T-0.4 Chainsaw conformance harness + coverage + behavior scaffolds (R-TEST-01..06)

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
2026-08-16 00:08:32 -05:00
1 parent a778d923b6
commit 9d8e03892f
@@ -0,0 +1,44 @@
+# =============================================================================
+# L2 BEHAVIORAL SCAFFOLD — SSO / forward-auth  (R-IDP-02)
+# Catalog: docs/14 onboarding (auth wiring) + docs/15 identity-and-access.
+#
+# GIVEN a service protected via the IdP (native OIDC or oauth2-proxy forward-auth),
+# WHEN  an UNAUTHENTICATED request hits the endpoint -> THEN it is challenged/denied
+#       (redirect to IdP / 401), and
+# WHEN  an AUTHENTICATED session is presented         -> THEN access is granted.
+#
+# STATUS: scaffold — needs T-6.1c/T-6.1d (Keycloak + oauth2-proxy + auth render).
+# =============================================================================
+apiVersion: chainsaw.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  name: sso-forward-auth
+  labels:
+    conformance.home.k3s/R-IDP-02: "true"
+  annotations:
+    conformance.home.k3s/requirements: "R-IDP-02"
+    conformance.home.k3s/layer: "L2"
+    conformance.home.k3s/safety-critical: "false"
+    conformance.home.k3s/intent: >-
+      Unauthenticated requests are challenged by the IdP; authenticated ones pass.
+spec:
+  steps:
+    - name: given-idp-protected-service
+      try:
+        - script:
+            content: 'echo "TODO(T-6.1d): onboard a service with auth block -> OIDC/forward-auth"'
+    - name: then-unauthenticated-is-challenged
+      try:
+        - script:
+            # Expect a 302 to the IdP or a 401 — never a 200 with the app body.
+            content: |
+              set -euo pipefail
+              code=$(kubectl -n "$NAMESPACE" exec probe -- \
+                curl -s -o /dev/null -w '%{http_code}' https://<service>.home.keithjackson.dev)
+              echo "unauth_code=$code"
+              case "$code" in 302|303|401|403) echo CHALLENGED_OK ;; *) exit 1 ;; esac
+            check: { ($stdout =~ 'CHALLENGED_OK'): true }
+    - name: then-authenticated-is-granted
+      try:
+        - script:
+            content: 'echo "TODO: obtain IdP session (test user), replay, assert 200"'