# =============================================================================
# L2 BEHAVIORAL SCAFFOLD — the CVE page requires a platform-admins login  (R-VULN-04)
# Catalog: docs/17 "Acceptance gates" (L2).
#
# An unauthenticated request to cve.<domain> is redirected to Keycloak, and a logged-in user outside platform-admins gets 403.
#
# STATUS: scaffold only. It asserts nothing and DOES NOT EXECUTE IN CI: vars.CLUSTER_AVAILABLE is unset,
# so L2/L3 conformance does not run. Coverage from this file is a named gap, not evidence.
# =============================================================================
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: Test
metadata:
  name: vuln-page-requires-admin
  labels:
    conformance.home.k3s/R-VULN-04: "true"
  annotations:
    conformance.home.k3s/requirements: "R-VULN-04"
    conformance.home.k3s/layer: "L2"
    conformance.home.k3s/safety-critical: "false"
    conformance.home.k3s/intent: >-
      An unauthenticated request to cve.<domain> is redirected to Keycloak, and a logged-in user outside platform-admins gets 403.
spec:
  steps:
    - name: given-the-page-route
      try:
        - script:
            content: 'echo "TODO: resolve cve.<domain> through the Gateway"'
    - name: when-unauthenticated
      try:
        - script:
            content: 'echo "TODO: request the page with no session"'
    - name: then-redirected-to-keycloak
      try:
        - script:
            content: 'echo "TODO: assert a 302 to the homelab realm"'
    - name: then-non-admin-forbidden
      try:
        - script:
            content: 'echo "TODO: assert 403 for a session outside platform-admins"'