coulomb/net-kingdom
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record canonical portal hostname and callback cutover
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
This commit is contained in:
tegwick 2026-09-14 00:16:33 +02:00
parent bea425cf78
commit dc42b0344c
6 changed files with 78 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

19
sso-mfa/k8s/keycape/test_portal_client_rollout.py
View file

@ -32,6 +32,25 @@ class PortalClientTests(unittest.TestCase):
self.assertEqual(yaml.safe_load(updated), expected)
self.assertEqual(secret['data']['key.pem'], 'synthetic-key')
def test_legacy_callback_upgrade_preserves_bytes_and_is_idempotent(self):
legacy = dict(rollout.portal.CLIENT, redirectUris=[
'https://users.92-205-62-239.nip.io/oidc/callback'])
secret, raw = self.fixture([{'clientId': 'existing', 'clientType': 'public'}, legacy])
encoded, changed = rollout.replacement(secret)
updated = base64.b64decode(encoded).decode()
self.assertTrue(changed)
self.assertEqual(updated.replace(' - https://users.coulomb.social/oidc/callback\n', ''), raw)
self.assertEqual(yaml.safe_load(updated)['clients'][-1], rollout.portal.CLIENT)
secret['data']['config.yaml'] = encoded
self.assertEqual(rollout.replacement(secret), (encoded, False))
def test_upgrade_refuses_extra_scope_or_unreviewed_callback(self):
for extra in [dict(allowedScopes=['openid', 'admin']),
dict(redirectUris=['https://users.coulomb.social/oidc/callback']),
dict(clientType='confidential')]:
with self.subTest(extra=extra), self.assertRaises(rollout.Refused):
rollout.replacement(self.fixture([dict(rollout.portal.CLIENT, **extra)])[0])
def test_exact_existing_registration_is_noop(self):
secret, _ = self.fixture([rollout.portal.CLIENT])
self.assertEqual(rollout.replacement(secret), (secret['data']['config.yaml'], False))