39 lines
1 KiB
Go
39 lines
1 KiB
Go
|
package main
|
||
|
|
|
||
|
|
import (
|
||
|
|
"keycape/internal/config"
|
||
|
|
"testing"
|
||
|
|
"time"
|
||
|
|
)
|
||
|
|
|
||
|
|
func TestServiceRegistrationAudienceAndScopeIsolation(t *testing.T) {
|
||
|
|
cfg, err := config.Load("../../../config/service-clients.example.yaml")
|
||
|
|
if err != nil {
|
||
|
|
t.Fatal(err)
|
||
|
|
}
|
||
|
|
for _, c := range cfg.Clients {
|
||
|
|
t.Setenv(c.SecretRef[4:], "test-only-secret")
|
||
|
|
}
|
||
|
|
registry, err := buildClientRegistry(cfg.Clients)
|
||
|
|
if err != nil {
|
||
|
|
t.Fatal(err)
|
||
|
|
}
|
||
|
|
for _, id := range []string{"secrets-engine-approval", "approval-engine-operator"} {
|
||
|
|
c := registry[id]
|
||
|
|
if c == nil || c.Audience != "approval-engine" || c.TokenLifetime != 15*time.Minute {
|
||
|
|
t.Fatalf("invalid registration for %s", id)
|
||
|
|
}
|
||
|
|
for _, scope := range c.AllowedScopes {
|
||
|
|
if id == "approval-engine-operator" && scope == "approval:consume" {
|
||
|
|
t.Fatal("operator may not consume")
|
||
|
|
}
|
||
|
|
if id == "secrets-engine-approval" && scope != "approval:read" && scope != "approval:consume" {
|
||
|
|
t.Fatal("excess PEP scope")
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
if registry["secrets-engine-openbao"].Audience != "" {
|
||
|
|
t.Fatal("OpenBao audience default changed")
|
||
|
|
}
|
||
|
|
}
|