Establish scoped KeyCape factor custody and verified automatic renewal

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c

tests/test_keycape_factor_provider.py

@@ -0,0 +1,21 @@
+import base64,importlib.util,json,time,unittest
+from pathlib import Path
+from unittest.mock import patch
+spec=importlib.util.spec_from_file_location("factor_provider",Path(__file__).resolve().parents[1]/"scripts/keycape_factor_provider.py")
+m=importlib.util.module_from_spec(spec);spec.loader.exec_module(m)
+class FactorProviderTests(unittest.TestCase):
+ def check(self,role="admin",auth_status=True,expiry=3600,policy_status=403,listing_status=True):
+  token="synthetic."+base64.urlsafe_b64encode(json.dumps({"exp":int(time.time())+expiry}).encode()).decode().rstrip("=")+".signature"
+  def request(path,payload=None,token=None):
+   if path=="/auth":return 200,{"result":{"status":auth_status,"value":{"role":role,"username":m.USER,"token":self.token}}}
+   if path=="/policy/":return policy_status,{}
+   return 200,{"result":{"status":listing_status,"value":{"tokens":[{}],"count":1}}}
+  self.token=token
+  with patch.object(m,"request",side_effect=request):return m.token_result("synthetic-password-not-a-real-secret")
+ def test_success_requires_scoped_admin_and_expiry(self):
+  r=self.check();self.assertTrue(r["policy_read_denied"]);self.assertTrue(r["cross_user_factor_visible"])
+ def test_rejects_user_token_expiry_and_privilege_leak(self):
+  for kwargs in [dict(role="user"),dict(auth_status=False),dict(expiry=-1),dict(expiry=9000),dict(policy_status=200),dict(policy_status=500),dict(listing_status=False)]:
+   with self.subTest(kwargs=kwargs):
+    with self.assertRaises(RuntimeError):self.check(**kwargs)
+ def test_no_redirect_forwarding(self):self.assertIsNone(m.NoRedirect().redirect_request(None,None,None,None,None,None))