tegwick
fca5591bc6
verify-reuse-surface-hub-writer.py logs in with skip_browser=true and shows the address (or opens a fresh temporary browser profile), so the default Authelia session is never reused. The receipt records uid, openbao_error and assurance per net-kingdom/docs/sign-in-diagnosis.md, with tokens, codes and emails redacted. Capabilities come from sys/capabilities-self on the lane token; no operator or root token is read. Needs railiance-platform CCR-2026-0045 applied to run live. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 1041694@bnt-lap001 Assistant-Session: 7af0bb68-ac4a-4ce3-8639-24ddd84c0b52
75 lines
2.4 KiB
Python
75 lines
2.4 KiB
Python
from ops_mason.reuse_surface_hub_writer import (
|
|
DATA,
|
|
FORBIDDEN_ENTITY_ID,
|
|
METADATA,
|
|
PARENT_DATA,
|
|
POLICY,
|
|
SIBLING,
|
|
assess,
|
|
)
|
|
|
|
|
|
def member(**overrides):
|
|
report = {
|
|
"mode": "member",
|
|
"login": "ok",
|
|
"policies": [POLICY],
|
|
"identity_policies": [],
|
|
"entity_id": "11111111-1111-1111-1111-111111111111",
|
|
"capabilities": {
|
|
DATA: ["read"],
|
|
METADATA: ["read"],
|
|
PARENT_DATA: ["deny"],
|
|
"platform/metadata/workloads/reuse/reuse-surface": ["deny"],
|
|
SIBLING: ["deny"],
|
|
},
|
|
"revoked": True,
|
|
}
|
|
report.update(overrides)
|
|
return report
|
|
|
|
|
|
def test_member_exact_policy_passes():
|
|
assert assess(member()) == []
|
|
|
|
|
|
def test_admin_entity_and_broad_capabilities_fail():
|
|
failures = assess(
|
|
member(
|
|
policies=["default", "operator-custody", "platform-admin", POLICY],
|
|
identity_policies=["platform-admin"],
|
|
entity_id=FORBIDDEN_ENTITY_ID,
|
|
capabilities={
|
|
DATA: ["create", "delete", "list", "read", "update"],
|
|
METADATA: ["create", "delete", "list", "read", "update"],
|
|
PARENT_DATA: ["create", "delete", "list", "read", "update"],
|
|
"platform/metadata/workloads/reuse/reuse-surface": ["read"],
|
|
SIBLING: ["create", "delete", "list", "read", "update"],
|
|
},
|
|
)
|
|
)
|
|
assert any("platform-admin entity" in item for item in failures)
|
|
assert any("forbidden policies" in item for item in failures)
|
|
assert any(SIBLING in item for item in failures)
|
|
assert any("not exactly" in item for item in failures)
|
|
|
|
|
|
def test_missing_entity_fails():
|
|
assert any("entity id" in item for item in assess(member(entity_id="")))
|
|
|
|
|
|
def test_missing_revoke_fails():
|
|
assert any("not revoked" in item for item in assess(member(revoked=False)))
|
|
|
|
|
|
def test_non_member_refusal_passes_and_unexpected_login_fails():
|
|
refusal = 'claim "groups" does not match any associated bound claim values'
|
|
assert assess({"mode": "non-member", "login": "refused", "openbao_error": refusal}) == []
|
|
assert assess({"mode": "non-member", "login": "refused"}) == [
|
|
"non-member refusal recorded no openbao_error text"
|
|
]
|
|
assert assess({"mode": "non-member", "login": "ok"})
|
|
|
|
|
|
def test_unknown_mode_fails():
|
|
assert assess({"mode": "other"})
|