coulomb/secrets-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(auth): authenticate producer-signed decisions before authorization
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786
This commit is contained in:
tegwick 2026-10-16 07:51:44 +02:00
parent 6bd7129eac
commit c80a944105
30 changed files with 2059 additions and 32 deletions
Download patch file Download diff file Expand all files Collapse all files

12
tests/test_integration_authorization.py
View file

@ -234,3 +234,15 @@ def test_unconfigured_engine_still_fails_closed(bao_dev, lane, tmp_path):
)
with pytest.raises(DecisionError, match="live production remains disabled"):
cli._require_lane_approval(cfg, entry, "apply")
from tests.signature_support import signature_tools, admit_tools, sign_envelope
@pytest.fixture(autouse=True)
def admitted_native_signer(monkeypatch,signature_tools):
original_cfg=_cfg
def configured(tmp_path,*args,**kwargs):
return admit_tools(original_cfg(tmp_path,*args,**kwargs),tmp_path,signature_tools)
monkeypatch.setattr(__import__(__name__,fromlist=['_cfg']),'_cfg',configured)
original_decision=AuthorizationStub.decision
monkeypatch.setattr(AuthorizationStub,'decision',lambda self,request:sign_envelope(original_decision(self,request),signature_tools))