tegwick
57411f25b9
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786
84 lines
3.8 KiB
Python
84 lines
3.8 KiB
Python
"""Actual NetKingdom 1.2 source selection; no accepted/native case fixture."""
|
|
import json
|
|
from pathlib import Path
|
|
|
|
import pytest
|
|
import yaml
|
|
|
|
from ops_mason import case_plan, cli
|
|
|
|
NK = case_plan.DEFAULT_NK_ROOT
|
|
TYPES = NK / "security-case-type-revisions/1.2"
|
|
CASE = TYPES / "oidc-browser-relying-party/examples/forgejo.yaml"
|
|
pytestmark = pytest.mark.skipif(not CASE.is_file(), reason="NetKingdom 1.2 source absent")
|
|
|
|
|
|
def test_explicit_source_root_renders_actual_six_object_draft(tmp_path, capsys):
|
|
output = tmp_path / "plan.md"
|
|
assert cli.main(["plan", "--case", str(CASE), "--types-root", str(TYPES),
|
|
"--no-live", "--allow-unimplemented", "--out", str(output)]) == 0
|
|
plan = output.read_text()
|
|
front = yaml.safe_load(plan.split("---\n", 2)[1])
|
|
assert front["status"] == "draft"
|
|
assert front["case_acceptance"] is None
|
|
assert front["derived_from_type"] == "oidc-browser-relying-party@1.2"
|
|
assert front["reference_case"] is True
|
|
case, doc, rendered = case_plan.render(CASE, types_root=TYPES, allow_unimplemented=True)
|
|
assert case["spec"]["status"] == "proposed"
|
|
assert "acceptance" not in case["spec"]
|
|
assert doc["spec"]["status"] == "acknowledged"
|
|
assert len(rendered["materialization"]) == 6
|
|
role = next(item for item in rendered["materialization"]
|
|
if item["id"] == "consumer-eso-role")
|
|
body = yaml.safe_load(role["body"])
|
|
assert body["bound_service_account_namespaces"] == ["forgejo"]
|
|
assert body["bound_service_account_names"] == ["forgejo-keycape-forgejo-eso"]
|
|
assert front["render_digest"] == rendered["digest"]
|
|
assert json.loads(capsys.readouterr().err)["ok"] is True
|
|
|
|
|
|
def test_explicit_root_does_not_waive_implemented_gate(tmp_path, capsys):
|
|
output = tmp_path / "plan.md"
|
|
assert cli.main(["plan", "--case", str(CASE), "--types-root", str(TYPES),
|
|
"--no-live", "--out", str(output)]) == 2
|
|
assert not output.exists()
|
|
assert "only implemented types" in capsys.readouterr().err
|
|
|
|
|
|
def test_missing_explicit_root_never_falls_forward_to_12(tmp_path, capsys):
|
|
output = tmp_path / "plan.md"
|
|
assert cli.main(["plan", "--case", str(CASE), "--no-live",
|
|
"--allow-unimplemented", "--out", str(output)]) == 2
|
|
assert not output.exists()
|
|
assert "not 1.2" in capsys.readouterr().err
|
|
|
|
|
|
def test_proposed_case_cannot_build_even_with_selected_acknowledged_source(tmp_path, capsys):
|
|
output = tmp_path / "bundle"
|
|
assert cli.main(["build", "--case", str(CASE), "--types-root", str(TYPES),
|
|
"--allow-unimplemented", "--plan", str(tmp_path / "absent-plan.md"),
|
|
"--out", str(output)]) == 2
|
|
assert not output.exists()
|
|
assert "case is not accepted" in capsys.readouterr().err
|
|
|
|
|
|
def test_historical_bundle_cannot_attest_12_inventory(tmp_path, capsys):
|
|
owner = Path("/home/worsch/ops-mason")
|
|
assert cli.main(["structure-request", "--case", str(CASE), "--types-root", str(TYPES),
|
|
"--allow-unimplemented", "--plan", str(owner / "plans/case-forgejo-netkingdom-oidc.md"),
|
|
"--bundle", str(owner / "builds/case-forgejo-netkingdom-oidc")]) == 2
|
|
captured = capsys.readouterr()
|
|
assert captured.out == ""
|
|
assert json.loads(captured.err)["error"] == "structural-source-preparation-refused"
|
|
|
|
|
|
def test_actual_validator_refuses_invalid_consumer_namespace(tmp_path, capsys):
|
|
case = yaml.safe_load(CASE.read_text())
|
|
case["spec"]["parameters"]["consumer_namespace"] = "../../other"
|
|
source = tmp_path / "case.yaml"
|
|
source.write_text(yaml.safe_dump(case))
|
|
assert cli.main(["plan", "--case", str(source), "--types-root", str(TYPES),
|
|
"--no-live", "--allow-unimplemented"]) == 2
|
|
captured = capsys.readouterr()
|
|
assert captured.out == ""
|
|
assert "consumer_namespace" in captured.err
|