coulomb/ops-mason
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

MASON-WP-0015-T03: deny comma-string token_policies in ops-mason-construct

Browse source 
Live probe showed token_policies=workload-kv-read-x,default passes the
workload-kv-read-* glob as one string. Login denies held; this closes the
role-policy limit. Reinstall required.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 278674@bnt-lap001
Assistant-Session: 64827407-e196-4ce3-b70c-76e7b537493f
This commit is contained in:
tegwick 2026-10-18 11:59:04 +02:00
parent ea847816ad
commit 482a08b40e
4 changed files with 122 additions and 35 deletions
Download patch file Download diff file Expand all files Collapse all files

2
tests/test_construct_policy.py
View file

@ -60,6 +60,8 @@ def test_role_writes_restrict_token_policies():
if path.startswith("auth/") and "/role/" in path and _caps(body) & {"create", "update"}:
assert '"token_policies" = ["workload-kv-read-*"]' in body, path
assert re.search(r'denied_parameters\s*=\s*\{\s*"policies"\s*=\s*\[\]', body), path
# Comma strings bypass the glob (MASON-WP-0015-T03).
assert re.search(r'"token_policies"\s*=\s*\["\*,\*"\]', body), path
def test_no_mount_or_auth_method_writes():