tegwick
c59bbf568c
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a1468b-63fa-7710-85dc-8f2e16b3ebfa
31 lines
2 KiB
Python
31 lines
2 KiB
Python
import hashlib
|
|
import importlib.util
|
|
import json
|
|
from pathlib import Path
|
|
import pytest
|
|
|
|
spec=importlib.util.spec_from_file_location('check',Path(__file__).parents[1]/'tools/check-keycape-recovery-selector.py');m=importlib.util.module_from_spec(spec);spec.loader.exec_module(m)
|
|
SOURCE=b'CLIENT_ID="secrets-engine-openbao"\nSUBJECT="service:secrets-engine"\nTENANT="tenant:platform"\nROLE="secrets-engine"\nSCOPE="openbao:login"\nraise RuntimeError("source is parsed, never executed")\n'
|
|
SELECTOR={'client_id':'secrets-engine-openbao','secret_env':'KEYCAPE_SECRETS_ENGINE_OPENBAO_CLIENT_SECRET','audience':'secrets-engine-openbao','scope':'openbao:login','subject':'service:secrets-engine','tenant':'tenant:platform','roles':'secrets-engine','deny_scope':'openbao:admin'}
|
|
DIGEST='sha256:'+hashlib.sha256(SOURCE).hexdigest()
|
|
def test_source_parsed_not_executed():
|
|
result=m.verify(SELECTOR,SOURCE,DIGEST)
|
|
assert result['network_contacted'] is False
|
|
@pytest.mark.parametrize('field',list(SELECTOR))
|
|
def test_each_selector_binding_is_exact(field):
|
|
bad={**SELECTOR,field:'different'}
|
|
with pytest.raises(ValueError):m.verify(bad,SOURCE,DIGEST)
|
|
def test_source_drift_and_untyped_digest_refused():
|
|
for source,digest in ((SOURCE+b'\n',DIGEST),(SOURCE,DIGEST.removeprefix('sha256:'))):
|
|
with pytest.raises(ValueError):m.verify(SELECTOR,source,digest)
|
|
def test_duplicate_constants_refused():
|
|
source=SOURCE+b'CLIENT_ID="other"\n'
|
|
with pytest.raises(ValueError):m.verify(SELECTOR,source,'sha256:'+hashlib.sha256(source).hexdigest())
|
|
def test_duplicate_public_metadata_keys_refused():
|
|
with pytest.raises(ValueError):json.loads('{"consumer":{},"consumer":{}}',object_pairs_hook=m.unique)
|
|
def test_oversize_public_input_refused(tmp_path):
|
|
p=tmp_path/'selector.json';p.write_bytes(b'x'*(m.LIMIT+1))
|
|
with pytest.raises(ValueError):m.read(p)
|
|
def test_symlink_public_input_refused(tmp_path):
|
|
p=tmp_path/'selector.json';p.write_text('{}');link=tmp_path/'link';link.symlink_to(p)
|
|
with pytest.raises(ValueError):m.read(link)
|