coulomb/ops-warden
5
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

Route explicit attended OpenBao administration to governed login
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786
This commit is contained in:
tegwick 2026-10-16 18:44:02 +02:00
parent 958352089b
commit d79f065955
3 changed files with 55 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

25
tests/test_openbao_configuration_routing.py
View file

@ -1,4 +1,5 @@
"""Configuration intent must never inherit a metadata survey's founder act."""
from dataclasses import replace
from pathlib import Path
import pytest
@ -9,6 +10,8 @@ from warden.routing.catalog import Catalog, load_catalog
ROOT = Path(__file__).resolve().parents[1]
NEED = ('attended OpenBao platform administration to configure read policies and auth roles '
'for Coulomb and email backup delivery')
SIGNER_NEED = ('attended OpenBao platform administration for reviewed flex-auth '
'signer custody CAS0 and fixed KV metadata')
@pytest.fixture
@ -18,18 +21,24 @@ def catalog(monkeypatch):
@pytest.mark.parametrize('need', [NEED,
SIGNER_NEED,
'Attended OpenBao platform administration login',
'configure OpenBao policies and Kubernetes auth roles for backup delivery',
'apply OpenBao read policy for an explicitly reviewed service account'])
def test_configuration_requires_attended_admin_identity(catalog, need):
plan = build_plan(need, catalog=catalog)
assert plan.lane_id == 'openbao-platform-admin-login'
assert plan.verdict == 'founder_required' and plan.founder_act.kind == 'oidc_login'
assert plan.commands == [
'warden access openbao-platform-admin-login --exec -- <reviewed-command>',
'# owner login is contained by warden; do not invoke it separately']
assert all('--fetch' not in command and '--out' not in command for command in plan.commands)
@pytest.mark.parametrize('need', [
'survey existing OpenBao policies and roles for backup delivery',
'OpenBao read-only metadata survey policy approle consumer backup',
'survey OpenBao signer custody CAS0 and fixed KV metadata',
'inspect OpenBao structure metadata policy approle'])
def test_survey_remains_metadata_only(catalog, need):
plan = build_plan(need, catalog=catalog)
@ -37,11 +46,23 @@ def test_survey_remains_metadata_only(catalog, need):
assert plan.founder_act.kind == 'approve'
def test_explicit_lane_id_still_wins_and_missing_admin_fails_closed(catalog):
@pytest.mark.parametrize('need', [NEED, SIGNER_NEED])
def test_explicit_lane_id_still_wins_and_missing_admin_fails_closed(catalog, need):
assert catalog.find('openbao-structure-survey')[0].id == 'openbao-structure-survey'
unavailable = Catalog(catalog.path, [entry for entry in catalog.entries
if entry.id != 'openbao-platform-admin-login'])
plan = build_plan(NEED, catalog=unavailable)
plan = build_plan(need, catalog=unavailable)
assert plan.verdict == 'unroutable' and plan.lane_id is None
assert not plan.commands
@pytest.mark.parametrize('changes', [{'status': 'draft'}, {'lane': 'secret'}])
def test_attended_admin_cannot_use_inactive_or_secret_lane(catalog, changes):
admin = catalog.get('openbao-platform-admin-login')
unavailable = Catalog(catalog.path, [
replace(entry, **changes) if entry.id == admin.id else entry
for entry in catalog.entries])
plan = build_plan(SIGNER_NEED, catalog=unavailable, include_draft=True)
assert plan.verdict == 'unroutable' and plan.lane_id is None
assert not plan.commands