a3e8eb64ba
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786
49 lines
2.9 KiB
Python
49 lines
2.9 KiB
Python
"""Real CCR schema/applier contract, no credentials or backend invocation."""
|
|
from copy import deepcopy
|
|
import importlib.util
|
|
import json
|
|
from pathlib import Path
|
|
import yaml
|
|
ROOT=Path(__file__).resolve().parents[1]
|
|
spec=importlib.util.spec_from_file_location('signer_ccr',ROOT/'scripts/credential-change.py')
|
|
ccr_module=importlib.util.module_from_spec(spec);spec.loader.exec_module(ccr_module)
|
|
CCR=ROOT/'credential-change-requests/CCR-2026-0050-flex-auth-envelope-signing.yaml'
|
|
|
|
|
|
def test_real_schema_and_apply_refusal():
|
|
ccr,errors,warnings=ccr_module.validate_ccr(CCR)
|
|
assert errors==[]
|
|
assert warnings==['OIDC/Kubernetes bound claim is not confirmed; apply is blocked']
|
|
blockers=ccr_module.applier_readiness_blockers(ccr)
|
|
assert len(blockers)==2
|
|
assert any('status, got proposed' in x for x in blockers)
|
|
assert any('confirmed OpenBao auth binding' in x for x in blockers)
|
|
assert ccr['review']['comments']==[] and ccr['access_frontdoor']['resolvable'] is False
|
|
# Pure synthetic candidate only: ensure admitted-pattern scope has no latent
|
|
# schema/applier role/field failures once the real owners eventually approve.
|
|
admitted=deepcopy(ccr);admitted['status']='approved';admitted['openbao']['auth']['bound_claims_confirmed']=True
|
|
assert ccr_module.applier_readiness_blockers(admitted)==[]
|
|
|
|
|
|
def test_generated_read_scope_and_projection_join():
|
|
ccr,_,_=ccr_module.validate_ccr(CCR)
|
|
assert (ROOT/ccr['openbao']['policy_file']).read_text()==ccr_module.generated_policy_hcl(ccr)
|
|
hcl=ccr_module.generated_policy_hcl(ccr)
|
|
assert 'metadata/' not in hcl and 'list' not in hcl and 'create' not in hcl
|
|
assert ccr['openbao']['fields']==['ED25519_PRIVATE_KEY']
|
|
docs=list(yaml.safe_load_all((ROOT/'docs/credential-lane-designs/flex-auth-envelope-signing-native-projection.yaml.proposed').read_text()))
|
|
store=next(x for x in docs if x['kind']=='SecretStore')
|
|
assert store['spec']['provider']['vault']['auth']['kubernetes']['role']==ccr['openbao']['auth']['role']
|
|
external=next(x for x in docs if x['kind']=='ExternalSecret')
|
|
assert external['spec']['data']==[{'secretKey':'seed','remoteRef':{'key':'workloads/flex-auth/envelope-signing','property':'ED25519_PRIVATE_KEY'}}]
|
|
|
|
|
|
def test_native_scope_separates_read_grant_and_unadmitted_execution():
|
|
plan=json.loads((ROOT/'docs/credential-lane-designs/flex-auth-envelope-signing-native-plan.json').read_text())
|
|
assert plan['authority_granted'] is False and plan['status']=='prepared-unapproved'
|
|
assert plan['bootstrap']['expected_version']==0
|
|
assert all(x['disposition'].startswith('pending ') for x in plan['reviews_required'])
|
|
assert 'implementation/independent tests still required' in plan['protected_adapter']['state']
|
|
assert plan['receipts']['maximum_bytes']==65536
|
|
assert all('platform/' in x['path'] for x in plan['bootstrap']['allowed_native_methods'])
|
|
assert 'zero flex-auth PVCs' in plan['requested_scope']['new_resources']
|