wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

fix(security): isolate workload database identities
All checks were successful
CD Pipeline / workflow-shape (push) Successful in 1s
Details
CD Pipeline / cancel-stale-cd (push) Has been skipped
Details
CD Pipeline / tests (push) Successful in 2m25s
Details
CD Pipeline / build-and-deploy (push) Successful in 6m42s
Details
CD Pipeline / post-deploy-checks (push) Successful in 1m50s
Details

Browse Source
This commit is contained in:
ogt
2026-07-11 04:20:08 +08:00
parent eb976bdbd2
commit 262c9c8a7e
11 changed files with 1062 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

49
apps/api/tests/test_executor_trust_boundary_readback.py
View File

@@ -25,19 +25,32 @@ def _verified_receipt(source_sha: str = "abc123") -> dict[str, str]:
"worker_ssh_egress_denied": "true",
"broker_ssh_egress_allowlisted": "true",
"legacy_namespace_egress_allow_absent": "true",
"db_identity_verifier": "runtime_role_fingerprint_and_secret_projection_v1",
"db_identity_verifier": (
"runtime_role_fingerprint_secret_projection_and_"
"representative_preflight_v2"
),
"api_database_secret_ref": "awoooi-api-db",
"worker_database_secret_ref": "awoooi-worker-db",
"broker_database_secret_ref": "awoooi-broker-db",
"api_db_role_fingerprint": "a" * 64,
"worker_db_role_fingerprint": "b" * 64,
"broker_db_role_fingerprint": "c" * 64,
"api_db_connection_limit": "2",
"api_db_connection_limit": "4",
"worker_db_connection_limit": "2",
"broker_db_connection_limit": "2",
"api_required_connection_budget": "1",
"worker_required_connection_budget": "1",
"broker_required_connection_budget": "1",
"api_required_connection_budget": "4",
"worker_required_connection_budget": "2",
"broker_required_connection_budget": "2",
"api_representative_db_preflight_passed": "true",
"worker_representative_db_preflight_passed": "true",
"broker_representative_db_preflight_passed": "true",
"api_table_privilege_gap_count": "0",
"worker_table_privilege_gap_count": "0",
"broker_table_privilege_gap_count": "0",
"api_sequence_privilege_gap_count": "0",
"worker_sequence_privilege_gap_count": "0",
"broker_sequence_privilege_gap_count": "0",
"representative_db_preflights_verified": "true",
"api_database_null_pool": "true",
"worker_database_null_pool": "true",
"broker_database_null_pool": "true",
@@ -67,9 +80,12 @@ def test_executor_trust_boundary_requires_live_controls_and_matching_source() ->
assert database_boundary["db_identity_isolated"] is True
assert database_boundary["connection_budget_verified"] is True
assert database_boundary["connection_budget"] == {
"observed_total": 6,
"required_total": 3,
"observed_total": 8,
"required_total": 8,
}
assert database_boundary["controls"][
"representative_db_preflights_verified"
] is True
assert database_boundary["secret_values_read"] is False
assert database_boundary["role_names_exposed"] is False
@@ -126,3 +142,22 @@ def test_executor_trust_boundary_keeps_shared_database_identity_in_progress() ->
assert "database_role_fingerprints_not_distinct" in database_boundary[
"active_blockers"
]
def test_executor_trust_boundary_requires_representative_database_preflight() -> None:
receipt = _verified_receipt()
receipt["worker_representative_db_preflight_passed"] = "false"
receipt["worker_table_privilege_gap_count"] = "1"
receipt["representative_db_preflights_verified"] = "false"
readback = build_executor_trust_boundary_readback(
receipt,
deployed_source_sha="abc123",
)
database_boundary = readback["database_identity_boundary"]
assert database_boundary["db_identity_isolated"] is True
assert database_boundary["connection_budget_verified"] is False
assert "worker_representative_db_preflight_not_verified" in (
database_boundary["active_blockers"]
)