tegwick
d79f065955
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786
81 lines
3.8 KiB
Python
81 lines
3.8 KiB
Python
"""Configuration intent must never inherit a metadata survey's founder act."""
|
|
from dataclasses import replace
|
|
from pathlib import Path
|
|
|
|
import pytest
|
|
|
|
from warden.plan import build_plan
|
|
from warden.routing.catalog import Catalog, load_catalog
|
|
|
|
ROOT = Path(__file__).resolve().parents[1]
|
|
NEED = ('attended OpenBao platform administration to configure read policies and auth roles '
|
|
'for Coulomb and email backup delivery')
|
|
SIGNER_NEED = ('attended OpenBao platform administration for reviewed flex-auth '
|
|
'signer custody CAS0 and fixed KV metadata')
|
|
|
|
|
|
@pytest.fixture
|
|
def catalog(monkeypatch):
|
|
monkeypatch.setenv('WARDEN_POSTURE_CATALOG', str(ROOT / 'registry/policy/security-posture.yaml'))
|
|
return load_catalog(ROOT / 'registry/routing/catalog.yaml')
|
|
|
|
|
|
@pytest.mark.parametrize('need', [NEED,
|
|
SIGNER_NEED,
|
|
'Attended OpenBao platform administration login',
|
|
'configure OpenBao policies and Kubernetes auth roles for backup delivery',
|
|
'apply OpenBao read policy for an explicitly reviewed service account'])
|
|
def test_configuration_requires_attended_admin_identity(catalog, need):
|
|
plan = build_plan(need, catalog=catalog)
|
|
assert plan.lane_id == 'openbao-platform-admin-login'
|
|
assert plan.verdict == 'founder_required' and plan.founder_act.kind == 'oidc_login'
|
|
assert plan.commands == [
|
|
'warden access openbao-platform-admin-login --exec -- <reviewed-command>',
|
|
'# owner login is contained by warden; do not invoke it separately']
|
|
assert all('--fetch' not in command and '--out' not in command for command in plan.commands)
|
|
|
|
|
|
@pytest.mark.parametrize('need', [
|
|
'survey existing OpenBao policies and roles for backup delivery',
|
|
'OpenBao read-only metadata survey policy approle consumer backup',
|
|
'survey OpenBao signer custody CAS0 and fixed KV metadata',
|
|
'inspect OpenBao structure metadata policy approle'])
|
|
def test_survey_remains_metadata_only(catalog, need):
|
|
plan = build_plan(need, catalog=catalog)
|
|
assert plan.lane_id == 'openbao-structure-survey'
|
|
assert plan.founder_act.kind == 'approve'
|
|
|
|
|
|
@pytest.mark.parametrize('need', [NEED, SIGNER_NEED])
|
|
def test_explicit_lane_id_still_wins_and_missing_admin_fails_closed(catalog, need):
|
|
assert catalog.find('openbao-structure-survey')[0].id == 'openbao-structure-survey'
|
|
unavailable = Catalog(catalog.path, [entry for entry in catalog.entries
|
|
if entry.id != 'openbao-platform-admin-login'])
|
|
plan = build_plan(need, catalog=unavailable)
|
|
assert plan.verdict == 'unroutable' and plan.lane_id is None
|
|
assert not plan.commands
|
|
|
|
|
|
@pytest.mark.parametrize('changes', [{'status': 'draft'}, {'lane': 'secret'}])
|
|
def test_attended_admin_cannot_use_inactive_or_secret_lane(catalog, changes):
|
|
admin = catalog.get('openbao-platform-admin-login')
|
|
unavailable = Catalog(catalog.path, [
|
|
replace(entry, **changes) if entry.id == admin.id else entry
|
|
for entry in catalog.entries])
|
|
plan = build_plan(SIGNER_NEED, catalog=unavailable, include_draft=True)
|
|
assert plan.verdict == 'unroutable' and plan.lane_id is None
|
|
assert not plan.commands
|
|
|
|
|
|
def test_pair_provisioning_routes_to_custody_not_survey(catalog):
|
|
need = "provision a Scaleway object storage backup publisher key pair into OpenBao custody"
|
|
plan = build_plan(need, catalog=catalog)
|
|
assert plan.lane_id == "openbao-api-key"
|
|
assert plan.verdict == "founder_required"
|
|
assert plan.founder_act.kind == "paste_once_provision"
|
|
assert not any("plan-survey" in command for command in plan.commands)
|
|
|
|
|
|
def test_missing_custody_frontdoor_fails_closed(catalog):
|
|
unavailable = Catalog(catalog.path, [e for e in catalog.entries if e.id != "openbao-api-key"])
|
|
assert build_plan("provision OpenBao backup key pair", catalog=unavailable).verdict == "unroutable"
|