104ed90f42
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a1468b-63fa-7710-85dc-8f2e16b3ebfa
70 lines
3.1 KiB
Python
70 lines
3.1 KiB
Python
"""Proposed fixed issuer ESO source contract for RPF-1.3-T4 / NK48-R5-F2.
|
|
|
|
Pure public metadata only. No API/credential/Secret access or apply path. This
|
|
new declaration requires independent Platform review before type integration.
|
|
The delivery lane may use only external_secret(); store provisioning is a
|
|
separate owner action and is never delegated by this module.
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
from copy import deepcopy
|
|
from pathlib import Path
|
|
import re
|
|
|
|
import yaml
|
|
|
|
ROOT = Path(__file__).resolve().parents[1]
|
|
TEMPLATE = ROOT / 'manifests/templates/keycape-issuer-eso.yaml'
|
|
|
|
|
|
class Refused(ValueError):
|
|
"""Fixed issuer metadata differs; never return an owner delivery receipt."""
|
|
|
|
|
|
def documents(client_id: str) -> tuple[dict, dict]:
|
|
# Match the frozen type client_id pattern and existing adapter's derived bound.
|
|
# No caller can supply a store name/kind/namespace or an OpenBao path.
|
|
if not isinstance(client_id, str) or not re.fullmatch(r'[a-z0-9][a-z0-9-]{1,62}', client_id):
|
|
raise Refused('bounded admitted client_id required')
|
|
if len('keycape-' + client_id + '-client') > 63:
|
|
raise Refused('derived issuer reference exceeds existing adapter bound')
|
|
store, external = yaml.safe_load_all(TEMPLATE.read_text().format(client_id=client_id))
|
|
return store, external
|
|
|
|
|
|
def external_secret(client_id: str) -> dict:
|
|
"""The ONLY document the proposed delivery capability may apply."""
|
|
return deepcopy(documents(client_id)[1])
|
|
|
|
|
|
def _matching_public_resource(observed: dict, expected: dict) -> None:
|
|
if not isinstance(observed, dict):
|
|
raise Refused('public resource observation required')
|
|
metadata = observed.get('metadata')
|
|
if not isinstance(metadata, dict):
|
|
raise Refused('resource metadata required')
|
|
expected_namespace = expected['metadata'].get('namespace')
|
|
namespace_matches = (metadata.get('namespace') == expected_namespace
|
|
if expected_namespace else metadata.get('namespace') in (None, ''))
|
|
if (observed.get('apiVersion') != expected['apiVersion']
|
|
or observed.get('kind') != expected['kind']
|
|
or metadata.get('name') != expected['metadata']['name']
|
|
or not namespace_matches
|
|
or observed.get('spec') != expected['spec']):
|
|
raise Refused('fixed issuer resource differs')
|
|
status = observed.get('status')
|
|
conditions = status.get('conditions', []) if isinstance(status, dict) else []
|
|
if not isinstance(conditions, list) or not any(
|
|
isinstance(c, dict) and c.get('type') == 'Ready' and c.get('status') == 'True'
|
|
for c in conditions):
|
|
raise Refused('fixed issuer resource not ready')
|
|
|
|
|
|
def require_fixed_store(observed: dict, client_id: str) -> None:
|
|
"""Refuse a missing/drifted/not-ready store; never create it through delivery."""
|
|
_matching_public_resource(observed, documents(client_id)[0])
|
|
|
|
|
|
def require_ready_delivery(observed: dict, client_id: str) -> None:
|
|
"""Spec equality and Ready precede a created/NO_CHANGE owner receipt."""
|
|
_matching_public_resource(observed, documents(client_id)[1])
|