gitea-admin/CASAN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Complete CASAN backlog tier 1 controls

Browse Source
This commit is contained in:
thanhnv
2026-07-06 11:31:17 +09:00
parent 571c2b7e80
commit e79d7973fb
22 changed files with 685 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files
AINative_OKR_CASAN5/.specify/tests/phase-h5-approval-tests.sh
+32
View File
@@ -94,6 +94,38 @@ expect_rc 0 "non-strict env approval unchanged (backward compatible)" \
env CASAN_ACTOR=alice CASAN_APPROVAL_DECISION=approve CASAN_APPROVER=bob \
bash "$S/governance-check.sh" "$REQ" "$WORK/out.txt" deploy
echo "===== H5 OIDC approval via mock IdP JWT (CASAN_APPROVAL_STRICT=1) ====="
openssl genrsa -out "$WORK/idp.priv.pem" 2048 2>/dev/null
openssl rsa -in "$WORK/idp.priv.pem" -pubout -out "$WORK/idp.pub.pem" 2>/dev/null
openssl genrsa -out "$WORK/fake-idp.priv.pem" 2048 2>/dev/null
mint_jwt() {
python3 "$S/approval-jwt-mint.py" --key "$1" --sub "$2" --role "$3" \
--action deploy --actor alice --input "$REQ" --exp-offset "$4"
}
# 9. Valid IdP-signed JWT by an authorized role -> APPROVED
OIDC_JWT="$(mint_jwt "$WORK/idp.priv.pem" oidc-ops ops 300)"
OUT="$(gc CASAN_APPROVER=oidc-ops CASAN_APPROVAL_JWT="$OIDC_JWT" CASAN_IDP_PUBLIC_KEY="$WORK/idp.pub.pem" 2>/dev/null)"; RC=$?
{ [[ "$RC" -eq 0 ]] && printf '%s' "$OUT" | grep -q "human_approved_oidc"; } \
&& pass "valid IdP JWT by authorized role -> APPROVED" \
|| fail "valid IdP JWT rejected (rc=$RC out=$OUT)"
# 10. Expired JWT -> DENY
EXPIRED_JWT="$(mint_jwt "$WORK/idp.priv.pem" oidc-ops ops -60)"
expect_rc 2 "expired IdP JWT is denied" \
gc CASAN_APPROVER=oidc-ops CASAN_APPROVAL_JWT="$EXPIRED_JWT" CASAN_IDP_PUBLIC_KEY="$WORK/idp.pub.pem"
# 11. Role not authorized for deploy -> DENY
WRONG_ROLE_JWT="$(mint_jwt "$WORK/idp.priv.pem" oidc-tech tech_lead 300)"
expect_rc 2 "IdP JWT with unauthorized role is denied" \
gc CASAN_APPROVER=oidc-tech CASAN_APPROVAL_JWT="$WRONG_ROLE_JWT" CASAN_IDP_PUBLIC_KEY="$WORK/idp.pub.pem"
# 12. JWT signed by a different key than the trusted IdP pubkey -> DENY
FORGED_JWT="$(mint_jwt "$WORK/fake-idp.priv.pem" oidc-ops ops 300)"
expect_rc 2 "JWT with forged IdP signature is denied" \
gc CASAN_APPROVER=oidc-ops CASAN_APPROVAL_JWT="$FORGED_JWT" CASAN_IDP_PUBLIC_KEY="$WORK/idp.pub.pem"
echo ""
echo "===== H5 APPROVAL-IDENTITY SUMMARY: PASS=$PASS FAIL=$FAIL ====="
[[ "$FAIL" -eq 0 ]] || exit 1