2e2c31d237
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
31 lines
1.7 KiB
Python
31 lines
1.7 KiB
Python
import importlib.util,unittest
|
|
from pathlib import Path
|
|
from unittest.mock import patch
|
|
spec=importlib.util.spec_from_file_location("factor_metadata",Path(__file__).resolve().parents[1]/"scripts/keycape_factor_metadata.py")
|
|
m=importlib.util.module_from_spec(spec);spec.loader.exec_module(m)
|
|
class FactorMetadataTests(unittest.TestCase):
|
|
def test_exact_role_and_policy_scope(self):
|
|
self.assertEqual(["keycape-factor-eso"],m.ROLE_CONFIG["bound_service_account_names"])
|
|
self.assertEqual(["sso"],m.ROLE_CONFIG["bound_service_account_namespaces"])
|
|
self.assertTrue(m.ROLE_CONFIG["token_no_default_policy"])
|
|
self.assertEqual(900,m.ROLE_CONFIG["token_max_ttl"])
|
|
policy=(m.ROOT/"openbao/policies"/(m.POLICY+".hcl")).read_text()
|
|
self.assertNotIn("*",policy);self.assertNotIn("issuer",policy.splitlines()[1:])
|
|
self.assertEqual(3,policy.count('capabilities = ["read"]'))
|
|
def test_denied_capabilities_prevent_writes(self):
|
|
calls=[]
|
|
def fake(*args,**kwargs):
|
|
calls.append(args)
|
|
if args[:2]==("secrets","list"):return {"platform/":{"type":"kv","options":{"version":"2"}}}
|
|
if args[:2]==("auth","list"):return {"kubernetes/":{"type":"kubernetes"}}
|
|
return ["deny"]
|
|
with patch.object(m,"call",side_effect=fake):
|
|
with self.assertRaises(RuntimeError):m.execute(True)
|
|
self.assertFalse(any(c[0]=="write" for c in calls))
|
|
def test_mismatched_role_fails_readback(self):
|
|
self.assertTrue(m.verify_role(dict(m.ROLE_CONFIG)))
|
|
self.assertFalse(m.verify_role(dict(m.ROLE_CONFIG,token_policies=["root"])))
|
|
|
|
def test_policy_readback_accepts_cli_and_api_shapes(self):
|
|
self.assertEqual("expected",m.policy_text({"policy":"expected"}))
|
|
self.assertEqual("expected",m.policy_text({"data":{"policy":"expected"}}))
|