hmm basekye

Author: dmihalcik-virtru

xtest/tdfs.py

@@ -114,17 +114,27 @@ def has_base_key(self) -> bool:
 
         When base_key is present, SDKs automatically use EC wrapping.
         """
+        return self.base_key_kas_uri is not None
+
+    @property
+    def base_key_kas_uri(self) -> str | None:
+        """Get the KAS URI from the platform's base_key configuration.
+
+        Returns None if base_key is not configured.
+        """
         import json
-        import subprocess
         import urllib.request
 
         platformurl = os.getenv("PLATFORMURL", "http://localhost:8080")
         try:
             with urllib.request.urlopen(f"{platformurl}/.well-known/opentdf-configuration", timeout=5) as response:
                 config = json.loads(response.read().decode())
-                return "base_key" in config.get("configuration", {})
+                base_key = config.get("configuration", {}).get("base_key")
+                if base_key:
+                    return base_key.get("kas_uri")
+                return None
         except Exception:
-            return False
+            return None
 
     def skip_if_unsupported(self, *features: feature_type):
         for feature in features:

xtest/test_abac.py

@@ -51,7 +51,7 @@ def assert_decrypt_fails_with_patterns(
         unexpected_patterns: Patterns that should NOT appear in SDK error output
         audit_logs: Optional AuditLogAsserter for server-side audit validation
         audit_attr_fqn: Optional attribute FQN to verify in audit decision logs
-        ignore_kas_allowlist: If True, bypass KAS allowlist validation
+        ignore_kas_allowlist: Bypass KAS allowlist validation
     """
     try:
         decrypt_sdk.decrypt(
@@ -657,6 +657,10 @@ def test_obligations_not_entitled(
     # Mark timestamp before decrypt attempt
     audit_logs.mark("before_decrypt")
 
+    # Bypass KAS allowlist when base_key is enabled (SDK bug: allowlist not respected)
+    pfs = tdfs.PlatformFeatureSet()
+    ignore_allowlist = pfs.has_base_key
+
     assert_decrypt_fails_with_patterns(
         decrypt_sdk=decrypt_sdk,
         ct_file=ct_file,
@@ -666,7 +670,7 @@ def test_obligations_not_entitled(
         unexpected_patterns=[obligations_pattern],
         audit_logs=audit_logs,
         audit_attr_fqn=attr_val.fqn,
-        ignore_kas_allowlist=True,
+        ignore_kas_allowlist=ignore_allowlist,
     )
 
 

xtest/test_tdfs.py

@@ -135,7 +135,10 @@ def test_tdf_roundtrip(
 
     fname = ct_file.stem
     rt_file = tmp_dir / f"{fname}.untdf"
-    decrypt_sdk.decrypt(ct_file, rt_file, container)
+
+    # When base_key is enabled, bypass KAS allowlist (SDK bug: allowlist not respected with base_key)
+    ignore_allowlist = pfs.has_base_key
+    decrypt_sdk.decrypt(ct_file, rt_file, container, ignore_kas_allowlist=ignore_allowlist)
     assert filecmp.cmp(pt_file, rt_file)
 
     if (