38 lines
1.5 KiB
Python
38 lines
1.5 KiB
Python
|
"""Source checks for the netkingdom OpenBao role files (RPF-WP-0065). No live access."""
|
||
|
|
import json
|
||
|
|
from pathlib import Path
|
||
|
|
|
||
|
|
AUTH = Path(__file__).resolve().parents[1] / 'openbao/auth'
|
||
|
|
|
||
|
|
|
||
|
|
def role(name):
|
||
|
|
return json.loads((AUTH / name).read_text())
|
||
|
|
|
||
|
|
|
||
|
|
def test_platform_admin_binds_group_and_aal2():
|
||
|
|
r = role('netkingdom-platform-admin-role.json')
|
||
|
|
assert r['bound_claims_type'] == 'string'
|
||
|
|
assert r['bound_claims'] == {'groups': ['net-kingdom-admins'], '/assurance/level': 'aal2'}
|
||
|
|
assert r['groups_claim'] == 'groups'
|
||
|
|
assert r['token_policies'] == ['platform-admin', 'operator-custody']
|
||
|
|
|
||
|
|
|
||
|
|
def test_platform_admin_matches_credential_broker_assurance_binding():
|
||
|
|
admin = role('netkingdom-platform-admin-role.json')['bound_claims']
|
||
|
|
broker = role('credential-broker-keycape-client-secret-generate-oidc-role.json')['bound_claims']
|
||
|
|
assert admin['/assurance/level'] == broker['/assurance/level'] == 'aal2'
|
||
|
|
|
||
|
|
|
||
|
|
def test_coding_agent_accepts_service_and_agent_during_transition():
|
||
|
|
r = role('coding-agent-jwt-role.json')
|
||
|
|
claims = r['bound_claims']
|
||
|
|
assert sorted(claims['principal_type']) == ['agent', 'service']
|
||
|
|
# nothing else loosened
|
||
|
|
assert claims['sub'] == 'service:codex:railiance-platform'
|
||
|
|
assert claims['tenant'] == 'tenant:platform'
|
||
|
|
assert claims['roles'] == 'coding-agent'
|
||
|
|
assert r['bound_audiences'] == ['codex-railiance-platform']
|
||
|
|
assert r['token_ttl'] == r['token_max_ttl'] == '15m'
|
||
|
|
assert r['token_no_default_policy'] is True
|
||
|
|
assert 'default' not in r['token_policies']
|