tegwick
4a915ce6c7
T02 done. Deployed user-engine digest c501aeb2 reads the projected flex-auth token per decision (verified in the running container); flex-auth-user-engine 138aa347 serves with caller-auth enforce. Probes: valid 200 decision:d9aef25f08e17b84, missing token 401, wrong-system 403. Closes manifest drift: runtime.yaml pinned e3b5f65b, the digest T01 warned against, while the cluster ran c501aeb2. Re-applying it would have rolled the portal back to an image that cannot authenticate to a PDP now in enforce. kubectl diff is now empty. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
33 lines
1.3 KiB
Python
33 lines
1.3 KiB
Python
from pathlib import Path
|
|
import unittest
|
|
|
|
|
|
ROOT = Path(__file__).parents[1]
|
|
|
|
|
|
class UserEnginePlatformExpansionContractTests(unittest.TestCase):
|
|
def test_contract_keeps_authorization_fail_closed(self):
|
|
text = (ROOT / "docs/user-engine-platform-expansion-contract.md").read_text()
|
|
self.assertIn("fail closed", text)
|
|
self.assertIn("decision ID", text)
|
|
self.assertIn("USER_ENGINE_FLEX_AUTH_URL", text)
|
|
|
|
def test_contract_requires_idempotent_bounded_delivery(self):
|
|
text = (ROOT / "docs/user-engine-platform-expansion-contract.md").read_text()
|
|
self.assertIn("Idempotency-Key", text)
|
|
self.assertIn("bounded attempts", text)
|
|
self.assertIn("dead-letter", text)
|
|
self.assertIn("OpenBao", text)
|
|
|
|
def test_desired_manifest_authenticates_flex_auth_calls(self):
|
|
manifest = (ROOT / "sso-mfa/k8s/user-engine/runtime.yaml").read_text()
|
|
self.assertIn("USER_ENGINE_FLEX_AUTH_URL", manifest)
|
|
self.assertIn("USER_ENGINE_FLEX_AUTH_TOKEN_FILE", manifest)
|
|
self.assertIn("serviceAccountName: user-engine", manifest)
|
|
self.assertIn("audience: flex-auth", manifest)
|
|
self.assertIn("mountPath: /var/run/secrets/flex-auth-caller", manifest)
|
|
self.assertIn("automountServiceAccountToken: false", manifest)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|