coulomb/secrets-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(auth): authenticate producer-signed decisions before authorization
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786
This commit is contained in:
tegwick 2026-10-16 07:51:44 +02:00
parent 6bd7129eac
commit c80a944105
30 changed files with 2059 additions and 32 deletions
Download patch file Download diff file Expand all files Collapse all files

22
tests/test_consume_binding_join.py
View file

@ -24,7 +24,19 @@ from secrets_engine.catalog import validate_entry
from secrets_engine.errors import DecisionError
from tests.test_catalog import VALID
AUTH_ID = "8bfc20be-47a4-4fb0-97a2-bf0a920afad8"
from tests.signature_support import signature_tools, admit_tools, sign_envelope
@pytest.fixture(autouse=True)
def admitted_native_signer(monkeypatch, tmp_path, signature_tools):
original = _Cfg.__init__
def configured(self, *a, **kw):
original(self,*a,**kw)
admit_tools(self,tmp_path,signature_tools)
monkeypatch.setattr(_Cfg,'__init__',configured)
original_decision=AuthorizationStub.decision
monkeypatch.setattr(AuthorizationStub,'decision',lambda self,request:sign_envelope(original_decision(self,request),signature_tools))
APPROVAL_ID = "8bfc20be-47a4-4fb0-97a2-bf0a920afad8"
class _Cfg:
@ -45,7 +57,7 @@ class _Cfg:
def _entry():
raw = copy.deepcopy(VALID)
raw["approval"] = dict(raw.get("approval") or {})
raw["approval"]["authorization_id"] = AUTH_ID
raw["approval"]["authorization_id"] = APPROVAL_ID
raw["approval"]["purpose"] = "contract-test"
return validate_entry(raw)
@ -76,7 +88,7 @@ def _served(entry=None, action="deactivate", fields=("api_token",), **over):
"schema_version": "0.1",
"kind": "approval-claim",
"issuer": "approval-engine",
"approval_id": AUTH_ID,
"approval_id": APPROVAL_ID,
"state": "valid",
"valid_now": True,
"consumed": False,
@ -116,7 +128,7 @@ def _opener(envelope, status=200):
def _resolve(cfg, entry, envelope, action="deactivate"):
pdp = AuthorizationStub(approval_id=AUTH_ID, package=cfg.authorization_policy_package, version=cfg.authorization_policy_version)
pdp = AuthorizationStub(approval_id=APPROVAL_ID, package=cfg.authorization_policy_package, version=cfg.authorization_policy_version)
def check(request, timeout=None):
submitted = json.loads(request.data)
return _opener(pdp.decision(submitted))(request)
@ -136,7 +148,7 @@ def test_valid_authorization_yields_binding_with_canonical_digest(tmp_path):
cfg = _Cfg(_token(tmp_path))
binding = _resolve(cfg, entry, _served())
assert binding is not None
assert binding.binding.approval_id == AUTH_ID
assert binding.binding.approval_id == APPROVAL_ID
assert binding.binding.request_digest != request_digest(_expected_request(entry))