ops-mason/tests/test_construct_policy.py

"""ops-mason-construct can build a lane but never log in as one (MASON-IN-0005)."""

import re
from pathlib import Path

POLICY = Path(__file__).resolve().parents[1] / "policies" / "ops-mason-construct.hcl"


def _stanzas() -> dict[str, str]:
    text = "\n".join(line.split("#", 1)[0] for line in POLICY.read_text().splitlines())
    return {
        m.group(1): m.group(2)
        for m in re.finditer(r'path\s+"([^"]+)"\s*\{(.*?)\n?\s*\}\s*(?=path|\Z)', text, re.S)
    }


def _caps(body: str) -> set[str]:
    m = re.search(r"capabilities\s*=\s*\[([^\]]*)\]", body)
    return set(re.findall(r'"(\w+)"', m.group(1))) if m else set()


def test_login_and_value_paths_are_denied():
    stanzas = _stanzas()
    for path in [
        "auth/approle/role/+/role-id",
        "auth/approle/role/+/secret-id",
        "auth/approle/role/+/secret-id/*",
        "auth/approle/role/+/custom-secret-id",
        "auth/token/create",
        "auth/token/create/*",
        "auth/token/create-orphan",
        "platform/data/*",
        "operators/data/*",
        "secret/data/*",
        "sys/policies/acl/ops-mason-construct",
        "sys/policies/acl/ops-mason-survey",
        "sys/policies/acl/default",
        "sys/policies/acl/root",
    ]:
        assert _caps(stanzas[path]) == {"deny"}, path


def test_kv_data_is_create_only():
    stanzas = _stanzas()
    for path in ["platform/data/workloads/*", "platform/data/suppliers/*"]:
        assert _caps(stanzas[path]) == {"create"}, path
    for path, body in stanzas.items():
        if "/data/" in path:
            assert not _caps(body) & {"read", "update", "list"}, path


def test_policy_writes_limited_to_workload_read_prefix():
    for path, body in _stanzas().items():
        if path.startswith("sys/policies/acl/") and _caps(body) & {"create", "update", "delete"}:
            assert path == "sys/policies/acl/workload-kv-read-*", path


def test_role_writes_restrict_token_policies():
    for path, body in _stanzas().items():
        if path.startswith("auth/") and "/role/" in path and _caps(body) & {"create", "update"}:
            assert '"token_policies" = ["workload-kv-read-*"]' in body, path
            assert re.search(r'denied_parameters\s*=\s*\{\s*"policies"\s*=\s*\[\]', body), path
            # Comma strings bypass the glob (MASON-WP-0015-T03).
            assert re.search(r'"token_policies"\s*=\s*\["\*,\*"\]', body), path


def test_no_mount_or_auth_method_writes():
    for path, body in _stanzas().items():
        if path.startswith(("sys/mounts/", "sys/auth/")):
            assert _caps(body) <= {"read", "list", "deny"}, path