feat(NK-WP-0032): admit OpenBao operator loopback callback

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02b90-83bf-75c2-81c8-aa705414e4d4

sso-mfa/k8s/keycape/test_openbao_client_config.py

@@ -0,0 +1,43 @@
+#!/usr/bin/env python3
+"""Focused regression tests for the code-defined OpenBao KeyCape client."""
+
+from __future__ import annotations
+
+import importlib.util
+import unittest
+from pathlib import Path
+
+
+MODULE_PATH = Path(__file__).with_name("openbao-client-config.py")
+SPEC = importlib.util.spec_from_file_location("openbao_client_config", MODULE_PATH)
+assert SPEC and SPEC.loader
+MODULE = importlib.util.module_from_spec(SPEC)
+SPEC.loader.exec_module(MODULE)
+
+LOOPBACK_CALLBACK = "http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback"
+
+
+class OpenBaoClientConfigTest(unittest.TestCase):
+    def test_operator_tunnel_callback_is_required(self) -> None:
+        self.assertIn(LOOPBACK_CALLBACK, MODULE.OPENBAO_CLIENT["redirectUris"])
+
+    def test_missing_operator_tunnel_callback_fails_verification(self) -> None:
+        client = dict(MODULE.OPENBAO_CLIENT)
+        client["redirectUris"] = [
+            uri for uri in MODULE.OPENBAO_CLIENT["redirectUris"] if uri != LOOPBACK_CALLBACK
+        ]
+        errors = MODULE.client_errors({"clients": [client]}, MODULE.OPENBAO_CLIENT)
+        self.assertEqual(
+            errors,
+            [f"openbao-admin.redirectUris missing: {LOOPBACK_CALLBACK}"],
+        )
+
+    def test_upsert_preserves_unrelated_clients(self) -> None:
+        config = {"clients": [{"clientId": "unrelated", "clientType": "public"}]}
+        updated = MODULE.upsert_client(config, MODULE.OPENBAO_CLIENT)
+        self.assertEqual(updated["clients"][0]["clientId"], "unrelated")
+        self.assertIn(LOOPBACK_CALLBACK, updated["clients"][1]["redirectUris"])
+
+
+if __name__ == "__main__":
+    unittest.main()