ea028c1de6
factory_audit_delivery re-pins the reviewed manifest after the CUST-WP-0073 metadata-only template fix and accepts only that exact template (data, type and dataFrom still refused). Flex-auth signer tests assert the reviewed state of CCR-2026-0050 and its pinned native plan instead of the pre-review snapshot. Full suite: 1547 passed, 18 skipped, 0 failed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 509845@bnt-lap001 Assistant-Session: ed7a7d95-d8eb-455c-b594-963fb1830f76
63 lines
3.9 KiB
Python
63 lines
3.9 KiB
Python
import hashlib
|
|
"""Real CCR schema/applier contract, no credentials or backend invocation."""
|
|
from copy import deepcopy
|
|
import importlib.util
|
|
import json
|
|
from pathlib import Path
|
|
import yaml
|
|
ROOT=Path(__file__).resolve().parents[1]
|
|
spec=importlib.util.spec_from_file_location('signer_ccr',ROOT/'scripts/credential-change.py')
|
|
ccr_module=importlib.util.module_from_spec(spec);spec.loader.exec_module(ccr_module)
|
|
CCR=ROOT/'credential-change-requests/CCR-2026-0050-flex-auth-envelope-signing.yaml'
|
|
|
|
|
|
def test_real_schema_and_apply_refusal():
|
|
ccr,errors,warnings=ccr_module.validate_ccr(CCR)
|
|
assert errors==[]
|
|
assert warnings==['OIDC/Kubernetes bound claim is not confirmed; apply is blocked']
|
|
blockers=ccr_module.applier_readiness_blockers(ccr)
|
|
assert len(blockers)==2
|
|
assert any('status, got proposed' in x for x in blockers)
|
|
assert any('confirmed OpenBao auth binding' in x for x in blockers)
|
|
assert ccr['access_frontdoor']['resolvable'] is False
|
|
# 2026-10-21: scoped owner reviews are recorded (RPF-WP-0035-T14), but the founder and
|
|
# cluster-runtime-storage-owner have not approved, so the CCR stays proposed.
|
|
approvers=set(ccr['review']['required_approvers'])
|
|
for comment in ccr['review']['comments']:
|
|
role=comment['reviewer'].split(' (')[0]
|
|
assert role in approvers and role not in {'founder','cluster-runtime-storage-owner'}
|
|
# Pure synthetic candidate only: ensure admitted-pattern scope has no latent
|
|
# schema/applier role/field failures once the real owners eventually approve.
|
|
admitted=deepcopy(ccr);admitted['status']='approved';admitted['openbao']['auth']['bound_claims_confirmed']=True
|
|
assert ccr_module.applier_readiness_blockers(admitted)==[]
|
|
|
|
|
|
def test_generated_read_scope_and_projection_join():
|
|
ccr,_,_=ccr_module.validate_ccr(CCR)
|
|
assert (ROOT/ccr['openbao']['policy_file']).read_text()==ccr_module.generated_policy_hcl(ccr)
|
|
hcl=ccr_module.generated_policy_hcl(ccr)
|
|
assert 'metadata/' not in hcl and 'list' not in hcl and 'create' not in hcl
|
|
assert ccr['openbao']['fields']==['ED25519_PRIVATE_KEY']
|
|
docs=list(yaml.safe_load_all((ROOT/'docs/credential-lane-designs/flex-auth-envelope-signing-native-projection.yaml.proposed').read_text()))
|
|
store=next(x for x in docs if x['kind']=='SecretStore')
|
|
assert store['spec']['provider']['vault']['auth']['kubernetes']['role']==ccr['openbao']['auth']['role']
|
|
external=next(x for x in docs if x['kind']=='ExternalSecret')
|
|
assert external['spec']['data']==[{'secretKey':'seed','remoteRef':{'key':'workloads/flex-auth/envelope-signing','property':'ED25519_PRIVATE_KEY'}}]
|
|
|
|
|
|
def test_native_scope_separates_read_grant_and_unadmitted_execution():
|
|
plan=json.loads((ROOT/'docs/credential-lane-designs/flex-auth-envelope-signing-native-plan.json').read_text())
|
|
assert plan['authority_granted'] is False and plan['status']=='prepared-unapproved'
|
|
assert plan['bootstrap']['expected_version']==0
|
|
assert all(x['disposition'].startswith('pending ') for x in plan['reviews_required'])
|
|
# The plan is the exact artifact the owners reviewed (native plan sha256 in CCR-2026-0050).
|
|
assert hashlib.sha256((ROOT/'docs/credential-lane-designs/flex-auth-envelope-signing-native-plan.json').read_bytes()).hexdigest().startswith('22306d50e082fc35')
|
|
state=plan['protected_adapter']['state']
|
|
assert 'implemented and tested' in state and 'not a native execution approval' in state
|
|
assert 'remain mandatory' in state and 'dev-process gate remains preserved' in state
|
|
assert plan['receipts']['maximum_bytes']==65536
|
|
assert all('platform/' in x['path'] for x in plan['bootstrap']['allowed_native_methods'])
|
|
# 84c529f: Platform creates no storage; the outbox PVC is Access's separate proposal and
|
|
# its provisioning stays with cluster-runtime-storage review.
|
|
resources=plan['requested_scope']['new_resources']
|
|
assert 'Platform creates no storage resources' in resources and 'remain open' in resources
|