76 lines
3.1 KiB
Python
76 lines
3.1 KiB
Python
#!/usr/bin/env python3
|
|
"""Smoke-test gateway-owned project vault setup payload generation."""
|
|
|
|
import base64
|
|
import importlib.util
|
|
import pathlib
|
|
import sys
|
|
|
|
|
|
def load_module():
|
|
script_path = pathlib.Path(__file__).resolve().parents[1] / "resources" / "scripts" / "napseer_mcp_server.py"
|
|
sys.path.insert(0, str(script_path.parent))
|
|
spec = importlib.util.spec_from_file_location("napseer_mcp_server", script_path)
|
|
module = importlib.util.module_from_spec(spec)
|
|
assert spec and spec.loader
|
|
spec.loader.exec_module(module)
|
|
return module
|
|
|
|
|
|
def run():
|
|
mod = load_module()
|
|
writes = []
|
|
|
|
mod.AUTH = {"agent_id": "gateway-agent-1"}
|
|
mod.VAULT_KEY = bytes(range(32))
|
|
mod.VAULT_SECRETS = {}
|
|
mod.persist_vault_secrets = lambda: writes.append(dict(mod.VAULT_SECRETS))
|
|
|
|
payload = mod.gateway_generate_project_vault_setup_payload("project-1", "setup-1")
|
|
assert mod.VAULT_KDF_ITERATIONS == 600000
|
|
assert writes, "payload generation should persist local encrypted vault state"
|
|
assert set(item["secret_kind"] for item in payload["project_secrets"]) == {"chat", "tabs", "gateway"}
|
|
assert payload["wrapped_master_secret"]["credential_id"] == "gateway-vault:gateway-agent-1"
|
|
assert payload["wrapped_master_secret"]["kdf_params"]["iterations"] == 600000
|
|
|
|
for item in payload["project_secrets"]:
|
|
envelope = item["encrypted_secret_envelope"]
|
|
assert envelope["schema_version"] == 1
|
|
assert envelope["alg"] == "AES-GCM-256"
|
|
assert envelope["key_id"] == "vault-master:project-1:v1"
|
|
assert "plaintext" not in envelope
|
|
assert "content" not in envelope
|
|
assert len(base64.b64decode(envelope["nonce_b64"])) == 12
|
|
assert len(base64.b64decode(envelope["ciphertext_b64"])) == envelope["payload_size_bytes"]
|
|
assert envelope["payload_size_bytes"] > 16
|
|
|
|
stored = mod.VAULT_SECRETS["project_vaults"]["project-1"]
|
|
assert stored["setup_request_id"] == "setup-1"
|
|
assert len(base64.b64decode(stored["vault_master_secret_b64"])) == 32
|
|
assert set(stored["project_secrets"]) == {"chat", "tabs", "gateway"}
|
|
|
|
writes.clear()
|
|
calls = []
|
|
mod.DEFAULT_PROJECT_ID = "project-1"
|
|
mod.require_unlocked = lambda operation="operation": None
|
|
mod.request_project_write = lambda method, path, body, project_id, purpose, scope_type="project": calls.append(
|
|
(method, path, body, project_id, purpose, scope_type)
|
|
) or {
|
|
"id": "secret-version-2",
|
|
"version": 2,
|
|
"secret_kind": "chat",
|
|
}
|
|
rotated = mod.gateway_rotate_project_vault_secret({"project_id": "project-1", "secret_kind": "chat"})
|
|
assert rotated["version"] == 2
|
|
assert calls[0][0] == "POST"
|
|
assert calls[0][1] == "/v1/projects/project-1/vault/secrets/chat/rotate"
|
|
assert calls[0][5] == "encryption"
|
|
assert calls[0][2]["encrypted_secret_envelope"]["key_id"] == "vault-master:project-1:v1"
|
|
assert mod.VAULT_SECRETS["project_vaults"]["project-1"]["project_secrets"]["chat"]["version"] == 2
|
|
|
|
print("ok: gateway vault setup payload smoke passed")
|
|
|
|
|
|
if __name__ == "__main__":
|
|
run()
|