tegwick
3b14469afb
The name was retired on 2026-09-15. Remove both public UI callbacks from the code-defined client (openbao-client-config.py, create-secrets.sh), stop probing them in verify-openbao-client.sh, and fail verification in openbao-client-config.py and verify-t07.sh if either is registered again. The CLI and operator-tunneled 127.0.0.1:18200 callbacks remain. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 299762@bnt-lap001 Assistant-Session: d3d3cea1-869c-44f1-be2a-3d6d3550e72e
62 lines
2.6 KiB
Python
62 lines
2.6 KiB
Python
#!/usr/bin/env python3
|
|
"""Focused regression tests for the code-defined OpenBao KeyCape client."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import importlib.util
|
|
import unittest
|
|
from pathlib import Path
|
|
|
|
|
|
MODULE_PATH = Path(__file__).with_name("openbao-client-config.py")
|
|
SPEC = importlib.util.spec_from_file_location("openbao_client_config", MODULE_PATH)
|
|
assert SPEC and SPEC.loader
|
|
MODULE = importlib.util.module_from_spec(SPEC)
|
|
SPEC.loader.exec_module(MODULE)
|
|
|
|
LOOPBACK_CALLBACK = "http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback"
|
|
|
|
|
|
class OpenBaoClientConfigTest(unittest.TestCase):
|
|
def test_operator_tunnel_callback_is_required(self) -> None:
|
|
self.assertIn(LOOPBACK_CALLBACK, MODULE.OPENBAO_CLIENT["redirectUris"])
|
|
|
|
def test_missing_operator_tunnel_callback_fails_verification(self) -> None:
|
|
client = dict(MODULE.OPENBAO_CLIENT)
|
|
client["redirectUris"] = [
|
|
uri for uri in MODULE.OPENBAO_CLIENT["redirectUris"] if uri != LOOPBACK_CALLBACK
|
|
]
|
|
errors = MODULE.client_errors({"clients": [client]}, MODULE.OPENBAO_CLIENT)
|
|
self.assertEqual(
|
|
errors,
|
|
[f"openbao-admin.redirectUris missing: {LOOPBACK_CALLBACK}"],
|
|
)
|
|
|
|
def test_retired_public_callbacks_are_not_declared(self) -> None:
|
|
for uri in MODULE.RETIRED_OPENBAO_REDIRECT_URIS:
|
|
self.assertNotIn(uri, MODULE.OPENBAO_CLIENT["redirectUris"])
|
|
|
|
def test_retired_public_callback_fails_verification(self) -> None:
|
|
client = dict(MODULE.OPENBAO_CLIENT)
|
|
retired = MODULE.RETIRED_OPENBAO_REDIRECT_URIS[0]
|
|
client["redirectUris"] = [*MODULE.OPENBAO_CLIENT["redirectUris"], retired]
|
|
self.assertEqual(
|
|
MODULE.retired_redirect_errors({"clients": [client]}),
|
|
[f"openbao-admin.redirectUris retired: {retired}"],
|
|
)
|
|
|
|
def test_upsert_removes_retired_callbacks(self) -> None:
|
|
stale = dict(MODULE.OPENBAO_CLIENT)
|
|
stale["redirectUris"] = [*MODULE.OPENBAO_CLIENT["redirectUris"], *MODULE.RETIRED_OPENBAO_REDIRECT_URIS]
|
|
updated = MODULE.upsert_client({"clients": [stale]}, MODULE.OPENBAO_CLIENT)
|
|
self.assertEqual(MODULE.retired_redirect_errors(updated), [])
|
|
|
|
def test_upsert_preserves_unrelated_clients(self) -> None:
|
|
config = {"clients": [{"clientId": "unrelated", "clientType": "public"}]}
|
|
updated = MODULE.upsert_client(config, MODULE.OPENBAO_CLIENT)
|
|
self.assertEqual(updated["clients"][0]["clientId"], "unrelated")
|
|
self.assertIn(LOOPBACK_CALLBACK, updated["clients"][1]["redirectUris"])
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|