Establish scoped KeyCape factor custody and verified automatic renewal

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c

tests/test_keycape_factor_metadata.py

@@ -0,0 +1,31 @@
+import importlib.util,unittest
+from pathlib import Path
+from unittest.mock import patch
+spec=importlib.util.spec_from_file_location("factor_metadata",Path(__file__).resolve().parents[1]/"scripts/keycape_factor_metadata.py")
+m=importlib.util.module_from_spec(spec);spec.loader.exec_module(m)
+class FactorMetadataTests(unittest.TestCase):
+ def test_exact_role_and_policy_scope(self):
+  self.assertEqual(["keycape-factor-eso"],m.ROLE_CONFIG["bound_service_account_names"])
+  self.assertEqual(["sso"],m.ROLE_CONFIG["bound_service_account_namespaces"])
+  self.assertTrue(m.ROLE_CONFIG["token_no_default_policy"])
+  self.assertEqual(900,m.ROLE_CONFIG["token_max_ttl"])
+  policy=(m.ROOT/"openbao/policies"/(m.POLICY+".hcl")).read_text()
+  self.assertNotIn("*",policy);self.assertNotIn("issuer",policy.splitlines()[1:])
+  self.assertEqual(3,policy.count('capabilities = ["read"]'))
+ def test_denied_capabilities_prevent_writes(self):
+  calls=[]
+  def fake(*args,**kwargs):
+   calls.append(args)
+   if args[:2]==("secrets","list"):return {"platform/":{"type":"kv","options":{"version":"2"}}}
+   if args[:2]==("auth","list"):return {"kubernetes/":{"type":"kubernetes"}}
+   return ["deny"]
+  with patch.object(m,"call",side_effect=fake):
+   with self.assertRaises(RuntimeError):m.execute(True)
+  self.assertFalse(any(c[0]=="write" for c in calls))
+ def test_mismatched_role_fails_readback(self):
+  self.assertTrue(m.verify_role(dict(m.ROLE_CONFIG)))
+  self.assertFalse(m.verify_role(dict(m.ROLE_CONFIG,token_policies=["root"])))
+
+ def test_policy_readback_accepts_cli_and_api_shapes(self):
+  self.assertEqual("expected",m.policy_text({"policy":"expected"}))
+  self.assertEqual("expected",m.policy_text({"data":{"policy":"expected"}}))