tegwick
6f33abddcf
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 41s
Assistant: codex Assistant-Model: gpt-5.6-luna Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
79 lines
4 KiB
Python
79 lines
4 KiB
Python
import importlib.util
|
|
from pathlib import Path
|
|
import unittest
|
|
|
|
spec = importlib.util.spec_from_file_location('probe_renderer', Path(__file__).with_name('render-upstream-issuer-probe.py'))
|
|
renderer = importlib.util.module_from_spec(spec)
|
|
spec.loader.exec_module(renderer)
|
|
IMAGE = 'forgejo.coulomb.social/coulomb/key-cape@sha256:' + 'a' * 64
|
|
STATE = 'A' * 43
|
|
UID = '12345678-1234-1234-1234-123456789abc'
|
|
|
|
|
|
class RenderProbeTests(unittest.TestCase):
|
|
def test_dedicated_route_and_pod_cannot_join_production_service(self):
|
|
packet = renderer.render(IMAGE, STATE, UID)
|
|
job = packet['job']
|
|
pod = job['spec']['template']
|
|
self.assertNotIn('app.kubernetes.io/name', pod['metadata']['labels'])
|
|
self.assertFalse(pod['spec']['automountServiceAccountToken'])
|
|
self.assertEqual(job['spec']['activeDeadlineSeconds'], 600)
|
|
self.assertEqual(job['spec']['backoffLimit'], 0)
|
|
self.assertEqual(job['spec']['ttlSecondsAfterFinished'], 300)
|
|
children = packet['children']['items']
|
|
self.assertEqual(len(children), 4)
|
|
for child in children:
|
|
self.assertEqual(child['metadata']['ownerReferences'][0]['uid'], UID)
|
|
route = children[1]['spec']['routes'][0]
|
|
self.assertIn('Query(`state`, `' + STATE + '`)', route['match'])
|
|
self.assertIn('Path(`/authorize/callback`)', route['match'])
|
|
self.assertNotIn('PathPrefix', route['match'])
|
|
self.assertFalse(route['observability']['accessLogs'])
|
|
self.assertFalse(route['observability']['tracing'])
|
|
|
|
def test_only_config_yaml_is_projected_without_signing_key_or_api_token(self):
|
|
pod = renderer.render(IMAGE, STATE)['job']['spec']['template']['spec']
|
|
self.assertEqual(len(pod['volumes']), 1)
|
|
secret = pod['volumes'][0]['secret']
|
|
self.assertEqual(secret['secretName'], 'keycape-config')
|
|
self.assertEqual(secret['items'], [{'key': 'config.yaml', 'path': 'config.yaml', 'mode': 0o440}])
|
|
security = pod['containers'][0]['securityContext']
|
|
self.assertTrue(security['readOnlyRootFilesystem'])
|
|
self.assertFalse(security['allowPrivilegeEscalation'])
|
|
|
|
def test_no_route_or_scope_injection_and_no_mutable_image(self):
|
|
for state in ['', STATE + '`)', 'B' * 43, 'A' * 22]:
|
|
with self.assertRaises(ValueError):
|
|
renderer.render(IMAGE, state)
|
|
with self.assertRaises(ValueError):
|
|
renderer.render('forgejo.coulomb.social/coulomb/key-cape:latest', STATE)
|
|
with self.assertRaises(ValueError):
|
|
renderer.render(IMAGE, STATE, 'arbitrary-owner')
|
|
|
|
|
|
if __name__ == '__main__':
|
|
unittest.main()
|
|
|
|
class ReceiptTests(unittest.TestCase):
|
|
def setUp(self):
|
|
import json
|
|
self.json = json
|
|
spec = importlib.util.spec_from_file_location('collector', Path(__file__).with_name('collect-upstream-issuer-proof.py'))
|
|
self.collector = importlib.util.module_from_spec(spec)
|
|
spec.loader.exec_module(self.collector)
|
|
self.receipt = {'schema': 'keycape.upstream-issuer-proof.v1', 'status': 'verified',
|
|
'observed_at': '2026-09-08T22:00:00Z', 'issuer': 'https://auth.coulomb.social',
|
|
'tokens_retained': False, 'downstream_credential_issued': False,
|
|
'signature_verified': True, 'audience_verified': True,
|
|
'validity_window_verified': True, 'nonce_verified': True}
|
|
|
|
def test_verified_receipt_is_preserved(self):
|
|
self.assertEqual(self.collector.sanitize(self.json.dumps(self.receipt)), self.receipt)
|
|
|
|
def test_extra_claims_unverified_issuers_and_untyped_success_are_refused(self):
|
|
for patch in [{'sub': 'private-user'}, {'issuer': 'https://unreviewed.example'},
|
|
{'signature_verified': 1}, {'tokens_retained': True}]:
|
|
with self.assertRaises(ValueError):
|
|
self.collector.sanitize(self.json.dumps(dict(self.receipt, **patch)))
|
|
with self.assertRaises(ValueError):
|
|
self.collector.sanitize(self.json.dumps(self.receipt) + '\nprivate-token')
|