coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Harden secret provisioning and lifecycle controls
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0217e-8c4c-7383-be6b-f50a6e485306
This commit is contained in:
tegwick 2026-08-23 12:05:58 +02:00
parent 0617923ff1
commit 3a1bd4f1c8
23 changed files with 1369 additions and 162 deletions
Download patch file Download diff file Expand all files Collapse all files

31
tests/test_integration_bao.py
View file

@ -17,6 +17,7 @@ import pytest
from secrets_engine.apply import apply_plan
from secrets_engine.catalog import get_entry
from secrets_engine.config import repo_root
from secrets_engine.errors import BackendError
from secrets_engine.exec_delivery import exec_with_secret
from secrets_engine.openbao import OpenBaoClient
from secrets_engine.plan import build_plan
@ -75,6 +76,18 @@ def test_full_chain(bao_dev, tmp_path):
os.chmod(tokenfile, 0o600)
provision_from_file(client, entry, "npm_token", tokenfile)
# Server-side patch preserves an unmentioned sibling. Provisioning the
# declared field again must not replace that sibling.
client.kv_patch_fields(
entry.mount, entry.path, {"integration_sibling": "still-present"}
)
tokenfile.write_text("npm_integrationTESTvalue0987654321")
os.chmod(tokenfile, 0o600)
provision_from_file(client, entry, "npm_token", tokenfile)
assert client.kv_field_present(
entry.mount, entry.path, "integration_sibling", token=client.token
)
pos = verify_positive(client, entry, "npm_token")
assert pos.passed, pos.detail
neg = verify_negative(client, entry)
@ -93,6 +106,24 @@ def test_full_chain(bao_dev, tmp_path):
assert "SE_NPM_TOKEN" not in os.environ
def test_merge_safe_patch_rejects_stale_cas(bao_dev):
client = bao_dev
mount = "cas-test"
path = "build/example"
client.ensure_kv_mount(mount)
client.kv_patch_fields(mount, path, {"first": "one", "second": "two"})
stale = client.kv_current_version(mount, path)
client.kv_patch_fields(mount, path, {"first": "new"}, expected_version=stale)
with pytest.raises(BackendError):
client.kv_patch_fields(
mount, path, {"second": "stale-write"}, expected_version=stale
)
assert client.kv_field_present(mount, path, "first", token=client.token)
assert client.kv_field_present(mount, path, "second", token=client.token)
def test_idempotent_apply(bao_dev):
client = bao_dev
entry = get_entry(repo_root() / "catalog", "whynot-design-npm-publish")