c20bf329fd
OpenBao 2.5.4 applies required_parameters to reads, so the executor could not read the version it must name for CAS (net-kingdom NK-WP-0056-T12 synthetic pilot). cas_required on the key still refuses writes without options.cas; metadata, delete, sibling and new paths stay denied (tested). Renderer, test and policy file corrected. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 994874@bnt-lap001 Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87
63 lines
3 KiB
Python
63 lines
3 KiB
Python
"""workload-kv-write-next-version contract (NetKingdom NK-WP-0056 bounded executor); no values."""
|
|
import copy
|
|
import importlib.util
|
|
from pathlib import Path
|
|
|
|
import yaml
|
|
|
|
ROOT = Path(__file__).resolve().parents[1]
|
|
spec = importlib.util.spec_from_file_location("wkw", ROOT / "scripts/workload_kv_write_next_version.py")
|
|
m = importlib.util.module_from_spec(spec)
|
|
spec.loader.exec_module(m)
|
|
CCR = yaml.safe_load((ROOT / "credential-change-requests/CCR-2026-0058-net-kingdom-bind-executor-svc-authelia-write.yaml").read_text())
|
|
|
|
|
|
def test_checked_in_request_is_valid():
|
|
assert m.validate_contract(CCR) == []
|
|
|
|
|
|
def test_policy_artifact_matches_contract():
|
|
path = ROOT / CCR["openbao"]["policy_file"]
|
|
assert path.read_text() == m.policy_hcl(CCR)
|
|
hcl = m.policy_hcl(CCR)
|
|
assert '"read", "update"' in hcl and "create" not in hcl and "metadata" not in hcl
|
|
# required_parameters would refuse reads too (OpenBao 2.5.4, NK-WP-0056-T12); cas_required on the key
|
|
# refuses writes without options.cas
|
|
assert "required_parameters" not in hcl
|
|
assert '"options" = []' in hcl and '"data" = []' in hcl
|
|
|
|
|
|
def test_write_shape_cannot_be_widened():
|
|
for change in ({"cas_required": False}, {"create": True}, {"metadata_read": True}, {"delete": True},
|
|
{"mode": "any"}):
|
|
ccr = copy.deepcopy(CCR); ccr["openbao"]["write"].update(change)
|
|
assert m.validate_contract(ccr), change
|
|
ccr = copy.deepcopy(CCR); ccr["openbao"]["kv_path"] = "platform/workloads/net-kingdom/*"
|
|
assert m.validate_contract(ccr)
|
|
ccr = copy.deepcopy(CCR); ccr["openbao"]["metadata_paths"] = ["x"]
|
|
assert m.validate_contract(ccr)
|
|
|
|
|
|
def test_auth_is_one_serviceaccount_one_policy_15m():
|
|
for key, value in (("ttl", "1h"), ("token_no_default_policy", False), ("audience", "x")):
|
|
ccr = copy.deepcopy(CCR); ccr["openbao"]["auth"][key] = value
|
|
assert m.validate_contract(ccr), key
|
|
ccr = copy.deepcopy(CCR); ccr["openbao"]["auth"]["policies"].append("other")
|
|
assert "openbao.auth.policies must contain exactly openbao.policy_name" in m.validate_contract(ccr)
|
|
ccr = copy.deepcopy(CCR); ccr["openbao"]["auth"]["bound_claims"]["service_account_names"].append("x")
|
|
assert m.validate_contract(ccr)
|
|
|
|
|
|
def test_fence_frontdoor_and_admission_required():
|
|
ccr = copy.deepcopy(CCR); ccr["agent_fence"]["data_and_metadata_denied"] = False
|
|
assert "coding agents must be fenced from the data and metadata paths" in m.validate_contract(ccr)
|
|
ccr = copy.deepcopy(CCR); ccr["access_frontdoor"]["resolvable"] = True
|
|
assert "runtime credential frontdoor must remain disabled" in m.validate_contract(ccr)
|
|
ccr = copy.deepcopy(CCR); del ccr["admission"]
|
|
assert m.validate_contract(ccr)
|
|
|
|
|
|
def test_approved_stage_needs_every_required_approval():
|
|
ccr = copy.deepcopy(CCR); ccr["status"] = "approved"
|
|
ccr["review"]["comments"] = [{"reviewer": "platform-owner", "decision": "approved"}]
|
|
assert m.validate_contract(ccr) == ["explicit role approval missing: net-kingdom-owner"]
|