2d4a3838bf
A value held in platform custody that no workload reads, delivered into a service by an attended, MFA-gated procedure (privacyIDEA resolver bind for NetKingdom NK-WP-0056-T04). The contract forbids any policy, auth role, ESO object or runtime frontdoor. Modelled on attended-host-key-delivery. 4 tests. The 3 failures in test_credential_change.py also occur on main. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 896183@bnt-lap001 Assistant-Session: 3a18c01a-3205-4d02-94db-9efff25649a2
40 lines
1.8 KiB
Python
40 lines
1.8 KiB
Python
"""attended-service-credential-delivery contract (NetKingdom NK-WP-0056-T04); no values."""
|
|
import copy
|
|
import importlib.util
|
|
from pathlib import Path
|
|
|
|
import yaml
|
|
|
|
ROOT = Path(__file__).resolve().parents[1]
|
|
spec = importlib.util.spec_from_file_location("asd", ROOT / "scripts/attended_service_delivery.py")
|
|
m = importlib.util.module_from_spec(spec)
|
|
spec.loader.exec_module(m)
|
|
CCR = yaml.safe_load((ROOT / "credential-change-requests/CCR-2026-0055-net-kingdom-privacyidea-bind.yaml").read_text())
|
|
|
|
|
|
def test_checked_in_request_is_valid():
|
|
assert m.validate_contract(CCR) == []
|
|
|
|
|
|
def test_any_workload_access_is_refused():
|
|
for change in ({"policy_name": "x"}, {"runtime_access": True}, {"initial_cas": 1},
|
|
{"auth": {"method": "kubernetes", "mount": "kubernetes", "role": "x"}}):
|
|
ccr = copy.deepcopy(CCR); ccr["openbao"].update(change)
|
|
assert m.validate_contract(ccr), change
|
|
ccr = copy.deepcopy(CCR); ccr["access_frontdoor"]["resolvable"] = True
|
|
assert "runtime credential frontdoor must remain disabled" in m.validate_contract(ccr)
|
|
|
|
|
|
def test_delivery_and_lifecycle_are_required():
|
|
ccr = copy.deepcopy(CCR); del ccr["delivery"]["gate"]
|
|
assert "delivery needs surface, service, target, procedure and gate" in m.validate_contract(ccr)
|
|
ccr = copy.deepcopy(CCR); ccr["lifecycle"]["rotate"] = ""
|
|
assert "lifecycle.rotate required" in m.validate_contract(ccr)
|
|
|
|
|
|
def test_applied_stage_needs_every_required_approval():
|
|
ccr = copy.deepcopy(CCR); ccr["status"] = "verified"
|
|
ccr["review"]["comments"] = [{"reviewer": "User (platform-owner)", "decision": "approved"}]
|
|
assert m.validate_contract(ccr) == ["explicit role approval missing: net-kingdom-owner"]
|
|
ccr["review"]["comments"].append({"reviewer": "net-kingdom-owner", "decision": "approved"})
|
|
assert m.validate_contract(ccr) == []
|