tegwick
402b008986
CCR-2026-0044 is applied. Member and non-member receipts passed on 2026-10-14: the member token holds only workload-kv-read-reuse-surface-runtime, and a non-member login is refused. The catalog auth_method is now that OIDC role. The proxy still uses the ambient token and does not vend the hub writer value. Assistant: grok Assistant-Session: 01a13b2d-0bc1-7a91-ab1d-325bcfb09bf0
16 lines
578 B
Python
16 lines
578 B
Python
"""The reuse-surface catalog caller stays unnamed until verification."""
|
|
from __future__ import annotations
|
|
|
|
from pathlib import Path
|
|
|
|
from warden.routing import load_catalog
|
|
|
|
|
|
def test_dedicated_caller_is_the_verified_hub_writer_role():
|
|
catalog = load_catalog(Path(__file__).resolve().parents[1] / "registry" / "routing" / "catalog.yaml")
|
|
entry = catalog.get("reuse-surface-hub-write-token")
|
|
assert entry is not None
|
|
assert entry.auth_method == (
|
|
"bao login -method=oidc -path=netkingdom "
|
|
"role=reuse-surface-hub-writer-workload-kv-read"
|
|
)
|