d35c0f9d4b
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a1468b-63fa-7710-85dc-8f2e16b3ebfa
105 lines
4.3 KiB
Python
105 lines
4.3 KiB
Python
from __future__ import annotations
|
|
|
|
import importlib.util
|
|
import sys
|
|
import unittest
|
|
from pathlib import Path
|
|
|
|
REPO_DIR = Path(__file__).resolve().parents[1]
|
|
SPEC = importlib.util.spec_from_file_location(
|
|
"credential_grants_validate", REPO_DIR / "scripts/credential-grants-validate.py"
|
|
)
|
|
grants = importlib.util.module_from_spec(SPEC)
|
|
assert SPEC.loader is not None
|
|
sys.modules[SPEC.name] = grants
|
|
SPEC.loader.exec_module(grants)
|
|
|
|
|
|
class CredentialGrantBindTests(unittest.TestCase):
|
|
def test_catalog_validates(self) -> None:
|
|
errors: list[str] = []
|
|
catalog = grants.yaml.safe_load(
|
|
(REPO_DIR / "credential-grants/catalog.yaml").read_text()
|
|
)
|
|
for index, grant in enumerate(catalog["grants"]):
|
|
grants.validate_grant(grant, index, catalog, errors)
|
|
self.assertEqual(errors, [])
|
|
|
|
def test_keycape_generator_actor_matches_applied_issuer_binding(self) -> None:
|
|
catalog = grants.yaml.safe_load(
|
|
(REPO_DIR / 'credential-grants/catalog.yaml').read_text())
|
|
grant = next(g for g in catalog['grants'] if g['id'] == 'keycape/client-secret-generate')
|
|
ccr = grants.yaml.safe_load((REPO_DIR / 'credential-change-requests' /
|
|
'CCR-2026-0043-keycape-client-secret-generate-issuer-binding.yaml').read_text())
|
|
role = grants.yaml.safe_load((REPO_DIR / ccr['openbao']['auth']['role_file']).read_text())
|
|
auth = ccr['openbao']['auth']
|
|
self.assertEqual(grant['actors']['allowed_types'], ['human-operator'])
|
|
self.assertEqual(grant['actors']['required_subject_binding'],
|
|
f"auth/{auth['mount']}/role/{auth['role']}")
|
|
self.assertEqual(role['bound_claims'],
|
|
{'groups': ['net-kingdom-admins'], '/assurance/level': 'aal2'})
|
|
|
|
def test_postgres_grants_bind_rapp(self) -> None:
|
|
catalog = grants.yaml.safe_load(
|
|
(REPO_DIR / "credential-grants/catalog.yaml").read_text()
|
|
)
|
|
bound = {
|
|
grant["id"]: grant.get("rapp_id")
|
|
for grant in catalog["grants"]
|
|
if str(grant["id"]).startswith("rapp-")
|
|
}
|
|
self.assertEqual(
|
|
bound,
|
|
{
|
|
"rapp-postgres/audit-core-runtime": "rapp-postgres",
|
|
"rapp-postgres/audit-core-migration": "rapp-postgres",
|
|
},
|
|
)
|
|
|
|
def test_rapp_prefix_requires_matching_rapp_id(self) -> None:
|
|
errors: list[str] = []
|
|
grant = {
|
|
"id": "rapp-postgres/audit-core-runtime",
|
|
"title": "x",
|
|
"description": "x",
|
|
"status": "active",
|
|
"grant_class": "self-service",
|
|
"credential_type": "openbao-database-credential",
|
|
"issuer": "openbao",
|
|
"audience": "audit-core",
|
|
"openbao": {
|
|
"token_role": "audit-core-runtime-broker",
|
|
"issuer_policy": "credential-broker-audit-core-runtime-issuer",
|
|
"policies": ["credential-broker-audit-core-runtime"],
|
|
"disallowed_policies": ["root", "platform-admin"],
|
|
"mount_paths": ["database/creds/audit-core-runtime"],
|
|
},
|
|
"ttl": {"default": "15m", "max": "1h", "renewable": False},
|
|
"actors": {"allowed_types": ["human-operator"]},
|
|
"authorization": {
|
|
"flex_auth_required": False,
|
|
"purpose_required": True,
|
|
},
|
|
"delivery": {
|
|
"allowed": ["exec-env"],
|
|
"preferred": "exec-env",
|
|
"denied": [
|
|
"chat",
|
|
"state-hub-body",
|
|
"git",
|
|
"command-line-token-argument",
|
|
"llm-prompt",
|
|
],
|
|
},
|
|
"audit": {
|
|
"openbao_audit_required": True,
|
|
"record_secret_values": False,
|
|
},
|
|
"revocation": {"required": True, "by_accessor": True},
|
|
}
|
|
grants.validate_grant(grant, 0, {}, errors)
|
|
self.assertTrue(any("rapp_id is required" in error for error in errors))
|
|
errors.clear()
|
|
grant["rapp_id"] = "rapp-openbao"
|
|
grants.validate_grant(grant, 0, {}, errors)
|
|
self.assertTrue(any("must equal the grant id prefix" in error for error in errors))
|