tegwick
139f77dd55
Configuration intent (policies, auth roles) routes to the attended openbao-platform-admin-login lane and value provisioning to openbao-api-key custody; both fail closed when their front door is missing. The survey lane now points at ops-mason's read-only ops-mason-survey grant (MASON-IN-0004). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 327285@bnt-lap001 Assistant-Session: d6532cd1-7cd5-417b-baac-b841c9103a6b
60 lines
2.7 KiB
Python
60 lines
2.7 KiB
Python
"""Configuration intent must never inherit a metadata survey's founder act."""
|
|
from pathlib import Path
|
|
|
|
import pytest
|
|
|
|
from warden.plan import build_plan
|
|
from warden.routing.catalog import Catalog, load_catalog
|
|
|
|
ROOT = Path(__file__).resolve().parents[1]
|
|
NEED = ('attended OpenBao platform administration to configure read policies and auth roles '
|
|
'for Coulomb and email backup delivery')
|
|
|
|
|
|
@pytest.fixture
|
|
def catalog(monkeypatch):
|
|
monkeypatch.setenv('WARDEN_POSTURE_CATALOG', str(ROOT / 'registry/policy/security-posture.yaml'))
|
|
return load_catalog(ROOT / 'registry/routing/catalog.yaml')
|
|
|
|
|
|
@pytest.mark.parametrize('need', [NEED,
|
|
'configure OpenBao policies and Kubernetes auth roles for backup delivery',
|
|
'apply OpenBao read policy for an explicitly reviewed service account'])
|
|
def test_configuration_requires_attended_admin_identity(catalog, need):
|
|
plan = build_plan(need, catalog=catalog)
|
|
assert plan.lane_id == 'openbao-platform-admin-login'
|
|
assert plan.verdict == 'founder_required' and plan.founder_act.kind == 'oidc_login'
|
|
assert all('--fetch' not in command and '--out' not in command for command in plan.commands)
|
|
|
|
|
|
@pytest.mark.parametrize('need', [
|
|
'survey existing OpenBao policies and roles for backup delivery',
|
|
'OpenBao read-only metadata survey policy approle consumer backup',
|
|
'inspect OpenBao structure metadata policy approle'])
|
|
def test_survey_remains_metadata_only(catalog, need):
|
|
plan = build_plan(need, catalog=catalog)
|
|
assert plan.lane_id == 'openbao-structure-survey'
|
|
assert plan.founder_act.kind == 'approve'
|
|
|
|
|
|
def test_explicit_lane_id_still_wins_and_missing_admin_fails_closed(catalog):
|
|
assert catalog.find('openbao-structure-survey')[0].id == 'openbao-structure-survey'
|
|
unavailable = Catalog(catalog.path, [entry for entry in catalog.entries
|
|
if entry.id != 'openbao-platform-admin-login'])
|
|
plan = build_plan(NEED, catalog=unavailable)
|
|
assert plan.verdict == 'unroutable' and plan.lane_id is None
|
|
assert not plan.commands
|
|
|
|
|
|
def test_pair_provisioning_routes_to_custody_not_survey(catalog):
|
|
need = "provision a Scaleway object storage backup publisher key pair into OpenBao custody"
|
|
plan = build_plan(need, catalog=catalog)
|
|
assert plan.lane_id == "openbao-api-key"
|
|
assert plan.verdict == "founder_required"
|
|
assert plan.founder_act.kind == "paste_once_provision"
|
|
assert not any("plan-survey" in command for command in plan.commands)
|
|
|
|
|
|
def test_missing_custody_frontdoor_fails_closed(catalog):
|
|
unavailable = Catalog(catalog.path, [e for e in catalog.entries if e.id != "openbao-api-key"])
|
|
assert build_plan("provision OpenBao backup key pair", catalog=unavailable).verdict == "unroutable"
|