tegwick
5b48033bce
Token scope is now bound to package maturity, gated on netkingdom's own maturity: - maturity-build -> gitea-wide, maturity-test -> org-wide, maturity-prod -> repo-scoped (scope narrows as stakes rise; broad tokens only for low-stakes build artifacts) - the graduated table is DORMANT until netkingdom reaches production grade; until then every lane clamps to repo-scope, injected as NPM_AUTH_TOKEN (fail-safe) - token env-var name signals blast radius: NPM_AUTH_TOKEN (repo default), NPM_AUTH_COULOMB_TOKEN (org), NPM_AUTH_GITEA_TOKEN (gitea), NPM_AUTH_WHYNOT_TOKEN (npm scope, defined but unused), NPM_AUTH_WHYNOTDESIGN (explicit repo) netkingdom is at maturity-build today, so whynot-design resolves to repo-scope / NPM_AUTH_TOKEN. Flip netkingdom_maturity to maturity-prod to activate graduation. - policies/netkingdom-publication-scope.yaml: the policy data + gate - publication_policy.py: load + resolve (clamp/active, env naming, override) - exec delivery injects under the resolved env-var name (was fixed SE_NPM_TOKEN) - catalog lane carries delivery_config.npm.maturity - new CLI: `secrets-engine policy publication <lane>` - docs/publication-scope-policy.md; tests for clamp, graduation, naming, override Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
54 lines
2.1 KiB
Python
54 lines
2.1 KiB
Python
from dataclasses import replace
|
|
|
|
import pytest
|
|
|
|
from secrets_engine.config import repo_root
|
|
from secrets_engine.errors import PolicyGuardError
|
|
from secrets_engine.publication_policy import PublicationPolicy, resolve
|
|
|
|
|
|
def _policy():
|
|
return PublicationPolicy.load(repo_root() / "policies")
|
|
|
|
|
|
def test_netkingdom_is_build_and_dormant():
|
|
p = _policy()
|
|
assert p.netkingdom_maturity == "maturity-build"
|
|
assert p.production_grade is False
|
|
|
|
|
|
def test_dormant_clamps_to_repo_and_default_token_env():
|
|
p = _policy()
|
|
r = resolve(p, org="coulomb", repo="whynot-design", npm_scope="@whynot",
|
|
package_maturity="maturity-build")
|
|
assert r.effective_scope == "repo"
|
|
assert r.token_env == "NPM_AUTH_TOKEN"
|
|
assert r.clamped is True # build->gitea would be broader; clamped down
|
|
assert r.active is False
|
|
|
|
|
|
def test_active_graduated_scoping_when_production_grade():
|
|
p = replace(_policy(), netkingdom_maturity="maturity-prod")
|
|
build = resolve(p, org="coulomb", repo="whynot-design", npm_scope="@whynot",
|
|
package_maturity="maturity-build")
|
|
test = resolve(p, org="coulomb", repo="whynot-design", npm_scope="@whynot",
|
|
package_maturity="maturity-test")
|
|
prod = resolve(p, org="coulomb", repo="whynot-design", npm_scope="@whynot",
|
|
package_maturity="maturity-prod")
|
|
assert (build.effective_scope, build.token_env) == ("gitea", "NPM_AUTH_GITEA_TOKEN")
|
|
assert (test.effective_scope, test.token_env) == ("org", "NPM_AUTH_COULOMB_TOKEN")
|
|
assert (prod.effective_scope, prod.token_env) == ("repo", "NPM_AUTH_TOKEN")
|
|
assert build.active is True and build.clamped is False
|
|
|
|
|
|
def test_token_env_override_wins():
|
|
p = _policy()
|
|
r = resolve(p, org="coulomb", repo="whynot-design", npm_scope="@whynot",
|
|
package_maturity="maturity-build", token_env_override="NPM_AUTH_WHYNOTDESIGN")
|
|
assert r.token_env == "NPM_AUTH_WHYNOTDESIGN"
|
|
|
|
|
|
def test_invalid_maturity_rejected():
|
|
p = _policy()
|
|
with pytest.raises(PolicyGuardError):
|
|
resolve(p, org="coulomb", repo="x", npm_scope="@y", package_maturity="maturity-ga")
|