9ce42da97e
The reader login succeeded; the child died at preflight. Use bao for the KV read, accept parent/sibling deny shapes, and record a failure class. Assistant: grok Assistant-Session: 01a0a23b-3bf0-7341-b4e5-9dc05f72573a
55 lines
2.6 KiB
Python
55 lines
2.6 KiB
Python
import importlib.util
|
|
from pathlib import Path
|
|
import unittest
|
|
|
|
spec = importlib.util.spec_from_file_location(
|
|
'sitting', Path(__file__).resolve().parents[1] / 'scripts/provision-sitting-requester.py')
|
|
m = importlib.util.module_from_spec(spec)
|
|
spec.loader.exec_module(m)
|
|
|
|
|
|
class SittingRequesterProvisioningTests(unittest.TestCase):
|
|
def test_contract_is_create_only_informed_decision(self):
|
|
m.contract()
|
|
self.assertEqual(m.CLIENT['clientId'], 'informed-decision-sitting-requester')
|
|
self.assertEqual(m.CLIENT['allowedScopes'], ['approval:create'])
|
|
self.assertEqual(m.CLIENT['serviceSubject'], 'informed-decision')
|
|
self.assertEqual(m.CCRS, ('CCR-2026-0026', 'CCR-2026-0027'))
|
|
self.assertNotIn('CCR-2026-0024', m.CCRS)
|
|
self.assertNotIn('CCR-2026-0025', m.CCRS)
|
|
|
|
def test_contract_refuses_widened_scopes(self):
|
|
original = list(m.CLIENT['allowedScopes'])
|
|
m.CLIENT['allowedScopes'] = ['approval:create', 'approval:consume']
|
|
with self.assertRaises(Exception):
|
|
m.contract()
|
|
m.CLIENT['allowedScopes'] = original
|
|
|
|
def test_source_keycape_registration_matches_helper(self):
|
|
import yaml
|
|
clients = yaml.safe_load(Path('/home/worsch/key-cape/config/service-clients.example.yaml').read_text())['clients']
|
|
named = next(c for c in clients if c['clientId'] == 'informed-decision-sitting-requester')
|
|
self.assertEqual(named['secretRef'], 'env:' + m.ENV_NAME)
|
|
self.assertEqual(named['allowedScopes'], ['approval:create'])
|
|
self.assertEqual(named['serviceSubject'], 'informed-decision')
|
|
|
|
|
|
class SittingRequesterExchangeTests(unittest.TestCase):
|
|
def test_exchange_helper_does_not_post_sittings(self):
|
|
spec = importlib.util.spec_from_file_location(
|
|
'exchange', Path(__file__).resolve().parents[1] / 'scripts/prove-sitting-requester-exchange.py')
|
|
exchange = importlib.util.module_from_spec(spec)
|
|
spec.loader.exec_module(exchange)
|
|
source = Path(exchange.__file__).read_text()
|
|
self.assertNotIn('/v1/approvals', source)
|
|
self.assertEqual(exchange.CLIENT_ID, 'informed-decision-sitting-requester')
|
|
self.assertEqual(exchange.POLICY, 'workload-kv-read-informed-decision-sitting-requester-client')
|
|
self.assertIn('approval-requester', exchange.SIBLING)
|
|
self.assertTrue(exchange.is_deny(['deny']))
|
|
self.assertTrue(exchange.is_deny([]))
|
|
self.assertFalse(exchange.is_deny(['read']))
|
|
self.assertEqual(exchange.capabilities({'data': {'capabilities': ['read']}}), ['read'])
|
|
|
|
|
|
if __name__ == '__main__':
|
|
unittest.main()
|