napseer/nap-cli
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: configure agents with durable user sessions and scoped access

Browse Source
This commit is contained in:
HumbleTurtle
2026-09-10 03:29:48 -03:00
parent e8c6a5109e
commit 6c29a318e8
15 changed files with 1306 additions and 410 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/test_anonymous_auth_recovery.py
+27 -83
View File
@@ -29,37 +29,18 @@ def anonymous_auth(mod):
}
def test_initial_enrollment_persists_refresh_credential():
def test_unconfigured_agent_requires_user_login_without_enrollment():
mod = load_module()
mod.TOKEN = None
mod.AUTH = anonymous_auth(mod)
mod.BASE_URL = mod.AUTH["base_url"]
mod.DEFAULT_PROJECT_ID = None
saved = []
requests = []
mod.save_auth = lambda payload: saved.append(dict(payload))
def request(method, path, payload=None, token_required=False):
requests.append((method, path, payload, token_required))
return {
"token": {
"access_token": "access",
"refresh_token": "refresh",
"expires_at": "2099-01-01T00:00:00Z",
"refresh_expires_at": "",
},
"worker": {"id": "worker", "agent_id": "agent-id"},
}
mod.request_json = request
mod.ensure_enrolled({"slug": "example"})
assert saved[0]["refresh_token"] == "refresh"
assert "refresh_expires_at" in saved[0]
assert [(method, path) for method, path, _, _ in requests] == [
("POST", "/v1/enrollment/token")
]
assert requests[0][3] is False
mod.request_json = lambda *args, **kwargs: requests.append(args)
try:
mod.ensure_enrolled({"slug": "example"})
except mod.SafeToolError as exc:
assert exc.code == "auth_required"
else:
raise AssertionError("unconfigured agents must not enroll")
assert not requests
def test_failed_anonymous_refresh_uses_ssh_recovery():
@@ -107,65 +88,28 @@ def test_failed_anonymous_refresh_uses_ssh_recovery():
assert saved[0]["refresh_token"] == "recovered-refresh"
def test_failed_mixed_state_refresh_uses_ssh_recovery():
def test_oauth_failure_never_falls_back_to_anonymous_identity():
mod = load_module()
mod.AUTH = {
**anonymous_auth(mod),
"account_mode": "operator_project",
"oauth_client_id": "nap-cli",
"project_id": "project",
"ssh_private_key": "test-private-key",
"ssh_public_key": "ssh-ed25519 test-public-key",
}
mod.BASE_URL = mod.AUTH["base_url"]
mod.DEFAULT_PROJECT_ID = "project"
mod.REFRESH_TOKEN = "stale-refresh"
mod.REFRESH_EXPIRES_AT = None
mod.AUTH = {**anonymous_auth(mod), "account_mode": "operator_project"}
mod.TOKEN = "expired-access"
mod.REFRESH_TOKEN = "revoked-refresh"
mod.refresh_public_auth_state = lambda: mod.AUTH
mod.auth_public_key = lambda: "ssh-ed25519 test-public-key"
mod.sign_with_auth_key = lambda *args: "test-signature"
saved = []
mod.save_auth = lambda payload: saved.append(dict(payload))
def request_form(method, path, payload=None, token_required=False):
assert (method, path, token_required) == ("POST", "/v1/oauth/token", False)
raise RuntimeError("HTTP 401")
def request(method, path, payload=None, token_required=False):
if path == "/v1/enrollment/refresh":
raise RuntimeError("HTTP 401")
if path == "/v1/enrollment/challenges":
return {"challenge_id": "challenge", "challenge_text": "sign-me"}
if path == "/v1/enrollment/verify":
return {
"token": {
"access_token": "recovered-access",
"refresh_token": "recovered-refresh",
"expires_at": "2099-01-01T00:00:00Z",
"refresh_expires_at": "2099-12-31T00:00:00Z",
},
"worker": {
"id": "worker",
"agent_id": "agent-id",
"name": "agent",
"device_fingerprint": "device",
"root_path": "/repo",
"project_id": "project",
},
}
raise AssertionError(path)
mod.request_form_json = request_form
mod.request_json = request
result = mod.renew_auth()
assert result["method"] == "anonymous_ssh_recovery"
assert result["project_id"] == "project"
assert saved[0]["refresh_token"] == "recovered-refresh"
calls = []
def rejected(*args, **kwargs):
raise mod.SafeToolError("http_401", "Login rejected", status=401)
mod.request_form_json = rejected
mod.request_json = lambda *args, **kwargs: calls.append(args)
try:
mod.renew_auth()
except mod.SafeToolError as exc:
assert exc.code == "auth_required"
else:
raise AssertionError("OAuth revocation must require user login")
assert not calls
if __name__ == "__main__":
test_initial_enrollment_persists_refresh_credential()
test_unconfigured_agent_requires_user_login_without_enrollment()
test_failed_anonymous_refresh_uses_ssh_recovery()
test_failed_mixed_state_refresh_uses_ssh_recovery()
test_oauth_failure_never_falls_back_to_anonymous_identity()
print("ok: anonymous auth recovery tests passed")