tegwick
2278cefbb3
Add secrets-engine secret-use snapshot: catalog plus local evidence only, contracted non-secret fields, declared 1d heartbeat cadence. Never contacts OpenBao. Completeness is not claimed. owner_status stays proposed until kings-guard admits the snapshot as an observation input. Assistant: grok Assistant-Session: 01a05f07-ae72-7781-9fcb-19efd61add00
97 lines
3.3 KiB
Python
97 lines
3.3 KiB
Python
import copy
|
|
import json
|
|
from datetime import datetime, timezone
|
|
from pathlib import Path
|
|
|
|
import yaml
|
|
|
|
from secrets_engine.catalog import validate_entry
|
|
from secrets_engine.secret_use import LANE_FIELDS, snapshot, snapshot_lane
|
|
from tests.test_catalog import VALID
|
|
|
|
NOW = datetime(2026, 9, 2, 12, 0, tzinfo=timezone.utc)
|
|
|
|
|
|
def _write_catalog(tmp_path: Path, data=None):
|
|
entry = copy.deepcopy(data or VALID)
|
|
path = tmp_path / "catalog"
|
|
path.mkdir()
|
|
(path / f"{entry['id']}.yaml").write_text(
|
|
yaml.safe_dump(entry), encoding="utf-8"
|
|
)
|
|
return path
|
|
|
|
|
|
def test_snapshot_omits_unknown_ready_and_never_claims_completeness(tmp_path):
|
|
catalog = _write_catalog(tmp_path)
|
|
payload = snapshot(catalog, tmp_path / "evidence", now=NOW)
|
|
assert payload["completeness_claimed"] is False
|
|
assert payload["cadence"]["form"] == "heartbeat"
|
|
assert payload["cadence"]["interval"] == "1d"
|
|
assert payload["surface"] == "secret-use-evidence"
|
|
assert len(payload["lanes"]) == 1
|
|
lane = payload["lanes"][0]
|
|
assert lane["catalog_id"] == "test-lane"
|
|
assert "ready" not in lane
|
|
assert set(lane) <= set(LANE_FIELDS)
|
|
|
|
|
|
def test_snapshot_reads_last_verify_and_session_without_secrets(tmp_path):
|
|
catalog = _write_catalog(tmp_path)
|
|
evidence = tmp_path / "evidence"
|
|
evidence.mkdir()
|
|
records = [
|
|
{
|
|
"catalog_id": "test-lane",
|
|
"action": "verify",
|
|
"result": "pass",
|
|
"decision_id": "dec-1",
|
|
"evidence_kind": "attributive",
|
|
"detail": {
|
|
"session": {
|
|
"session_handle": "abc123def456",
|
|
"revocation_attempted": True,
|
|
"revocation_succeeded": True,
|
|
},
|
|
"secret": "npm_SHOULDNEVERAPPEAR",
|
|
},
|
|
},
|
|
{
|
|
"catalog_id": "test-lane",
|
|
"action": "revoke",
|
|
"result": "native-access-deactivated",
|
|
"detail": {"stance_stage": "test", "stance_failure_mode": "fail_open"},
|
|
},
|
|
]
|
|
(evidence / "evidence-2026-09-02.jsonl").write_text(
|
|
"".join(json.dumps(row) + "\n" for row in records), encoding="utf-8"
|
|
)
|
|
lane = snapshot_lane(
|
|
validate_entry(copy.deepcopy(VALID)), evidence, now=NOW
|
|
)
|
|
assert lane["ready"] is True
|
|
assert lane["session_handle"] == "abc123def456"
|
|
assert lane["revocation_attempted"] is True
|
|
assert lane["revocation_succeeded"] is True
|
|
assert lane["lifecycle_operation"] == "revoke"
|
|
assert lane["decision_id"] == "dec-1"
|
|
assert lane["stance_stage"] == "test"
|
|
dumped = json.dumps(lane)
|
|
assert "npm_SHOULDNEVERAPPEAR" not in dumped
|
|
assert "secret" not in lane
|
|
assert set(lane) <= set(LANE_FIELDS)
|
|
|
|
|
|
def test_snapshot_does_not_contact_openbao(tmp_path, monkeypatch):
|
|
from secrets_engine import secret_use
|
|
|
|
monkeypatch.setattr(
|
|
secret_use,
|
|
"load_catalog",
|
|
lambda *_args, **_kwargs: {"test-lane": validate_entry(copy.deepcopy(VALID))},
|
|
)
|
|
# If OpenBao were imported/called, this would be the failure mode to catch
|
|
# in handlers. The snapshot function has no OpenBao client parameter.
|
|
payload = snapshot(tmp_path, tmp_path, now=NOW)
|
|
assert payload["lanes"][0]["mount"] == "secret"
|
|
assert payload["completeness_claimed"] is False
|