coulomb/secrets-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(auth): authenticate producer-signed decisions before authorization
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786
This commit is contained in:
tegwick 2026-10-16 07:51:44 +02:00
parent 6bd7129eac
commit c80a944105
30 changed files with 2059 additions and 32 deletions
Download patch file Download diff file Expand all files Collapse all files

14
tests/test_decision_transport.py
View file

@ -67,7 +67,7 @@ def test_redirect_never_contacts_another_origin(credential, status):
with server() as (destination, received):
with server(status=status, location=destination + '/sink') as (source, sent):
with pytest.raises(DecisionError):
check_decision(base_url=source, token_file=credential, request={})
check_decision(allow_unsigned_test_fixture=True, base_url=source, token_file=credential, request={})
assert sent == [True]
assert received == []
@ -77,18 +77,22 @@ def test_environment_proxy_never_receives_request(credential, monkeypatch):
with server() as (source, direct):
monkeypatch.setenv('http_proxy', proxy)
monkeypatch.setenv('no_proxy', '')
assert check_decision(base_url=source, token_file=credential, request={}) == {}
assert check_decision(allow_unsigned_test_fixture=True, base_url=source, token_file=credential, request={}) == {}
assert direct == [True]
assert proxied == []
def test_approval_flow_uses_the_same_safe_transport(credential, monkeypatch):
from tests.signature_support import signature_tools, admit_tools
def test_approval_flow_uses_the_same_safe_transport(credential, monkeypatch, signature_tools):
observation = SimpleNamespace(request={})
monkeypatch.setattr(approval_consume, 'resolve_approval_observation', lambda *a, **kw: observation)
with server() as (destination, received):
with server(status=302, location=destination + '/sink') as (source, sent):
cfg = SimpleNamespace(pdp_url=source, pdp_token_file=credential,
authorization_policy_package='test', authorization_policy_version='v1')
admit_tools(cfg, credential.parent, signature_tools)
with pytest.raises(DecisionError):
approval_consume.authorize_action(cfg, object(), 'rotate', None)
assert sent == [True]
@ -105,7 +109,7 @@ def test_approval_flow_uses_the_same_safe_transport(credential, monkeypatch):
])
def test_invalid_address_refused_before_credential_read(url, tmp_path):
with pytest.raises(DecisionError, match='URL'):
check_decision(base_url=url, token_file=tmp_path / 'missing', request={})
check_decision(allow_unsigned_test_fixture=True, base_url=url, token_file=tmp_path / 'missing', request={})
@pytest.mark.parametrize('body,reason', [
@ -115,4 +119,4 @@ def test_invalid_address_refused_before_credential_read(url, tmp_path):
def test_response_limits_and_encoding_fail_closed(credential, body, reason):
with server(body=body) as (source, _):
with pytest.raises(DecisionError, match=reason):
check_decision(base_url=source, token_file=credential, request={})
check_decision(allow_unsigned_test_fixture=True, base_url=source, token_file=credential, request={})