tegwick
7ce58ae638
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1
83 lines
2.7 KiB
Python
83 lines
2.7 KiB
Python
"""Tests for scripts/build_flex_auth_registry.py."""
|
|
import json
|
|
import subprocess
|
|
import sys
|
|
from pathlib import Path
|
|
|
|
import yaml
|
|
|
|
ROOT = Path(__file__).resolve().parents[1]
|
|
SCRIPT = ROOT / "scripts" / "build_flex_auth_registry.py"
|
|
INVENTORY = ROOT / "examples" / "inventory.seed.yaml"
|
|
|
|
|
|
def test_build_registry_from_inventory_seed(tmp_path):
|
|
out = tmp_path / "registry.json"
|
|
subprocess.run(
|
|
[sys.executable, str(SCRIPT), str(INVENTORY), "-o", str(out)],
|
|
check=True,
|
|
cwd=ROOT,
|
|
)
|
|
registry = json.loads(out.read_text())
|
|
actors = yaml.safe_load(INVENTORY.read_text())["actors"]
|
|
|
|
assert len(registry["subjects"]) == len(actors)
|
|
assert len(registry["resource_manifests"][0]["resources"]) == len(actors)
|
|
|
|
bridge = next(
|
|
r
|
|
for r in registry["resource_manifests"][0]["resources"]
|
|
if r["id"] == "ssh-cert:actor/agt-state-hub-bridge"
|
|
)
|
|
assert bridge["attributes"]["actor_type"] == "agt"
|
|
assert bridge["attributes"]["max_ttl_hours"] == 24
|
|
assert "agt-task-bridge" in bridge["attributes"]["allowed_principals"]
|
|
assert "trust_zone" not in bridge
|
|
assert bridge["attributes"]["security_zone"] == "unknown"
|
|
assert bridge["attributes"]["security_zone_admission"] == "unknown"
|
|
assert bridge["attributes"]["workload_id"] == "ops-bridge-tunnel"
|
|
|
|
human = next(
|
|
r
|
|
for r in registry["resource_manifests"][0]["resources"]
|
|
if r["id"] == "ssh-cert:actor/adm-example"
|
|
)
|
|
assert human["attributes"]["security_zone_admission"] == "not-applicable"
|
|
|
|
|
|
def test_compiler_joins_explicit_workload_reference_to_resolved_zone(tmp_path):
|
|
zones = tmp_path / "zones.json"
|
|
zones.write_text(json.dumps({
|
|
"records": [{
|
|
"workload_id": "ops-bridge-tunnel",
|
|
"declared_zone": "z2-continuity",
|
|
"admission": "satisfied",
|
|
"admission_reason": "admission_floor_met",
|
|
"effective_zone": "z2-continuity",
|
|
"membership_revision": "sha256:zone-revision",
|
|
}]
|
|
}))
|
|
out = tmp_path / "registry.json"
|
|
subprocess.run(
|
|
[
|
|
sys.executable,
|
|
str(SCRIPT),
|
|
str(INVENTORY),
|
|
"--zone-resolutions",
|
|
str(zones),
|
|
"-o",
|
|
str(out),
|
|
],
|
|
check=True,
|
|
cwd=ROOT,
|
|
)
|
|
registry = json.loads(out.read_text())
|
|
bridge = next(
|
|
r
|
|
for r in registry["resource_manifests"][0]["resources"]
|
|
if r["id"] == "ssh-cert:actor/agt-state-hub-bridge"
|
|
)
|
|
attrs = bridge["attributes"]
|
|
assert attrs["security_zone"] == "z2-continuity"
|
|
assert attrs["security_zone_admission"] == "satisfied"
|
|
assert attrs["security_zone_revision"] == "sha256:zone-revision"
|