coulomb/secrets-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(auth): authenticate producer-signed decisions before authorization
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786
This commit is contained in:
tegwick 2026-10-16 07:51:44 +02:00
parent 6bd7129eac
commit c80a944105
30 changed files with 2059 additions and 32 deletions
Download patch file Download diff file Expand all files Collapse all files

8
tests/test_approval_auth.py
View file

@ -194,8 +194,11 @@ def test_environment_selects_separate_approval_secret(monkeypatch):
assert cfg.keycape_client_secret_file == Path("/protected/openbao.secret")
from tests.signature_support import signature_tools, admit_tools, sign_envelope
@pytest.mark.parametrize("failure", [None, "exchange", "conflict", "wrong-action"])
def test_cli_gate_exchanges_for_claim_and_consume(tmp_path, monkeypatch, failure):
def test_cli_gate_exchanges_for_claim_and_consume(tmp_path, monkeypatch, failure, signature_tools):
raw = copy.deepcopy(VALID)
raw["stage"] = "prod"
raw["approval"] = {"model": "bootstrap-only", "authorization_id": "approval-test", "purpose": "synthetic proof"}
@ -205,6 +208,9 @@ def test_cli_gate_exchanges_for_claim_and_consume(tmp_path, monkeypatch, failure
cfg.authorization_subject_type = "service"
cfg.authorization_policy_package = "secrets-engine.catalog-lane.lifecycle"
cfg.authorization_policy_version = "v2"
admit_tools(cfg,tmp_path,signature_tools)
original_decision=AuthorizationStub.decision
monkeypatch.setattr(AuthorizationStub,"decision",lambda self,request:sign_envelope(original_decision(self,request),signature_tools))
cfg.evidence_dir = tmp_path / "evidence"
cfg.pdp_token_file = tmp_path / "pdp.token"
cfg.pdp_token_file.write_text("synthetic-pdp-token")