"""Fixed SMTP admission with a synthetic Bao/SMTP boundary; no native credentials.""" import copy import importlib.util import json import os from pathlib import Path import subprocess import sys import tempfile import unittest from unittest.mock import patch import yaml ROOT = Path(__file__).resolve().parents[1] spec = importlib.util.spec_from_file_location('email_connect_delivery', ROOT / 'scripts/email_connect_smtp_delivery.py') delivery = importlib.util.module_from_spec(spec) spec.loader.exec_module(delivery) class FakeOwner: def __init__(self, lane): self.lane = lane self.writes = [] self.revoked = [] self.authenticated = False self.mailbox = {'data': dict(lane.FIELDS, SMTP_PASSWORD='fixture-only'), 'metadata': {'version': 2}} boundary = '\n'.join('path "'+p+'" { capabilities = ["deny"] }' for p in ( lane.LANE['kv_path'], lane.LANE['kv_path'].replace('/data/', '/metadata/', 1))) self.values = {p: {'policy': 'existing-consumer'} if '/policies/' in p else {'unchanged': True} for p in delivery.PROTECTED} self.values[delivery.PROTECTED[0]] = {'policy': boundary} self.changed_consumer = False self.changed_mailbox = False self.sealed = False self.cluster_id = delivery.OPENBAO_CLUSTER_ID self.auth_policies = ['platform-admin'] def bao(self, args, *, payload=None, allow_failure=False): if args[0] == 'status': value = {'cluster_id': self.cluster_id, 'initialized': True, 'sealed': self.sealed} elif args[:2] == ['token', 'lookup']: value = {'data': {'policies': self.auth_policies}} elif args[:2] == ['token', 'create']: value = {'auth': {'client_token': 'fixture-negative-token'}} elif args[0] == 'read': path = args[-1] if path == self.lane.LANE['kv_path']: v = copy.deepcopy(self.mailbox) if self.writes and self.changed_mailbox: v['metadata']['version'] += 1 value = {'data': v} elif path in self.values: v = copy.deepcopy(self.values[path]) if self.writes and self.changed_consumer and path == delivery.PROTECTED[1]: v['policy'] = 'changed' value = {'data': v} else: assert allow_failure return subprocess.CompletedProcess([], 2, b'', b'No value found') elif args[0] == 'write': path = args[1] assert path in ('sys/policies/acl/'+self.lane.LANE['policy'], 'auth/kubernetes/role/'+self.lane.LANE['role']) self.writes.append(path) v = copy.deepcopy(payload) for key in ('token_ttl', 'token_max_ttl', 'token_explicit_max_ttl'): if key in v: v[key] = 900 self.values[path] = v value = {} else: raise AssertionError(args) return subprocess.CompletedProcess([], 0, json.dumps(value).encode(), b'') def smtp(self, host, port, timeout): owner = self assert (host, port) == ('smtp.ionos.de', 587) class SMTP: def __enter__(self): return self def __exit__(self, *args): pass def ehlo(self): pass def starttls(self, context): assert context.check_hostname def login(self, user, password): assert user == 'platform@coulomb.social' and password == 'fixture-only' owner.authenticated = True return SMTP() def run(self): records = [] receipt = {} with patch.object(delivery, 'lane_module', return_value=self.lane), \ patch.object(self.lane, 'bao', side_effect=self.bao), \ patch.object(self.lane, 'capabilities', side_effect=lambda token, paths: {p: ['deny'] for p in paths}), \ patch.object(self.lane, 'revoke', side_effect=self.revoked.append), \ patch.object(self.lane.smtplib, 'SMTP', side_effect=self.smtp): delivery.admit(receipt, lambda r: records.append(copy.deepcopy(r))) return receipt, records class AdmissionTests(unittest.TestCase): def setUp(self): self.lane = delivery.lane_module() self.owner = FakeOwner(self.lane) def test_default_preview_has_no_owner_calls_and_exact_role(self): with patch.object(delivery, 'lane_module', return_value=self.lane), \ patch.object(self.lane, 'bao', side_effect=AssertionError('no owner call')): ccr, proposal, digest = delivery.prepare() self.assertEqual(ccr['id'], 'CCR-2026-0056') role = proposal['role'] self.assertEqual(role['bound_service_account_namespaces'], ['email-connect']) self.assertEqual(role['bound_service_account_names'], ['email-connect-platform-smtp-eso']) self.assertEqual(role['token_explicit_max_ttl'], '15m') self.assertTrue(role['token_no_default_policy']) self.assertNotIn('*', proposal['policy']) self.assertTrue(digest.startswith('sha256:')) def test_approval_and_native_binding_do_not_change_reviewed_scope_digest(self): ccr, _, _ = delivery.prepare() # Model the review lifecycle independently of the live CCR's activation. ccr['status'] = 'proposed' ccr['openbao']['auth']['bound_claims_confirmed'] = False ccr['review']['comments'] = [] ccr['verification']['evidence'] = [] ccr['access_frontdoor'].update(readiness='pending-review', resolvable=False) with tempfile.TemporaryDirectory() as tmp: path = Path(tmp) / 'ccr.yaml'; path.write_text(yaml.safe_dump(ccr)) with patch.object(delivery, 'CCR', path): initial = delivery.prepare()[2] ccr['status'] = 'approved' ccr['openbao']['auth']['bound_claims_confirmed'] = True ccr['review']['comments'] = [{'reviewer': 'fixture', 'decision': 'approved'}] path.write_text(yaml.safe_dump(ccr)) self.assertEqual(delivery.prepare()[2], initial) ccr['openbao']['auth']['bound_claims']['service_account_namespaces'] = ['other'] path.write_text(yaml.safe_dump(ccr)) with self.assertRaises(delivery.Refused): delivery.prepare() def test_all_three_execution_gates(self): ccr, _, digest = delivery.prepare() ccr['status'] = 'proposed' ccr['openbao']['auth']['bound_claims_confirmed'] = False with self.assertRaises(delivery.Refused): delivery.execution_guard(ccr, 'wrong', digest) with self.assertRaises(delivery.Refused): delivery.execution_guard(ccr, digest, digest) ccr['status'] = 'approved' with self.assertRaises(delivery.Refused): delivery.execution_guard(ccr, digest, digest) ccr['openbao']['auth']['bound_claims_confirmed'] = True delivery.execution_guard(ccr, digest, digest) def test_new_reader_only_and_existing_consumers_preserved(self): receipt, records = self.owner.run() self.assertEqual(receipt['status'], 'reader_admitted_verified') self.assertTrue(receipt['existing_consumers_preserved']) self.assertTrue(receipt['mailbox_unchanged']) self.assertFalse(receipt['native_consumer_auth_verified']) self.assertFalse(receipt['email_sent']) self.assertFalse(receipt['application_sender_changed']) self.assertTrue(self.owner.authenticated) self.assertEqual(len(self.owner.writes), 2) self.assertEqual(self.owner.revoked, ['fixture-negative-token']) self.assertEqual(records[0]['mutation_outcome'], 'unconfirmed') def test_instance_sealed_and_admin_guards_precede_writes(self): for kind, value in [('cluster_id', 'wrong'), ('sealed', True), ('auth_policies', ['root'])]: with self.subTest(kind=kind): owner = FakeOwner(self.lane); setattr(owner, kind, value) with self.assertRaises(delivery.Refused): owner.run() self.assertFalse(owner.writes) self.assertFalse(owner.authenticated) def test_missing_agent_boundary_cannot_be_added_implicitly(self): self.owner.values[delivery.PROTECTED[0]] = {'policy': ''} with self.assertRaises(delivery.Refused): self.owner.run() self.assertEqual(self.owner.writes, []) def test_different_existing_role_prevents_even_policy_creation(self): self.owner.values['auth/kubernetes/role/'+delivery.LANE['role']] = {'different': True} with self.assertRaises(self.lane.LaneError): self.owner.run() self.assertFalse(self.owner.authenticated) self.assertEqual(self.owner.writes, []) def test_different_existing_policy_is_not_replaced(self): self.owner.values['sys/policies/acl/'+delivery.LANE['policy']] = {'policy': 'different'} with self.assertRaises(delivery.Refused): self.owner.run() self.assertEqual(self.owner.writes, []) def test_existing_exact_reader_is_idempotent_without_metadata_writes(self): self.owner.run(); self.owner.writes.clear() receipt, _ = self.owner.run() self.assertEqual(receipt['status'], 'reader_admitted_verified') self.assertEqual(self.owner.writes, []) def test_existing_consumer_or_mailbox_change_refuses_success(self): for field in ['changed_consumer', 'changed_mailbox']: with self.subTest(field=field): owner = FakeOwner(self.lane); setattr(owner, field, True) with self.assertRaises(delivery.Refused): owner.run() self.assertEqual(len(owner.writes), 2) def approved(self): ccr, proposal, digest = delivery.prepare() ccr['status'] = 'approved'; ccr['openbao']['auth']['bound_claims_confirmed'] = True return ccr, proposal, digest def test_failed_attempt_is_private_append_only_and_redacted(self): ccr, proposal, digest = self.approved() with tempfile.TemporaryDirectory() as tmp: path = Path(tmp) / 'receipt.jsonl' def fail(receipt, checkpoint): receipt.update(phase='admitting', mutation_outcome='unconfirmed') checkpoint(receipt) raise RuntimeError('synthetic private provider text must not leave') self.assertEqual(delivery.execute(ccr, proposal, digest, digest, path, fail), 1) rows = [json.loads(line) for line in path.read_text().splitlines()] self.assertEqual(len(rows), 3) self.assertEqual(rows[0]['mutation_outcome'], 'not_started') self.assertEqual(rows[1]['mutation_outcome'], 'unconfirmed') self.assertEqual(rows[-1]['reason'], 'contained_admission_failure') self.assertNotIn('private provider', path.read_text()) self.assertEqual(path.stat().st_mode & 0o777, 0o600) before = path.read_bytes() with self.assertRaises(FileExistsError): delivery.execute(ccr, proposal, digest, digest, path, fail) self.assertEqual(path.read_bytes(), before) def test_interrupted_attempt_never_records_verified(self): ccr, proposal, digest = self.approved() with tempfile.TemporaryDirectory() as tmp: path = Path(tmp) / 'receipt.jsonl' def stop(receipt, checkpoint): receipt.update(phase='admitting', mutation_outcome='unconfirmed') checkpoint(receipt); raise SystemExit(7) with self.assertRaises(SystemExit): delivery.execute(ccr, proposal, digest, digest, path, stop) rows = [json.loads(line) for line in path.read_text().splitlines()] self.assertTrue(all(r['status'] == 'started' for r in rows)) self.assertEqual(rows[-1]['mutation_outcome'], 'unconfirmed') self.assertNotIn('completed_at', rows[-1]) self.assertIn('interrupted_at', rows[-1]) def test_public_receipt_parent_refused(self): ccr, proposal, digest = self.approved() with tempfile.TemporaryDirectory() as tmp: os.chmod(tmp, 0o755) with self.assertRaises(delivery.Refused): delivery.execute(ccr, proposal, digest, digest, Path(tmp)/'r', lambda *_: None) self.assertEqual(list(Path(tmp).iterdir()), []) def test_execute_refusal_is_silent_and_does_not_create_receipt(self): with tempfile.TemporaryDirectory() as tmp: path = Path(tmp)/'receipt.jsonl' r = subprocess.run([sys.executable, str(ROOT/'scripts/email_connect_smtp_delivery.py'), '--execute', '--expect-digest', 'wrong', '--receipt', str(path)], capture_output=True, timeout=10) self.assertNotEqual(r.returncode, 0) self.assertEqual((r.stdout, r.stderr), (b'', b'')) self.assertFalse(path.exists()) def test_telemetry_module_is_not_rebound(self): import telemetry_smtp_delivery self.assertEqual(telemetry_smtp_delivery.LANE['namespace'], 'telemetry') if __name__ == '__main__': unittest.main()