tegwick
a5496170cf
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
35 lines
2 KiB
Python
35 lines
2 KiB
Python
import base64,importlib.util,json,unittest
|
|
from pathlib import Path
|
|
import yaml
|
|
spec=importlib.util.spec_from_file_location('rollout',Path(__file__).with_name('authentication-policy-rollout.py'))
|
|
module=importlib.util.module_from_spec(spec);spec.loader.exec_module(module)
|
|
class PolicyMigration(unittest.TestCase):
|
|
def secret(self):
|
|
raw='''# exact bytes outside reviewed fields must survive
|
|
issuer: https://fixture.test
|
|
authelia:
|
|
issuer: https://primary.test
|
|
clients:
|
|
- clientId: user-engine-portal
|
|
clientType: public
|
|
grantTypes: [authorization_code]
|
|
- clientId: untouched
|
|
mfaRequired: true
|
|
clientSecret: fixture-secret
|
|
- clientId: vergabe-demo-company
|
|
clientType: public
|
|
grantTypes: [authorization_code]
|
|
privacyidea:
|
|
requireForAll: true
|
|
'''
|
|
return {'data':{'config.yaml':base64.b64encode(raw.encode()).decode(),'key.pem':'fixture-key'}}
|
|
def test_exact_migration_preserves_siblings_and_retries(self):
|
|
secret=self.secret();value,changed=module.replacement(secret);self.assertTrue(changed)
|
|
raw=base64.b64decode(value).decode();self.assertIn('# exact bytes',raw);self.assertIn(' clientSecret: fixture-secret\n',raw)
|
|
config=yaml.safe_load(raw);self.assertTrue(config['privacyidea']['requireForAll'])
|
|
self.assertTrue(config['clients'][0]['mfaOptional']);self.assertTrue(config['clients'][2]['mfaOptional'])
|
|
secret['data']['config.yaml']=value;again,changed=module.replacement(secret);self.assertFalse(changed);self.assertEqual(value,again)
|
|
def test_explicit_or_duplicate_registration_refused(self):
|
|
for edit in [lambda s:s.replace(' clientType: public',' mfaRequired: false\n clientType: public',1),lambda s:s.replace('clientId: untouched','clientId: user-engine-portal')]:
|
|
secret=self.secret();secret['data']['config.yaml']=base64.b64encode(edit(base64.b64decode(secret['data']['config.yaml']).decode()).encode()).decode()
|
|
with self.assertRaises(module.Refused):module.replacement(secret)
|