net-kingdom/sso-mfa/k8s/keycape/test_openbao_client_config.py

#!/usr/bin/env python3
"""Focused regression tests for the code-defined OpenBao KeyCape client."""

from __future__ import annotations

import importlib.util
import unittest
from pathlib import Path


MODULE_PATH = Path(__file__).with_name("openbao-client-config.py")
SPEC = importlib.util.spec_from_file_location("openbao_client_config", MODULE_PATH)
assert SPEC and SPEC.loader
MODULE = importlib.util.module_from_spec(SPEC)
SPEC.loader.exec_module(MODULE)

LOOPBACK_CALLBACK = "http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback"


class OpenBaoClientConfigTest(unittest.TestCase):
    def test_operator_tunnel_callback_is_required(self) -> None:
        self.assertIn(LOOPBACK_CALLBACK, MODULE.OPENBAO_CLIENT["redirectUris"])

    def test_missing_operator_tunnel_callback_fails_verification(self) -> None:
        client = dict(MODULE.OPENBAO_CLIENT)
        client["redirectUris"] = [
            uri for uri in MODULE.OPENBAO_CLIENT["redirectUris"] if uri != LOOPBACK_CALLBACK
        ]
        errors = MODULE.client_errors({"clients": [client]}, MODULE.OPENBAO_CLIENT)
        self.assertEqual(
            errors,
            [f"openbao-admin.redirectUris missing: {LOOPBACK_CALLBACK}"],
        )

    def test_retired_public_callbacks_are_not_declared(self) -> None:
        for uri in MODULE.RETIRED_OPENBAO_REDIRECT_URIS:
            self.assertNotIn(uri, MODULE.OPENBAO_CLIENT["redirectUris"])

    def test_retired_public_callback_fails_verification(self) -> None:
        client = dict(MODULE.OPENBAO_CLIENT)
        retired = MODULE.RETIRED_OPENBAO_REDIRECT_URIS[0]
        client["redirectUris"] = [*MODULE.OPENBAO_CLIENT["redirectUris"], retired]
        self.assertEqual(
            MODULE.retired_redirect_errors({"clients": [client]}),
            [f"openbao-admin.redirectUris retired: {retired}"],
        )

    def test_upsert_removes_retired_callbacks(self) -> None:
        stale = dict(MODULE.OPENBAO_CLIENT)
        stale["redirectUris"] = [*MODULE.OPENBAO_CLIENT["redirectUris"], *MODULE.RETIRED_OPENBAO_REDIRECT_URIS]
        updated = MODULE.upsert_client({"clients": [stale]}, MODULE.OPENBAO_CLIENT)
        self.assertEqual(MODULE.retired_redirect_errors(updated), [])

    def test_upsert_preserves_unrelated_clients(self) -> None:
        config = {"clients": [{"clientId": "unrelated", "clientType": "public"}]}
        updated = MODULE.upsert_client(config, MODULE.OPENBAO_CLIENT)
        self.assertEqual(updated["clients"][0]["clientId"], "unrelated")
        self.assertIn(LOOPBACK_CALLBACK, updated["clients"][1]["redirectUris"])


if __name__ == "__main__":
    unittest.main()