coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(recovery): verify scoped delivery and create first full offsite bundle
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2
This commit is contained in:
tegwick 2026-10-16 09:21:55 +02:00
parent 8857d9ff6f
commit 17a8fa1495
15 changed files with 435 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

15
tests/test_identity_offsite.py
View file

@ -182,3 +182,18 @@ def test_provider_parent_400_requires_independent_outside_folder_denial(monkeypa
with pytest.raises(setup.Refused):setup.boundary(None,owner_auth,token,'publisher',receipt)
assert not receipt.get('provider_boundary_verified')
assert not store
def test_eso_native_default_fields_preserve_exact_source_scope(monkeypatch):
import base64
from copy import deepcopy
es={'metadata':{'uid':'fixture-eso'},'spec':{'target':{'name':'net-kingdom-backup-publisher'},'secretStoreRef':{'kind':'SecretStore','name':'net-kingdom-backup-publisher'},'data':[{'secretKey':'token','remoteRef':{'key':'workloads/net-kingdom/identity-backup/publisher','property':'NC_WEBDAV_TOKEN','conversionStrategy':'Default','decodingStrategy':'None','metadataPolicy':'None'}}]},'status':{'conditions':[{'type':'Ready','status':'True'}]}}
secret={'metadata':{'ownerReferences':[{'uid':'fixture-eso'}]},'data':{'token':base64.b64encode(TOKEN.encode()).decode()}}
monkeypatch.setattr(runtime.capture,'get',lambda ns,kind,name:es if kind=='externalsecret' else secret)
assert runtime.token('publisher')==TOKEN
original=deepcopy(es)
for key,value in [('conversionStrategy','Unicode'),('property','OTHER'),('version','old')]:
es.clear();es.update(deepcopy(original));es['spec']['data'][0]['remoteRef'][key]=value
with pytest.raises(runtime.offsite.Refused):runtime.token('publisher')
es.clear();es.update(deepcopy(original));es['spec']['dataFrom']=[{'extract':{'key':'foreign'}}]
with pytest.raises(runtime.offsite.Refused):runtime.token('publisher')