coulomb/secrets-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

test(human-control): admit the serving path so the claim refusal is what is tested
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Since ebd8e49 the responder-trust preflight refuses before the claim is read,
so this test passed its fail-closed intent only by accident of an earlier
refusal and then failed its regex. Configure an admitted PDP path so the
undeclared human_control claim is the refusal again.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 17890@bnt-lap001
Assistant-Session: 7d96d43c-0154-4a22-af71-71c349ac6dc3
This commit is contained in:
tegwick 2026-10-21 08:48:55 +02:00
parent 551dd76dc3
commit 0d4f4b5cc2
1 changed files with 9 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

13
tests/test_human_control.py
View file

@ -20,6 +20,7 @@ from tests.test_consume_binding_join import (
APPROVAL_ID, _Cfg, _entry, _opener, _resolve, _served, _token,
)
from tests.test_exec_owner import bound
from tests.signature_support import admit_tools, signature_tools # noqa: F401 (fixture)
from tests.test_privileged_cli_evidence import _config, _records
@ -142,15 +143,19 @@ def test_human_declaration_is_rechecked_after_pdp(tmp_path, monkeypatch):
policy_targets=(entry.policy_name,), auth_targets=(entry.role_name,), pdp_opener=check)
def test_real_exec_handler_rejects_undeclared_claim_before_consume_backend_child(bound, tmp_path, monkeypatch):
def test_real_exec_handler_rejects_undeclared_claim_before_consume_backend_child(bound, tmp_path, monkeypatch, signature_tools):
raw, _, _ = bound
raw["stage"] = "prod"
raw["approval"].update(model="decision", authorization_id=APPROVAL_ID,
purpose="contract-test", human_control=True)
entry = validate_entry(raw)
cfg = replace(_config(tmp_path), approval_url="https://approval.example",
approval_token_file=_token(tmp_path), authorization_subject_id="user:alice",
authorization_subject_type="Human")
token = _token(tmp_path)
# A fully admitted serving path, so the refusal comes from the claim, not the trust preflight.
cfg = admit_tools(replace(_config(tmp_path), approval_url="https://approval.example",
approval_token_file=token, authorization_subject_id="user:alice",
authorization_subject_type="Human", pdp_url="http://127.0.0.1:1234",
pdp_token_file=token, authorization_policy_package="secrets-engine.lifecycle",
authorization_policy_version="v1"), tmp_path, signature_tools)
claim = _served(entry, action="exec")
monkeypatch.setattr(cli, "get_entry", lambda *a: entry)
monkeypatch.setattr(cli, "authorize_action", lambda *a, **k: authorize_action(*a, **k,