tegwick
0db6adef69
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
24 lines
1.2 KiB
Python
24 lines
1.2 KiB
Python
"""Real wrapping semantics in a disposable local OpenBao, not estate authority."""
|
|
import json
|
|
import re
|
|
|
|
from secrets_engine.openbao import OpenBaoClient
|
|
from tests.test_integration_bao import bao_dev, pytestmark # noqa: F401
|
|
|
|
|
|
def test_native_wrap_path_ttl_and_one_time_unwrap(bao_dev):
|
|
written=bao_dev._run(['kv','put','-format=json','secret/d3-wrap-fixture',
|
|
'marker=synthetic-wrapped-integration-value'])
|
|
assert written.returncode==0
|
|
wrapped=bao_dev.wrap_kv_get('secret','d3-wrap-fixture',ttl='60s')
|
|
assert wrapped.creation_path=='secret/data/d3-wrap-fixture'
|
|
assert wrapped.ttl=='60'
|
|
assert wrapped.wrap_token not in repr(wrapped) and wrapped.wrap_token not in json.dumps(wrapped.evidence())
|
|
recipient=OpenBaoClient(addr=bao_dev.addr,token=wrapped.wrap_token,bao_bin=bao_dev.bao_bin)
|
|
first=recipient._run(['unwrap','-format=json'])
|
|
assert first.returncode==0
|
|
assert json.loads(first.stdout)['data']['data']['marker']=='synthetic-wrapped-integration-value'
|
|
replay=recipient._run(['unwrap','-format=json'])
|
|
assert replay.returncode==2 and not replay.stdout.strip()
|
|
assert re.search(r'Code:\s*400\b',replay.stderr)
|
|
assert '* wrapping token is not valid or does not exist' in replay.stderr
|