d18649fc6e
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02b90-83bf-75c2-81c8-aa705414e4d4
78 lines
2.4 KiB
Python
78 lines
2.4 KiB
Python
import json
|
|
import os
|
|
import subprocess
|
|
from pathlib import Path
|
|
|
|
|
|
REPO_ROOT = Path(__file__).resolve().parents[1]
|
|
SCRIPT = REPO_ROOT / "scripts/openbao-apply-operator-loopback-callback.sh"
|
|
CALLBACK = "http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback"
|
|
|
|
|
|
def _fake_bao(tmp_path: Path) -> tuple[Path, Path]:
|
|
capture = tmp_path / "written-role.json"
|
|
executable = tmp_path / "bao"
|
|
executable.write_text(
|
|
"""#!/bin/sh
|
|
set -eu
|
|
if [ "$1" = "write" ]; then
|
|
cp "${3#@}" "$BAO_CAPTURE"
|
|
exit 0
|
|
fi
|
|
if [ "$1" = "read" ]; then
|
|
if [ "${BAO_FAKE_MISSING_CALLBACK:-false}" = "true" ]; then
|
|
printf '%s\\n' '{"data":{"role_type":"oidc","token_policies":["platform-admin"],"allowed_redirect_uris":[]}}'
|
|
else
|
|
printf '%s\\n' '{"data":{"role_type":"oidc","token_policies":["platform-admin"],"allowed_redirect_uris":["http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback"]}}'
|
|
fi
|
|
exit 0
|
|
fi
|
|
exit 2
|
|
""",
|
|
encoding="utf-8",
|
|
)
|
|
executable.chmod(0o755)
|
|
return executable, capture
|
|
|
|
|
|
def _run(tmp_path: Path, *, missing_callback: bool = False) -> tuple[subprocess.CompletedProcess[str], Path]:
|
|
_, capture = _fake_bao(tmp_path)
|
|
env = dict(os.environ)
|
|
env.update(
|
|
{
|
|
"PATH": f"{tmp_path}:{env['PATH']}",
|
|
"TMPDIR": str(tmp_path),
|
|
"BAO_CAPTURE": str(capture),
|
|
"BAO_FAKE_MISSING_CALLBACK": str(missing_callback).lower(),
|
|
}
|
|
)
|
|
result = subprocess.run(
|
|
[str(SCRIPT)],
|
|
cwd=REPO_ROOT,
|
|
env=env,
|
|
text=True,
|
|
capture_output=True,
|
|
check=False,
|
|
)
|
|
return result, capture
|
|
|
|
|
|
def test_contained_command_is_silent_and_writes_exact_role(tmp_path: Path) -> None:
|
|
result, capture = _run(tmp_path)
|
|
assert result.returncode == 0
|
|
assert result.stdout == ""
|
|
assert result.stderr == ""
|
|
|
|
role = json.loads(capture.read_text(encoding="utf-8"))
|
|
assert CALLBACK in role["allowed_redirect_uris"]
|
|
assert role["policies"] == ["platform-admin"]
|
|
assert role["bound_claims"] == {"groups": ["net-kingdom-admins"]}
|
|
assert not list(tmp_path.glob("openbao-platform-admin-*.json"))
|
|
|
|
|
|
def test_verification_failure_remains_silent_and_nonzero(tmp_path: Path) -> None:
|
|
result, _ = _run(tmp_path, missing_callback=True)
|
|
assert result.returncode != 0
|
|
assert result.stdout == ""
|
|
assert result.stderr == ""
|
|
assert not list(tmp_path.glob("openbao-platform-admin-*.json"))
|