net-kingdom/tests/test_executor_lanes.py

"""executor-lanes.py against an in-memory OpenBao and Kubernetes (NK-WP-0056-T10); no values leave the fakes."""
import hashlib
import importlib.util
import json
import shutil
import subprocess
import sys
from pathlib import Path
from types import SimpleNamespace

import pytest

ROOT = Path(__file__).resolve().parents[1]
PLATFORM = ROOT.parent / 'railiance-platform'
CCRS = {'write': 'CCR-2026-0058-net-kingdom-bind-executor-svc-authelia-write.yaml',
        'journey': 'CCR-2026-0059-net-kingdom-bind-executor-syn-journey-read.yaml'}
JOURNEY = 'platform/data/workloads/net-kingdom/synthetic-journey/syn-journey'
BIND = 'platform/data/workloads/net-kingdom/directory-binds/svc-authelia'
FENCE = ''.join(f'path "{p}" {{ capabilities = ["deny"] }}\n' for p in (
    JOURNEY, JOURNEY.replace('/data/', '/metadata/'), BIND, BIND.replace('/data/', '/metadata/')))

pytestmark = pytest.mark.skipif(not all((PLATFORM / 'credential-change-requests' / c).exists() for c in CCRS.values()),
                                reason='railiance-platform checkout with CCR-2026-0058/0059 required')


def platform_copy(tmp_path, confirm=True):
    root = tmp_path / 'railiance-platform'
    shutil.copytree(PLATFORM / 'scripts', root / 'scripts', ignore=shutil.ignore_patterns('__pycache__'))
    (root / 'openbao').mkdir(); shutil.copytree(PLATFORM / 'openbao' / 'policies', root / 'openbao' / 'policies')
    (root / 'credential-change-requests').mkdir()
    for name in CCRS.values():
        shutil.copy(PLATFORM / 'credential-change-requests' / name, root / 'credential-change-requests' / name)
        copy = root / 'credential-change-requests' / name
        if not confirm:  # the real CCRs are confirmed since 2026-10-31; undo it in the copy
            copy.write_text(copy.read_text().replace('bound_claims_confirmed: true', 'bound_claims_confirmed: false'))
        elif 'bound_claims_confirmed: true' not in copy.read_text():
            subprocess.run([sys.executable, str(root / 'scripts/credential-change.py'), 'confirm-binding',
                            '--reviewer', 'platform-owner', '--comment', 'synthetic test',
                            str(root / 'credential-change-requests' / name)], check=True, capture_output=True)
    return root


def digests(root):
    return {k: hashlib.sha256((root / 'credential-change-requests' / v).read_bytes()).hexdigest() for k, v in CCRS.items()}


def m_key(m):
    return m.CAS_KEY


class FakeBao:
    def __init__(self, m):
        self.m = m
        self.store = {m.BOUNDARY: {'policy': 'path "x" { capabilities = ["deny"] }\n' + FENCE}}
        self.cas = False
        self.meta = {'max_versions': 0, 'delete_version_after': '0s', 'custom_metadata': None}
        self.meta_write_clobbers = False
        self.identity = {'policies': ['platform-admin'], 'path': 'auth/netkingdom/oidc/callback'}
        self.login_ok = {('nk-bind-executor', 'openbao', m.LANES['journey']['role'])}
        self.wide = False
        self.revoked = []

    def __call__(self, args, *, payload=None, token=None, allow_failure=False):
        out = lambda d, code=0, err=b'': SimpleNamespace(returncode=code, stdout=json.dumps(d).encode(), stderr=err)
        missing = out({}, 2, b'No value found')
        if args[:2] == ['token', 'lookup']: return out({'data': self.identity})
        if args[:2] == ['token', 'create']: return out({'auth': {'client_token': 'child'}})
        if args[0] == 'read' and args[-1] == m_key(self.m):
            return out({'data': {'cas_required': self.cas, **self.meta}})
        if args[0] == 'read':
            path = args[-1]
            if path == JOURNEY and token == 'reader':
                return out({'data': {'data': {'PASSWORD': 'SYNTHETIC-PW-VALUE', 'TOTP_SEED': 'SYNTHETIC-SEED-VALUE'}, 'metadata': {'version': 1}}})
            return out({'data': self.store[path]}) if path in self.store else missing
        if args[0] == 'write':
            path = args[-2] if args[-1] == '-' else args[-1]
            if path == 'auth/token/revoke': self.revoked.append(payload['token']); return out({})
            if path == 'sys/capabilities':
                def cap(p):
                    if payload['token'] == 'reader' and (p == JOURNEY or self.wide): return ['read']
                    return ['deny']
                return out({'data': {p: cap(p) for p in payload['paths']}})
            if path == 'auth/kubernetes/login':
                sa, aud = payload['jwt'].split('|')
                if (sa, aud, payload['role']) in self.login_ok:
                    return out({'auth': {'client_token': 'reader', 'lease_duration': 900,
                                         'token_policies': [self.m.LANES['journey']['policy']]}})
                return out({}, 2, b'Code: 403')
            if path == m_key(self.m):
                assert payload == {'cas_required': True}
                self.cas = True
                if self.meta_write_clobbers: self.meta = {**self.meta, 'max_versions': 10}
                return out({})
            if path.startswith('auth/kubernetes/role/'):
                self.store[path] = {k: (900 if v == '15m' else v) for k, v in payload.items()}; return out({})
            self.store[path] = payload; return out({})
        raise AssertionError(args)


def build(tmp_path, monkeypatch, confirm=True):
    root = platform_copy(tmp_path, confirm)
    monkeypatch.setenv('NK_PLATFORM_ROOT', str(root))
    spec = importlib.util.spec_from_file_location('executor_lanes', ROOT / 'tools/service-binds/executor-lanes.py')
    m = importlib.util.module_from_spec(spec); spec.loader.exec_module(m)
    fake = FakeBao(m)
    for module in (m, sys.modules['state_hub_preflight_lane'], sys.modules['telemetry_smtp_delivery']):
        if hasattr(module, 'bao'):
            monkeypatch.setattr(module, 'bao', fake)  # the real helpers (ensure, capabilities, revoke) run on the fake
    monkeypatch.setattr(m, 'kube', lambda kc, args: f'{args[4]}|{args[5].split("=", 1)[1]}'.encode())
    return m, fake, digests(root)


def run(m, action, d):
    r = {}
    try:
        (m.setup(d, r) if action == 'setup' else m.verify(d, 'kc', r))
    except m.Refused as error:
        r.update(status='failed', reason=str(error))
    return r


def test_setup_applies_policies_cas_and_journey_role_but_never_the_write_role(tmp_path, monkeypatch):
    m, fake, d = build(tmp_path, monkeypatch)
    r = run(m, 'setup', d)
    assert r['status'] == 'lanes_prepared', r
    for lane in m.LANES.values():
        assert fake.store['sys/policies/acl/' + lane['policy']]['policy'] == lane['policy_text']
    assert fake.cas is True
    assert 'auth/kubernetes/role/' + m.LANES['journey']['role'] in fake.store
    assert 'auth/kubernetes/role/' + m.LANES['write']['role'] not in fake.store
    assert run(m, 'setup', d)['status'] == 'lanes_prepared'  # idempotent


def test_verify_after_setup(tmp_path, monkeypatch):
    m, fake, d = build(tmp_path, monkeypatch)
    run(m, 'setup', d)
    r = run(m, 'verify', d)
    assert r['status'] == 'lanes_verified', r
    assert r['write_login_denied'] and r['wrong_audience_denied'] and 'reader' in fake.revoked
    assert 'SYNTHETIC-' not in json.dumps(r)  # no values in the receipt


@pytest.mark.parametrize('mutate, reason', [
    (lambda m, f, d: d.update(write='0' * 64), 'write:ccr_digest'),
    (lambda m, f, d: f.store.update({m.BOUNDARY: {'policy': 'path "x" { capabilities = ["deny"] }\n'}}),
     'agent_fence_missing'),
    (lambda m, f, d: f.identity.update(policies=['root']), 'attended_platform_admin_required'),
    (lambda m, f, d: f.store.update({'auth/kubernetes/role/' + m.LANES['write']['role']: {}}),
     'write_role_exists_outside_a_window'),
    (lambda m, f, d: f.store.update({'sys/policies/acl/' + m.LANES['journey']['policy']: {'policy': 'path "*" {}'}}),
     'net-kingdom-bind-executor-syn-journey-read:policy_drift'),
    (lambda m, f, d: setattr(f, 'meta_write_clobbers', True), 'metadata_changed_beyond_cas_required'),
])
def test_setup_refusals(tmp_path, monkeypatch, mutate, reason):
    m, fake, d = build(tmp_path, monkeypatch)
    mutate(m, fake, d)
    r = run(m, 'setup', d)
    assert (r['status'], r['reason']) == ('failed', reason)


def test_unconfirmed_binding_is_refused(tmp_path, monkeypatch):
    m, fake, d = build(tmp_path, monkeypatch, confirm=False)
    assert run(m, 'setup', d)['reason'] == 'write:binding_unconfirmed'


@pytest.mark.parametrize('mutate, reason', [
    (lambda m, f: f.login_ok.add(('nk-bind-executor', 'openbao', m.LANES['write']['role'])), 'negative_login_accepted'),
    (lambda m, f: f.login_ok.add(('default', 'openbao', m.LANES['journey']['role'])), 'negative_login_accepted'),
    (lambda m, f: setattr(f, 'wide', True), 'journey_capabilities'),
    (lambda m, f: setattr(f, 'cas', False), 'cas_required_not_set'),
])
def test_verify_refusals(tmp_path, monkeypatch, mutate, reason):
    m, fake, d = build(tmp_path, monkeypatch)
    run(m, 'setup', d)
    mutate(m, fake)
    r = run(m, 'verify', d)
    assert (r['status'], r['reason']) == ('failed', reason)