transport.request = original
|
|
app.register(hub, memo, key='advisory-proof')
|
|
assert app.retrieve(hub, memo.id) == memo
|