tegwick
ee4e901611
Assistant: codex Assistant-Model: gpt-5.6-luna Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
24 lines
1.3 KiB
Python
24 lines
1.3 KiB
Python
"""Historical live evidence remains immutable and cannot satisfy the new contract."""
|
|
import json
|
|
from datetime import datetime
|
|
from pathlib import Path
|
|
|
|
import pytest
|
|
|
|
from secrets_engine.authorization import build_action_request, validate_decision_envelope
|
|
from secrets_engine.catalog import load_catalog
|
|
from secrets_engine.errors import DecisionError
|
|
|
|
|
|
def test_old_live_pin_without_submitted_binding_refuses_even_during_its_lifetime():
|
|
root = Path(__file__).resolve().parents[1]
|
|
decision = json.loads((root / "tests/fixtures/flex-auth-live/decision_rotate_glas_live.json").read_text())
|
|
entry = load_catalog(root / "catalog")["glas-claude-agent-dev-anthropic"]
|
|
request = build_action_request(entry, "rotate", subject_id="secrets-engine", subject_type="service",
|
|
purpose="live-adoption-proof", fields=["api_key"], request_id="check:secrets-engine-adoption-proof")
|
|
assert decision["effect"] == "allow"
|
|
assert "submitted_request_digest" not in decision["binding"]
|
|
with pytest.raises(DecisionError, match="submitted request digest"):
|
|
validate_decision_envelope(decision, request,
|
|
accepted_policy_packages={"secrets-engine.catalog-lane.lifecycle"}, accepted_policy_versions={"v2"},
|
|
now=datetime.fromisoformat(decision["provenance"]["decision_time"].replace("Z", "+00:00")))
|