tegwick
6a602edafb
Value-free evidence under the read-only ops-mason-survey grant (revoked after use). Adds T05 for live-token checks and the pointer route. Fixes bao-session.sh grant misreporting an unreadable policy as absent. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 132360@bnt-lap001 Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b
41 lines
1.3 KiB
Python
41 lines
1.3 KiB
Python
"""bao-session.sh grant: distinguish an absent policy from an unreadable one."""
|
|
|
|
import os
|
|
import subprocess
|
|
from pathlib import Path
|
|
|
|
SCRIPT = Path(__file__).resolve().parents[1] / "scripts" / "bao-session.sh"
|
|
|
|
|
|
def _run_grant(tmp_path, stub_stderr, stub_rc):
|
|
bindir = tmp_path / "bin"
|
|
bindir.mkdir()
|
|
stub = bindir / "bao"
|
|
stub.write_text(
|
|
"#!/usr/bin/env bash\n"
|
|
f"echo {stub_stderr!r} >&2\n"
|
|
f"exit {stub_rc}\n"
|
|
)
|
|
stub.chmod(0o755)
|
|
env = dict(os.environ)
|
|
env["PATH"] = f"{bindir}:{env['PATH']}"
|
|
env["HOME"] = str(tmp_path)
|
|
env["GRANT_FILE"] = str(tmp_path / "grant")
|
|
return subprocess.run(
|
|
["bash", str(SCRIPT), "grant", "t"], env=env, capture_output=True, text=True
|
|
)
|
|
|
|
|
|
def test_absent_policy_reported_as_absent(tmp_path):
|
|
r = _run_grant(tmp_path, "No policy named: ops-mason-survey", 2)
|
|
assert r.returncode == 1
|
|
assert "does not exist yet" in r.stdout
|
|
assert not (tmp_path / "grant").exists()
|
|
|
|
|
|
def test_permission_denied_not_reported_as_absent(tmp_path):
|
|
r = _run_grant(tmp_path, "Code: 403. Errors: * permission denied", 2)
|
|
assert r.returncode == 1
|
|
assert "does not exist" not in r.stdout
|
|
assert "session expired or not permitted" in r.stdout
|
|
assert not (tmp_path / "grant").exists()
|