coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Close CCR drift and high-risk policy gaps
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source
This commit is contained in:
codex 2026-08-21 01:29:28 +02:00
parent 852a8ab661
commit 382f04412a
12 changed files with 577 additions and 68 deletions
Download patch file Download diff file Expand all files Collapse all files

73
tests/test_credential_change.py
View file

@ -76,6 +76,55 @@ class CredentialChangeTests(unittest.TestCase):
self.assertEqual(errors, [])
self.assertEqual(ccr["target"]["rapp"], "rapp-qonto")
def test_email_connect_declares_live_transitional_token_auth(self) -> None:
path = (
REPO_DIR
/ "credential-change-requests/CCR-2026-0010-email-connect-transactional.yaml"
)
ccr, errors, warnings = credential_change.validate_ccr(path)
self.assertEqual(errors, [])
self.assertEqual(ccr["openbao"]["auth"]["method"], "token")
self.assertEqual(
ccr["openbao"]["auth"]["token_secret"],
"external-secrets/openbao-email-connect-eso-token",
)
self.assertTrue(any("token auth is transitional" in item for item in warnings))
rendered = credential_change.render_summary(ccr, warnings)
self.assertIn("transitional token via Secret", rendered)
def test_in_flight_ccr_declares_each_completion_only_omission(self) -> None:
path = (
REPO_DIR
/ "credential-change-requests/CCR-2026-0011-scaleway-object-storage-bootstrap.yaml"
)
ccr, errors, warnings = credential_change.validate_ccr(path)
self.assertEqual(errors, [])
self.assertEqual(warnings, [])
self.assertEqual(ccr["status"], "in_flight")
self.assertEqual(
set(ccr["in_flight"]["missing_fields"]),
{"openbao.policy_file", "openbao.auth"},
)
payload = credential_change.status_payload(ccr, warnings)
self.assertFalse(payload["apply_allowed"])
self.assertFalse(payload["frontdoor_resolvable"])
self.assertIn("got in_flight", " ".join(payload["apply_blockers"]))
rendered = credential_change.render_summary(ccr, warnings)
self.assertIn("in flight; declared missing", rendered)
def test_in_flight_ccr_cannot_omit_an_undeclared_field(self) -> None:
source = (
REPO_DIR
/ "credential-change-requests/CCR-2026-0011-scaleway-object-storage-bootstrap.yaml"
)
path = self.unapproved_ccr(source)
data = credential_change.load_yaml(path)
data["status"] = "in_flight"
data["in_flight"]["missing_fields"] = ["openbao.auth"]
credential_change.dump_yaml(path, data)
_ccr, errors, _warnings = credential_change.validate_ccr(path)
self.assertTrue(any("openbao.policy_file" in error for error in errors))
def test_core_hub_runtime_lane_is_split_and_agent_denied(self) -> None:
path = (
REPO_DIR
@ -105,6 +154,30 @@ class CredentialChangeTests(unittest.TestCase):
self.assertEqual(store["spec"]["provider"]["vault"]["path"], "platform")
self.assertEqual(store["spec"]["conditions"][0]["namespaces"], ["core-hub"])
def test_agent_boundary_denies_every_current_concrete_high_risk_catalog_path(self) -> None:
boundary = (
REPO_DIR / "openbao/policies/agent-high-risk-boundary.hcl"
).read_text()
data_paths = {
"platform/data/workloads/activity-core/llm-connect/llm-connect-provider-secrets",
"platform/data/workloads/railiance/backup/offsite-lane",
"platform/data/workloads/forgejo/forgejo-admin",
"tenants/data/binky/company-email/imap",
"tenants/data/binky/qonto-api",
"platform/data/workloads/coulomb/whynot-design/npm-publish",
"platform/data/workloads/rapp-qonto/keycape-client",
"platform/data/workloads/agent-harness/forgejo-deploy-key",
"platform/data/workloads/audit-core/senders",
"platform/data/workloads/email-connect/transactional",
"platform/data/workloads/railiance/scaleway/bootstrap",
}
for path in data_paths:
with self.subTest(path=path):
self.assertRegex(
boundary,
rf'path "{path}" \{{\s*capabilities = \["deny"\]',
)
database_policy = (
REPO_DIR / "openbao/policies/external-secrets-core-hub-database.hcl"
).read_text()