coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Allow bounded ESO token self-validation and cleanup
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883
This commit is contained in:
codex 2026-09-05 16:47:26 +02:00
parent 238d261536
commit 9c86983f1a
5 changed files with 29 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

3
tests/test_state_hub_preflight_lane.py
View file

@ -24,6 +24,8 @@ class SigningLaneTests(unittest.TestCase):
def test_data_only_policy_and_bounded_auth_survive_plan_generation(self):
self.assertNotIn('/metadata/', cc.generated_policy_hcl(self.ccr))
self.assertIn('path "auth/token/lookup-self"', cc.generated_policy_hcl(self.ccr))
self.assertIn('path "auth/token/revoke-self"', cc.generated_policy_hcl(self.ccr))
auth = cc.auth_payload(self.ccr)
self.assertEqual(auth['audience'], 'openbao')
self.assertEqual(auth['token_explicit_max_ttl'], '15m')
@ -35,6 +37,7 @@ class SigningLaneTests(unittest.TestCase):
def test_malformed_security_options_rejected(self):
for section, key, value in [('openbao', 'metadata_read', 'false'),
('openbao', 'token_self_lifecycle', 'true'),
('auth', 'audience', ''),
('auth', 'token_max_ttl', 900),
('auth', 'token_no_default_policy', 'true')]: