Advance blocked assurance and operator callback work

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883

tests/test_openbao_operator_loopback_callback.py

@@ -1,78 +1,62 @@
-import json
-import os
-import subprocess
+import copy
+import importlib.util
 from pathlib import Path
+import pytest
+
+spec = importlib.util.spec_from_file_location('callback', Path(__file__).resolve().parents[1] / 'scripts/openbao_operator_loopback_callback.py')
+m = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(m)
 
 
-REPO_ROOT = Path(__file__).resolve().parents[1]
-SCRIPT = REPO_ROOT / "scripts/openbao-apply-operator-loopback-callback.sh"
-CALLBACK = "http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback"
+def role():
+    return {'role_type': 'oidc', 'token_policies': ['platform-admin'],
+            'allowed_redirect_uris': ['https://existing.example/callback'],
+            'token_ttl': 900, 'bound_claims': {'groups': ['custom-admins']},
+            'claim_mappings': {'email': 'email'}, 'token_max_ttl': 1800}
 
 
-def _fake_bao(tmp_path: Path) -> tuple[Path, Path]:
-    capture = tmp_path / "written-role.json"
-    executable = tmp_path / "bao"
-    executable.write_text(
-        """#!/bin/sh
-set -eu
-if [ "$1" = "write" ]; then
-  cp "${3#@}" "$BAO_CAPTURE"
-  exit 0
-fi
-if [ "$1" = "read" ]; then
-  if [ "${BAO_FAKE_MISSING_CALLBACK:-false}" = "true" ]; then
-    printf '%s\\n' '{"data":{"role_type":"oidc","token_policies":["platform-admin"],"allowed_redirect_uris":[]}}'
-  else
-    printf '%s\\n' '{"data":{"role_type":"oidc","token_policies":["platform-admin"],"allowed_redirect_uris":["http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback"]}}'
-  fi
-  exit 0
-fi
-exit 2
-""",
-        encoding="utf-8",
-    )
+def test_preserves_all_other_settings():
+    current = role()
+    original = copy.deepcopy(current)
+    writes = []
+    def write(value):
+        writes.append(value)
+        current.update(value)
+    assert m.update(lambda: copy.deepcopy(current), write)
+    assert len(writes) == 1
+    assert current == dict(original, allowed_redirect_uris=original['allowed_redirect_uris'] + [m.CALLBACK])
+    assert not m.update(lambda: copy.deepcopy(current), write)
+    assert len(writes) == 1
+
+
+def test_observed_concurrent_change_prevents_write():
+    reads = iter([role(), dict(role(), token_ttl=300)])
+    with pytest.raises(ValueError):
+        m.update(lambda: next(reads), lambda _: pytest.fail('must not write'))
+
+
+def test_failed_readback_is_not_success():
+    with pytest.raises(ValueError):
+        m.update(role, lambda _: None)
+
+
+@pytest.mark.parametrize('mutation', [{'role_type': 'jwt'}, {'token_policies': ['other']}, {'allowed_redirect_uris': 'bad'}])
+def test_unexpected_live_role_refused(monkeypatch, mutation):
+    import json
+    import subprocess
+    payload = dict(role(), **mutation)
+    monkeypatch.setattr(m.subprocess, 'run', lambda *a, **kw: subprocess.CompletedProcess(a, 0, json.dumps({'data': payload}).encode()))
+    with pytest.raises(ValueError):
+        m.read_role()
+
+
+def test_silent_entrypoint_on_command_failure(tmp_path):
+    import os
+    import subprocess
+    executable = tmp_path / 'bao'
+    executable.write_text('#!/bin/sh\necho SECRET_CANARY >&2\nexit 1\n')
     executable.chmod(0o755)
-    return executable, capture
-
-
-def _run(tmp_path: Path, *, missing_callback: bool = False) -> tuple[subprocess.CompletedProcess[str], Path]:
-    _, capture = _fake_bao(tmp_path)
-    env = dict(os.environ)
-    env.update(
-        {
-            "PATH": f"{tmp_path}:{env['PATH']}",
-            "TMPDIR": str(tmp_path),
-            "BAO_CAPTURE": str(capture),
-            "BAO_FAKE_MISSING_CALLBACK": str(missing_callback).lower(),
-        }
-    )
-    result = subprocess.run(
-        [str(SCRIPT)],
-        cwd=REPO_ROOT,
-        env=env,
-        text=True,
-        capture_output=True,
-        check=False,
-    )
-    return result, capture
-
-
-def test_contained_command_is_silent_and_writes_exact_role(tmp_path: Path) -> None:
-    result, capture = _run(tmp_path)
-    assert result.returncode == 0
-    assert result.stdout == ""
-    assert result.stderr == ""
-
-    role = json.loads(capture.read_text(encoding="utf-8"))
-    assert CALLBACK in role["allowed_redirect_uris"]
-    assert role["policies"] == ["platform-admin"]
-    assert role["bound_claims"] == {"groups": ["net-kingdom-admins"]}
-    assert not list(tmp_path.glob("openbao-platform-admin-*.json"))
-
-
-def test_verification_failure_remains_silent_and_nonzero(tmp_path: Path) -> None:
-    result, _ = _run(tmp_path, missing_callback=True)
+    result = subprocess.run([str(Path(m.__file__).with_name('openbao-apply-operator-loopback-callback.sh'))],
+        env=dict(os.environ, PATH=str(tmp_path) + ':' + os.environ['PATH']), capture_output=True)
     assert result.returncode != 0
-    assert result.stdout == ""
-    assert result.stderr == ""
-    assert not list(tmp_path.glob("openbao-platform-admin-*.json"))
+    assert result.stdout == result.stderr == b''