NK-WP-0048-T04: SecurityCaseType oidc-browser-relying-party 1.0 (proposed)

Composes key-cape.oidc-client-registration; confidential/public conditions,
one justified attended step, threat model, fit table of hand-built clients,
Forgejo and public-portal examples. Validator gains when/required_when and
provider discovery. 43 tests pass. Adds T08 (identity-provisioner groups ensure).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5457@bnt-lap001
Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012

tools/security-case-types/tests/test_security_case_validator.py

@@ -157,3 +157,29 @@ def test_template_conforms_to_the_json_schemas():
     bad["spec"]["surprise"] = True
     with pytest.raises(jsonschema.ValidationError):
         jsonschema.validate(bad, case_schema)
+
+
+def test_conditions_filter_rendering_and_require_parameters():
+    t = implemented()
+    t["spec"]["parameters"][3]["required"] = False
+    t["spec"]["parameters"][3]["constraints"]["required_when"] = "operator_username == bootstrap-admin"
+    t["spec"]["materialization"][0]["when"] = "operator_username == bootstrap-admin"
+    t["spec"]["rollback"][1]["when"] = "operator_username == bootstrap-admin"
+    assert msgs(v.validate_type(t)) == []
+    c = copy.deepcopy(CASE)
+    del c["spec"]["parameters"]["signing_key_ref"]
+    assert any("required when" in m for m in msgs(v.validate_case(c, t)))
+    c["spec"]["parameters"]["operator_username"] = "someone-else"
+    assert msgs(v.validate_case(c, t)) == []
+    _, r = v.render_case(c, t, DECLS)
+    assert [m["id"] for m in r["materialization"]] == ["signing-key-policy", "catalog-entry"]
+    assert all("when" not in m for m in r["materialization"])
+
+
+def test_bad_condition_is_refused():
+    t = copy.deepcopy(TYPE)
+    t["spec"]["materialization"][0]["when"] = "nonexistent == x"
+    t["spec"]["follow_through"][0]["when"] = "operator_username is x"
+    found = msgs(v.validate_type(t))
+    assert any("unknown parameter 'nonexistent'" in m for m in found)
+    assert any("must be '<parameter> == <value>'" in m for m in found)