tegwick
6cd89f0a7a
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
54 lines
2.5 KiB
Python
54 lines
2.5 KiB
Python
import base64
|
|
import importlib.util
|
|
import json
|
|
from pathlib import Path
|
|
import unittest
|
|
|
|
import yaml
|
|
|
|
spec = importlib.util.spec_from_file_location('portal_rollout', Path(__file__).with_name('portal-client-rollout.py'))
|
|
rollout = importlib.util.module_from_spec(spec)
|
|
spec.loader.exec_module(rollout)
|
|
|
|
|
|
class PortalClientTests(unittest.TestCase):
|
|
def fixture(self, clients=None):
|
|
# Synthetic marker values only; no live Secret is loaded by this suite.
|
|
raw = ('# preserve this comment\nauthelia:\n issuer: https://auth.example.invalid\n'
|
|
' clientSecret: synthetic-marker\nclients:\n' +
|
|
yaml.safe_dump(json.loads(json.dumps(clients or [{'clientId': 'existing', 'clientType': 'public'}])), sort_keys=False) +
|
|
'tokenLifetime: 15m\n')
|
|
return {'data': {'config.yaml': base64.b64encode(raw.encode()).decode(), 'key.pem': 'synthetic-key'}}, raw
|
|
|
|
def test_add_preserves_other_values_and_original_bytes(self):
|
|
secret, raw = self.fixture()
|
|
encoded, changed = rollout.replacement(secret)
|
|
updated = base64.b64decode(encoded).decode()
|
|
self.assertTrue(changed)
|
|
self.assertTrue(updated.startswith(raw[:raw.index('tokenLifetime:')]))
|
|
self.assertTrue(updated.endswith('tokenLifetime: 15m\n'))
|
|
expected = yaml.safe_load(raw)
|
|
expected['clients'].append(rollout.portal.CLIENT)
|
|
self.assertEqual(yaml.safe_load(updated), expected)
|
|
self.assertEqual(secret['data']['key.pem'], 'synthetic-key')
|
|
|
|
def test_exact_existing_registration_is_noop(self):
|
|
secret, _ = self.fixture([rollout.portal.CLIENT])
|
|
self.assertEqual(rollout.replacement(secret), (secret['data']['config.yaml'], False))
|
|
|
|
def test_differing_or_duplicate_registration_refused(self):
|
|
for clients in [[dict(rollout.portal.CLIENT, redirectUris=['https://other.invalid/callback'])],
|
|
[rollout.portal.CLIENT, rollout.portal.CLIENT]]:
|
|
with self.subTest(clients=len(clients)), self.assertRaises(rollout.Refused):
|
|
rollout.replacement(self.fixture(clients)[0])
|
|
|
|
def test_bootstrap_retains_same_public_registration(self):
|
|
source = Path(__file__).with_name('create-secrets.sh').read_text()
|
|
raw = source.split('CONFIG_YAML=$(cat <<EOF\n', 1)[1].split('\nEOF', 1)[0]
|
|
clients = yaml.safe_load(raw)['clients']
|
|
self.assertEqual([c for c in clients if c['clientId'] == rollout.portal.CLIENT_ID],
|
|
[rollout.portal.CLIENT])
|
|
|
|
|
|
if __name__ == '__main__':
|
|
unittest.main()
|