net-kingdom/tests/test_user_engine_platform_expansion.py

from pathlib import Path
import unittest


ROOT = Path(__file__).parents[1]


class UserEnginePlatformExpansionContractTests(unittest.TestCase):
    def test_contract_keeps_authorization_fail_closed(self):
        text = (ROOT / "docs/user-engine-platform-expansion-contract.md").read_text()
        self.assertIn("fail closed", text)
        self.assertIn("decision ID", text)
        self.assertIn("USER_ENGINE_FLEX_AUTH_URL", text)

    def test_contract_requires_idempotent_bounded_delivery(self):
        text = (ROOT / "docs/user-engine-platform-expansion-contract.md").read_text()
        self.assertIn("Idempotency-Key", text)
        self.assertIn("bounded attempts", text)
        self.assertIn("dead-letter", text)
        self.assertIn("OpenBao", text)

    def test_desired_manifest_authenticates_flex_auth_calls(self):
        manifest = (ROOT / "sso-mfa/k8s/user-engine/runtime.yaml").read_text()
        self.assertIn("USER_ENGINE_FLEX_AUTH_URL", manifest)
        self.assertIn("USER_ENGINE_FLEX_AUTH_TOKEN_FILE", manifest)
        self.assertIn("serviceAccountName: user-engine", manifest)
        self.assertIn("audience: flex-auth", manifest)
        self.assertIn("mountPath: /var/run/secrets/flex-auth-caller", manifest)
        self.assertIn("automountServiceAccountToken: false", manifest)


if __name__ == "__main__":
    unittest.main()