coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: prepare data-only Anthropic native delivery lane

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0726e-5232-73f2-aaca-2c05ceb62efb
This commit is contained in:
tegwick 2026-09-06 00:25:37 +02:00
parent ebdff586fe
commit 6a0daae437
7 changed files with 202 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

17
tests/test_guards.py
View file

@ -114,3 +114,20 @@ def test_every_admitted_lane_renders_existing_mount_check_and_exact_policy():
assert f'path "{entry.kv_data_path}"' in plan.policy_hcl
assert "*" not in entry.kv_data_path
assert plan.role_name.startswith("se-prod-")
def test_metadata_read_can_be_excluded_without_changing_default():
from secrets_engine.roles import lane_policy_paths
default = _entry(stage="test", path="test/team/thing")
assert "secret/metadata/test/team/thing" in lane_policy_paths(default)
narrow = _entry(stage="test", path="test/team/thing", delivery_auth={
"method":"approle", "management":"engine", "metadata_read":False})
assert lane_policy_paths(narrow) == {"secret/data/test/team/thing":["read"]}
assert "metadata/" not in build_plan(narrow, "test").policy_hcl
@pytest.mark.parametrize("invalid", ["false", None, 0, [], {}])
def test_metadata_read_setting_requires_boolean(invalid):
from secrets_engine.errors import CatalogError
with pytest.raises(CatalogError, match="metadata_read must be boolean"):
_entry(delivery_auth={"metadata_read":invalid})