tegwick
a7f9516bb3
bernd.worsch-3 is OpenBao entity f94b7c34-e151-30bb-b473-df3ccdbb9bf1. The member receipt must be that entity. T02 is done. The filed role stays unconfirmed until CCR-2026-0044 is approved. Assistant: grok Assistant-Session: 01a13b2d-5f6d-7a32-b2c9-384625c55ca6
73 lines
2.2 KiB
Python
73 lines
2.2 KiB
Python
from ops_mason.reuse_surface_hub_writer import (
|
|
DATA,
|
|
FORBIDDEN_ENTITY_ID,
|
|
MEMBER_ENTITY_ID,
|
|
METADATA,
|
|
PARENT_DATA,
|
|
POLICY,
|
|
SIBLING,
|
|
assess,
|
|
)
|
|
|
|
|
|
def member(**overrides):
|
|
report = {
|
|
"mode": "member",
|
|
"login": "ok",
|
|
"policies": [POLICY],
|
|
"identity_policies": [],
|
|
"entity_id": MEMBER_ENTITY_ID,
|
|
"capabilities": {
|
|
DATA: ["read"],
|
|
METADATA: ["read"],
|
|
PARENT_DATA: ["deny"],
|
|
"platform/metadata/workloads/reuse/reuse-surface": ["deny"],
|
|
SIBLING: ["deny"],
|
|
},
|
|
"revoked": True,
|
|
}
|
|
report.update(overrides)
|
|
return report
|
|
|
|
|
|
def test_member_exact_policy_passes():
|
|
assert assess(member()) == []
|
|
|
|
|
|
def test_admin_entity_and_broad_capabilities_fail():
|
|
failures = assess(
|
|
member(
|
|
policies=["default", "operator-custody", "platform-admin", POLICY],
|
|
identity_policies=["platform-admin"],
|
|
entity_id=FORBIDDEN_ENTITY_ID,
|
|
capabilities={
|
|
DATA: ["create", "delete", "list", "read", "update"],
|
|
METADATA: ["create", "delete", "list", "read", "update"],
|
|
PARENT_DATA: ["create", "delete", "list", "read", "update"],
|
|
"platform/metadata/workloads/reuse/reuse-surface": ["read"],
|
|
SIBLING: ["create", "delete", "list", "read", "update"],
|
|
},
|
|
)
|
|
)
|
|
assert any("platform-admin entity" in item for item in failures)
|
|
assert any("forbidden policies" in item for item in failures)
|
|
assert any(SIBLING in item for item in failures)
|
|
assert any("not exactly" in item for item in failures)
|
|
|
|
|
|
def test_other_entity_fails():
|
|
failures = assess(member(entity_id="11111111-1111-1111-1111-111111111111"))
|
|
assert any("not the member entity" in item for item in failures)
|
|
|
|
|
|
def test_missing_revoke_fails():
|
|
assert any("not revoked" in item for item in assess(member(revoked=False)))
|
|
|
|
|
|
def test_non_member_refusal_passes_and_unexpected_login_fails():
|
|
assert assess({"mode": "non-member", "login": "refused"}) == []
|
|
assert assess({"mode": "non-member", "login": "ok"})
|
|
|
|
|
|
def test_unknown_mode_fails():
|
|
assert assess({"mode": "other"})
|