coulomb/key-cape
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Correct platform infrastructure client tenant bindings

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e324-abce-7e51-bb2b-496f097afdb0
This commit is contained in:
tegwick 2026-09-27 16:43:31 +02:00
parent 3b0446e0ef
commit 717a97408a
7 changed files with 47 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

14
src/internal/server/oidc/tenant_test.go
View file

@ -118,7 +118,7 @@ func TestApprovalClientIssuesExactPlatformTenantAndRejectsAliases(t *testing.T)
GrantTypes: []string{"client_credentials"},
ClientType: "confidential",
ClientSecret: "approval-test-secret",
ServiceSubject: "service:secrets-engine",
ServiceSubject: "service:coulomb-workload-test",
Tenant: "tenant:platform",
Roles: []string{"secrets-engine"},
}
@ -147,22 +147,22 @@ func TestApprovalClientIssuesExactPlatformTenantAndRejectsAliases(t *testing.T)
}
}
// The aligned decision grants no cross-tenant reach: the unrelated OpenBao
// login client keeps tenant:coulomb.
// Platform ownership does not elevate workload clients. Request parameters
// cannot change a workload registration's tenant.
func TestUnrelatedServiceClientKeepsCoulombTenant(t *testing.T) {
h := serviceTokenHandler(t)
h.ClientConfig["secrets-engine-openbao"] = &domain.Client{
ClientID: "secrets-engine-openbao",
h.ClientConfig["coulomb-workload-test"] = &domain.Client{
ClientID: "coulomb-workload-test",
AllowedScopes: []string{"openbao:login"},
GrantTypes: []string{"client_credentials"},
ClientType: "confidential",
ClientSecret: "openbao-test-secret",
ServiceSubject: "service:secrets-engine",
ServiceSubject: "service:coulomb-workload-test",
Tenant: "tenant:coulomb",
Roles: []string{"secrets-engine"},
}
req := tokenRequest(url.Values{"grant_type": {"client_credentials"}, "scope": {"openbao:login"}, "tenant": {"tenant:platform"}})
req.SetBasicAuth("secrets-engine-openbao", "openbao-test-secret")
req.SetBasicAuth("coulomb-workload-test", "openbao-test-secret")
w := httptest.NewRecorder()
h.ServeHTTP(w, req)
if w.Code != http.StatusOK {