tegwick
fd2c5a5904
CCR-2026-0005 does not name a principal, and the platform-admin entity must not receive the workload policy. Add the draft role, verifier, and plan, drop the retired operators/nextcloud description, and record that tegwick's MFA factor is enrolled. Assistant: grok Assistant-Session: 01a13b2d-5f6d-7a32-b2c9-384625c55ca6
67 lines
2 KiB
Python
67 lines
2 KiB
Python
from ops_mason.reuse_surface_hub_writer import (
|
|
DATA,
|
|
FORBIDDEN_ENTITY_ID,
|
|
METADATA,
|
|
PARENT_DATA,
|
|
POLICY,
|
|
SIBLING,
|
|
assess,
|
|
)
|
|
|
|
|
|
def member(**overrides):
|
|
report = {
|
|
"mode": "member",
|
|
"login": "ok",
|
|
"policies": [POLICY],
|
|
"identity_policies": [],
|
|
"entity_id": "11111111-1111-1111-1111-111111111111",
|
|
"capabilities": {
|
|
DATA: ["read"],
|
|
METADATA: ["read"],
|
|
PARENT_DATA: ["deny"],
|
|
"platform/metadata/workloads/reuse/reuse-surface": ["deny"],
|
|
SIBLING: ["deny"],
|
|
},
|
|
"revoked": True,
|
|
}
|
|
report.update(overrides)
|
|
return report
|
|
|
|
|
|
def test_member_exact_policy_passes():
|
|
assert assess(member()) == []
|
|
|
|
|
|
def test_admin_entity_and_broad_capabilities_fail():
|
|
failures = assess(
|
|
member(
|
|
policies=["default", "operator-custody", "platform-admin", POLICY],
|
|
identity_policies=["platform-admin"],
|
|
entity_id=FORBIDDEN_ENTITY_ID,
|
|
capabilities={
|
|
DATA: ["create", "delete", "list", "read", "update"],
|
|
METADATA: ["create", "delete", "list", "read", "update"],
|
|
PARENT_DATA: ["create", "delete", "list", "read", "update"],
|
|
"platform/metadata/workloads/reuse/reuse-surface": ["read"],
|
|
SIBLING: ["create", "delete", "list", "read", "update"],
|
|
},
|
|
)
|
|
)
|
|
assert any("platform-admin entity" in item for item in failures)
|
|
assert any("forbidden policies" in item for item in failures)
|
|
assert any(SIBLING in item for item in failures)
|
|
assert any("not exactly" in item for item in failures)
|
|
|
|
|
|
def test_missing_revoke_fails():
|
|
assert any("not revoked" in item for item in assess(member(revoked=False)))
|
|
|
|
|
|
def test_non_member_refusal_passes_and_unexpected_login_fails():
|
|
assert assess({"mode": "non-member", "login": "refused"}) == []
|
|
assert assess({"mode": "non-member", "login": "ok"})
|
|
|
|
|
|
def test_unknown_mode_fails():
|
|
assert assess({"mode": "other"})
|