coulomb/ops-warden
4
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

fix: contain attended OpenBao login output

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0290b-3241-74c3-b868-6049545af836
This commit is contained in:
tegwick 2026-08-23 01:31:05 +02:00
parent 461f580813
commit 0fae0904ce
9 changed files with 497 additions and 75 deletions
Download patch file Download diff file Expand all files Collapse all files

12
tests/test_plan.py
View file

@ -65,19 +65,17 @@ def test_plan_first_time_openbao_database_admin_uses_platform_admin_login():
assert plan.founder_act.kind == "oidc_login"
command = plan.founder_act.details["fetch_command"]
assert command == (
"bao login -no-print -method=oidc -path=netkingdom role=platform-admin"
"warden access openbao-platform-admin-login --exec -- <reviewed-command>"
)
assert "financials" not in command
assert "paste_once" not in plan.founder_act.details["desk_hint"]
assert any(
item == "warden access openbao-platform-admin-login --fetch"
item
== "warden access openbao-platform-admin-login --exec -- <reviewed-command>"
for item in plan.commands
)
assert not any(
flag in item
for item in plan.commands
for flag in ("--exec", "--out", "--wrap")
)
assert not any("--fetch" in item for item in plan.commands)
assert not any("--out" in item or "--wrap" in item for item in plan.commands)
def test_plan_openbao_shamir_recovery_uses_approval_ceremony_not_secret_provision():