tegwick
ca563504c4
Warden failed closed on leftover JSON after a successful create. Objects are requested, no entries. Flex Auth package draft pins the seven ids; c01 skipped. No human bind. Assistant: grok Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267
76 lines
3 KiB
Python
76 lines
3 KiB
Python
import importlib.util
|
|
import json
|
|
from pathlib import Path
|
|
|
|
import pytest
|
|
|
|
spec = importlib.util.spec_from_file_location(
|
|
"create_sitting_approvals",
|
|
Path(__file__).resolve().parents[1] / "tools" / "create_sitting_approvals.py",
|
|
)
|
|
create = importlib.util.module_from_spec(spec)
|
|
spec.loader.exec_module(create)
|
|
|
|
|
|
def test_dry_run_lists_seven_and_skips_c01():
|
|
report = create.dry_run()
|
|
assert report["posted"] is False
|
|
assert report["skipped"] == ["infd-20260914-c01"]
|
|
assert len(report["memo_ids"]) == 7
|
|
assert "infd-20260914-c01" not in report["memo_ids"]
|
|
assert report["memo_ids"][0] == "infd-20260914-c02"
|
|
assert report["memo_ids"][-1] == "infd-20260914-d04"
|
|
|
|
|
|
def test_require_attended_refuses_this_shell():
|
|
with pytest.raises(create.Refused, match="attended_reader_required"):
|
|
create.require_attended()
|
|
|
|
|
|
def test_created_receipt_has_seven_requested_and_no_entries():
|
|
receipt = json.loads((Path(__file__).resolve().parents[1] / "docs" / "evidence" / "2026-09-15-sitting-approval-creates.json").read_text())
|
|
assert receipt["status"] == "created"
|
|
assert receipt["human_entries_created"] is False
|
|
assert receipt["credential_values_emitted"] is False
|
|
assert len(receipt["requests"]) == 7
|
|
assert receipt["skipped"] == ["infd-20260914-c01"]
|
|
for row in receipt["requests"]:
|
|
approval = row["approval"]
|
|
assert approval["status"] == "requested"
|
|
assert approval["entries"] == []
|
|
assert approval["binding"]["human_control"] is True
|
|
assert approval["binding"]["digest"].startswith("sha256:")
|
|
|
|
|
|
def test_policy_package_pins_match_created_receipt():
|
|
root = Path(__file__).resolve().parents[1] / "docs" / "batches" / "2026-09-14"
|
|
receipt = json.loads((Path(__file__).resolve().parents[1] / "docs" / "evidence" / "2026-09-15-sitting-approval-creates.json").read_text())
|
|
package = (root / "policy-package.md").read_text()
|
|
assert "c01" not in package or "infd-20260914-c01" not in package
|
|
for row in receipt["requests"]:
|
|
assert f'memo:{row["memo_id"]}' in package
|
|
assert row["approval"]["id"] in package
|
|
assert row["approval"]["binding"]["digest"] in package
|
|
|
|
|
|
def test_failed_receipt_does_not_block_retry(tmp_path, monkeypatch):
|
|
receipt = tmp_path / "r.json"
|
|
monkeypatch.setattr(create, "RECEIPT", receipt)
|
|
receipt.write_text('{"status": "failed", "phase": "preflight"}\n')
|
|
assert create.existing_receipt_blocks() is False
|
|
receipt.write_text('{"status": "created", "phase": "seven_unapproved_requests_created"}\n')
|
|
assert create.existing_receipt_blocks() is True
|
|
|
|
|
|
@pytest.mark.parametrize(
|
|
"origin,ok",
|
|
[
|
|
("http://127.0.0.1:18281", True),
|
|
("http://approval-engine.approval-engine.svc.cluster.local:8080", True),
|
|
("https://evil.example", False),
|
|
("http://10.43.103.108:8080", False),
|
|
(None, False),
|
|
],
|
|
)
|
|
def test_approval_origin_is_loopback_or_in_cluster_only(origin, ok):
|
|
assert create._approval_origin_ok(origin) is ok
|