tegwick
3b355de300
Re-render admitted-lane plans as kv-mount-check plus exact-path AppRole. Name openrouter-llm-connect as the first candidate. Document apply, verify, and rollback without authorizing live mutation. T05 stays wait on T04 serving and attended authority. Assistant: grok Assistant-Session: 01a05f07-ae72-7781-9fcb-19efd61add00
31 lines
1.1 KiB
Python
31 lines
1.1 KiB
Python
from secrets_engine.catalog import load_catalog
|
|
from secrets_engine.config import repo_root
|
|
from secrets_engine.plan import build_plan
|
|
|
|
ADMITTED = (
|
|
"openrouter-llm-connect",
|
|
"email-connect-transactional",
|
|
"issue-core-ingestion-api-key",
|
|
"reuse-surface-hub-write-token",
|
|
"forgejo-admin-api-token",
|
|
)
|
|
FIRST_LANE = "openrouter-llm-connect"
|
|
|
|
|
|
def test_admitted_lanes_plan_existing_mount_and_exact_approle():
|
|
catalog = load_catalog(repo_root() / "catalog")
|
|
assert FIRST_LANE == ADMITTED[0]
|
|
for lane_id in ADMITTED:
|
|
entry = catalog[lane_id]
|
|
assert entry.stage == "prod"
|
|
assert entry.mount == "platform"
|
|
assert entry.mount_management == "existing"
|
|
plan = build_plan(entry, "prod", decision_id=entry.approval.get("decision_ref", ""))
|
|
kinds = [action.kind for action in plan.actions]
|
|
assert kinds[0] == "kv-mount-check"
|
|
assert "kv-mount" not in kinds
|
|
assert "policy" in kinds
|
|
assert "approle" in kinds
|
|
assert "platform/data/" in plan.policy_hcl
|
|
assert '"create"' not in plan.policy_hcl
|
|
assert "capabilities = [\"read\"]" in plan.policy_hcl
|