99 lines
2.7 KiB
Python
99 lines
2.7 KiB
Python
#!/usr/bin/env python3
|
|
from __future__ import annotations
|
|
|
|
import ast
|
|
import json
|
|
from pathlib import Path
|
|
|
|
|
|
ROOT = Path(__file__).resolve().parents[1]
|
|
BROKER = ROOT / "active-runtime" / "app" / "owner_authorization_broker.py"
|
|
ADAPTER = (
|
|
ROOT
|
|
/ "active-runtime"
|
|
/ "app"
|
|
/ "aios_owner_authorization_broker_api.py"
|
|
)
|
|
OPENAPI = (
|
|
ROOT
|
|
/ "docs"
|
|
/ "gitops"
|
|
/ "openapi-owner-authorization-broker-fragment.yaml"
|
|
)
|
|
SYSTEMD = (
|
|
ROOT
|
|
/ "deploy"
|
|
/ "systemd"
|
|
/ "aios-gitops-model-api-owner-authorization-broker.conf.example"
|
|
)
|
|
|
|
|
|
def main() -> int:
|
|
failures = []
|
|
for path in (BROKER, ADAPTER):
|
|
try:
|
|
ast.parse(path.read_text(encoding="utf-8"))
|
|
except Exception as exc:
|
|
failures.append(f"{path}: {exc}")
|
|
|
|
broker = BROKER.read_text(encoding="utf-8")
|
|
for marker in [
|
|
"WILDCARD_OWNER_CREDENTIAL_REJECTED",
|
|
"OWNER_CREDENTIAL_SCOPE_NOT_PROVABLE",
|
|
"PRODUCTION_CAPABILITY_REJECTED",
|
|
"PROVISIONING_BLOCKED",
|
|
"owner_authorization_reference",
|
|
"AuthorizedTaskWriterProvisioner",
|
|
]:
|
|
if marker not in broker:
|
|
failures.append(f"broker marker missing: {marker}")
|
|
|
|
for marker in [
|
|
"update-ref",
|
|
"git branch",
|
|
"git push",
|
|
"gitops.tokens",
|
|
"OpenBao",
|
|
]:
|
|
if marker in broker:
|
|
failures.append(f"broker contains forbidden direct mutation: {marker}")
|
|
|
|
adapter = ADAPTER.read_text(encoding="utf-8")
|
|
for marker in [
|
|
"/api/governance/owner-authorizations",
|
|
"AIOS_GITOPS_OWNER_AUTHORIZATION_BROKER_ENABLED",
|
|
"WILDCARD_OWNER_CREDENTIAL_REJECTED",
|
|
]:
|
|
if marker not in adapter:
|
|
failures.append(f"adapter marker missing: {marker}")
|
|
|
|
schema = OPENAPI.read_text(encoding="utf-8")
|
|
for marker in [
|
|
"authorizeAndProvisionTaskWriter",
|
|
"x-openai-isConsequential: true",
|
|
"AUTHORIZE_TASK_WRITER_PROVISIONING",
|
|
"const: false",
|
|
]:
|
|
if marker not in schema:
|
|
failures.append(f"OpenAPI marker missing: {marker}")
|
|
|
|
systemd = SYSTEMD.read_text(encoding="utf-8")
|
|
for marker in [
|
|
"OWNER_AUTHORIZATION_BROKER_ENABLED=true",
|
|
"OWNER_AUTHORIZATION_INTAKE_SCOPES",
|
|
"OWNER_AUTHORIZATION_ALLOWED_IDENTITIES",
|
|
"aios_owner_authorization_broker_api.py",
|
|
]:
|
|
if marker not in systemd:
|
|
failures.append(f"systemd marker missing: {marker}")
|
|
|
|
if failures:
|
|
print(json.dumps({"status": "FAILED", "failures": failures}, indent=2))
|
|
return 1
|
|
print(json.dumps({"status": "PASS", "files": 4}, indent=2))
|
|
return 0
|
|
|
|
|
|
if __name__ == "__main__":
|
|
raise SystemExit(main())
|