Refuse login-only protected execution before consuming approval

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade

tests/test_execution_readiness.py

@@ -0,0 +1,71 @@
+from types import SimpleNamespace
+
+import pytest
+
+from secrets_engine import cli
+from secrets_engine.engine_auth import require_backend_execution_ready
+from secrets_engine.errors import BackendError
+
+
+def cfg(contract=None):
+    return SimpleNamespace(openbao_jwt_login_file=contract)
+
+
+@pytest.mark.parametrize('provider,contract', [('service-jwt', None), ('auto', '/non-secret/login.yaml')])
+def test_login_only_refused_before_claim_consume_or_backend(provider, contract, monkeypatch):
+    events = []
+    for name in ['authorize_action', 'require_production_consume', 'login_service_jwt']:
+        monkeypatch.setattr(cli, name, lambda *a, _name=name, **k: events.append(_name))
+    monkeypatch.setattr(cli.OpenBaoClient, 'resolve', lambda *a, **k: events.append('backend'))
+    args = SimpleNamespace(auth=provider, bootstrap_token_file=None)
+    with pytest.raises(BackendError, match='Approval was not consumed'):
+        cli._require_lane_approval(cfg(contract), SimpleNamespace(stage='prod'), 'apply', auth_args=args)
+    assert events == []
+
+
+@pytest.mark.parametrize('provider,bootstrap', [('env', None), ('bootstrap', '/private/explicit-token')])
+def test_named_legacy_provider_retained(provider, bootstrap):
+    args = SimpleNamespace(auth=provider, bootstrap_token_file=bootstrap)
+    result = require_backend_execution_ready(cfg('/published/login.yaml'), args, 'apply')
+    assert result.provider == provider
+    assert result.break_glass is (provider == 'bootstrap')
+
+
+def test_auto_with_contract_and_bootstrap_never_falls_back():
+    with pytest.raises(BackendError, match='no fallback'):
+        require_backend_execution_ready(cfg('/published/login.yaml'),
+            SimpleNamespace(auth='auto', bootstrap_token_file='/private/file'), 'apply')
+
+
+def test_readiness_cannot_be_self_asserted():
+    c = cfg('/published/login.yaml')
+    c.execution_entitlement_file = '/pretend/approved.json'
+    c.service_jwt_execution_ready = True
+    with pytest.raises(BackendError, match='no reviewed task-scoped'):
+        require_backend_execution_ready(c, SimpleNamespace(auth='auto', bootstrap_token_file=None), 'apply')
+
+
+def test_self_probe_auth_selection_remains_service_jwt():
+    from secrets_engine.engine_auth import select_engine_auth
+    assert select_engine_auth(cfg('/published/login.yaml'),
+        SimpleNamespace(auth='auto', bootstrap_token_file=None)).provider == 'service-jwt'
+
+
+def test_real_apply_handler_refuses_before_consumption(tmp_path, monkeypatch):
+    import copy
+    from secrets_engine.catalog import validate_entry
+    from secrets_engine.config import Config
+    from tests.test_catalog import VALID
+    entry = validate_entry(copy.deepcopy(VALID))
+    configuration = Config(catalog_dir=tmp_path, policy_dir=tmp_path,
+        evidence_dir=tmp_path / 'evidence', hub_url='', bao_addr='http://127.0.0.1:8200',
+        topic_id='fixture', openbao_jwt_login_file=tmp_path / 'login-contract.yaml')
+    monkeypatch.setattr(cli, '_resolve_lane_and_decision', lambda *a: entry)
+    calls = []
+    for name in ['authorize_action', 'require_production_consume', 'login_service_jwt', 'apply_plan']:
+        monkeypatch.setattr(cli, name, lambda *a, _name=name, **k: calls.append(_name))
+    args = SimpleNamespace(ref=entry.id, stage=entry.stage, dry_run=False,
+        auth='auto', bootstrap_token_file=None)
+    with pytest.raises(BackendError, match='Approval was not consumed'):
+        cli.cmd_apply(configuration, args)
+    assert calls == []