ops-warden/tests/test_reuse_surface_caller_gate.py

"""The reuse-surface catalog caller stays unnamed until verification."""
from __future__ import annotations

from pathlib import Path

from warden.routing import load_catalog


def test_dedicated_caller_is_the_verified_hub_writer_role():
    catalog = load_catalog(Path(__file__).resolve().parents[1] / "registry" / "routing" / "catalog.yaml")
    entry = catalog.get("reuse-surface-hub-write-token")
    assert entry is not None
    assert entry.auth_method == (
        "bao login -method=oidc -path=netkingdom "
        "role=reuse-surface-hub-writer-workload-kv-read"
    )