acbc78ffea
The helper previews delivery with no OpenBao or node effect and refuses execution while the CCRs stay draft. Policies are read-only on each workload path. No provider key is included. Assistant: grok Assistant-Session: 01a11cdb-f9fe-7011-947c-936e72007e54
60 lines
2.3 KiB
Python
60 lines
2.3 KiB
Python
"""Public export preserves the canonical YAML approval state and exact policy."""
|
|
|
|
import hashlib
|
|
import importlib.util
|
|
import json
|
|
import sys
|
|
from pathlib import Path
|
|
|
|
import pytest
|
|
import yaml
|
|
|
|
ROOT = Path(__file__).resolve().parents[1]
|
|
sys.path.insert(0, str(ROOT / "scripts"))
|
|
spec = importlib.util.spec_from_file_location(
|
|
"exporter", ROOT / "scripts/render_backup_credential_contract.py"
|
|
)
|
|
e = importlib.util.module_from_spec(spec)
|
|
spec.loader.exec_module(e)
|
|
|
|
|
|
@pytest.mark.parametrize("application", e.PROFILES)
|
|
def test_owner_yaml_updates_export_without_node_yaml_dependency(application, tmp_path):
|
|
source = (
|
|
ROOT
|
|
/ "credential-change-requests"
|
|
/ f"{e.PROFILES[application]['ccr']}-{application}-backup-primary.yaml"
|
|
)
|
|
ccr = yaml.safe_load(source.read_text())
|
|
ccr["status"] = "applied"
|
|
ccr["openbao"]["auth"]["bound_claims_confirmed"] = True
|
|
candidate = tmp_path / "reviewed.yaml"
|
|
candidate.write_text(yaml.safe_dump(ccr))
|
|
raw = e.render(candidate, application)
|
|
exported = json.loads(raw)
|
|
assert exported["status"] == "applied"
|
|
assert exported["source_ccr_sha256"] == hashlib.sha256(candidate.read_bytes()).hexdigest()
|
|
assert len(exported["policy_sha256"]) == 64
|
|
# Export is a representation, not an approval: missing reviews/admission fail.
|
|
with pytest.raises(Exception):
|
|
e.contract(raw, application, True, hashlib.sha256(raw).hexdigest())
|
|
|
|
|
|
def test_export_rejects_source_secret_marker(tmp_path):
|
|
source = ROOT / "credential-change-requests/CCR-2026-0036-coulomb-social-backup-primary.yaml"
|
|
ccr = json.loads(source.read_bytes())
|
|
ccr["accidental_value"] = "AGE-SECRET-KEY-1SYNTHETIC"
|
|
candidate = tmp_path / "bad.yaml"
|
|
candidate.write_text(yaml.safe_dump(ccr))
|
|
with pytest.raises(ValueError, match="invalid_reader_contract"):
|
|
e.render(candidate, "coulomb-social")
|
|
|
|
|
|
def test_export_cannot_change_reader_namespace(tmp_path):
|
|
source = ROOT / "credential-change-requests/CCR-2026-0036-coulomb-social-backup-primary.yaml"
|
|
ccr = json.loads(source.read_bytes())
|
|
ccr["openbao"]["auth"]["bound_claims"]["service_account_namespaces"] = ["email-connect"]
|
|
candidate = tmp_path / "bad.yaml"
|
|
candidate.write_text(yaml.safe_dump(ccr))
|
|
with pytest.raises(Exception):
|
|
e.render(candidate, "coulomb-social")
|