rkerberos 0.2.3 → 0.3.0

data/spec/krb5_keytab_spec.rb

@@ -37,21 +37,49 @@ RSpec.describe Kerberos::Krb5::Keytab, :kadm5 do
   subject(:keytab) { described_class.new }
 
   describe 'constructor' do
-    it 'accepts an optional name' do
-      expect { described_class.new("FILE:/usr/local/var/keytab") }.not_to raise_error
-      expect { described_class.new("FILE:/bogus/keytab") }.not_to raise_error
+    it 'accepts an optional name keyword' do
+      expect { described_class.new(name: "FILE:/usr/local/var/keytab") }.not_to raise_error
+      expect { described_class.new(name: "FILE:/bogus/keytab") }.not_to raise_error
     end
 
     it 'raises error for invalid residual type' do
       expect {
-        described_class.new("BOGUS:/tmp/keytab")
+        described_class.new(name: "BOGUS:/tmp/keytab")
       }.to raise_error(Kerberos::Krb5::Keytab::Exception)
     end
+
+    it 'accepts a context keyword argument' do
+      ctx = Kerberos::Krb5::Context.new
+      expect { described_class.new(name: @keytab_name, context: ctx) }.not_to raise_error
+    end
+
+    it 'works with context and no name' do
+      ctx = Kerberos::Krb5::Context.new
+      expect { described_class.new(context: ctx) }.not_to raise_error
+    end
+
+    it 'rejects positional arguments' do
+      expect { described_class.new(@keytab_name) }.to raise_error(ArgumentError)
+    end
+
+    it 'rejects unknown keywords' do
+      expect { described_class.new(unknown: true) }.to raise_error(ArgumentError, /unknown keyword/)
+    end
+
+    it 'raises TypeError for non-Context context argument' do
+      expect { described_class.new(context: "bad") }.to raise_error(TypeError)
+    end
+
+    it 'raises error for a closed context' do
+      ctx = Kerberos::Krb5::Context.new
+      ctx.close
+      expect { described_class.new(context: ctx) }.to raise_error(Kerberos::Krb5::Exception)
+    end
   end
 
   describe '#keytab_name and #keytab_type' do
     it 'returns the underlying name and type strings' do
-      kt = described_class.new(@keytab_name)
+      kt = described_class.new(name: @keytab_name)
       expect(kt).to respond_to(:keytab_name)
       expect(kt).to respond_to(:keytab_type)
 
@@ -67,30 +95,30 @@ RSpec.describe Kerberos::Krb5::Keytab, :kadm5 do
 
   describe '#close' do
     it 'returns true' do
-      kt = described_class.new(@keytab_name)
+      kt = described_class.new(name: @keytab_name)
       expect(kt.close).to eq(true)
     end
 
     it 'can be called multiple times without error' do
-      kt = described_class.new(@keytab_name)
+      kt = described_class.new(name: @keytab_name)
       kt.close
       expect { kt.close }.not_to raise_error
     end
 
     it 'raises an error when calling keytab_name after close' do
-      kt = described_class.new(@keytab_name)
+      kt = described_class.new(name: @keytab_name)
       kt.close
       expect { kt.keytab_name }.to raise_error(Kerberos::Krb5::Exception)
     end
 
     it 'raises an error when calling keytab_type after close' do
-      kt = described_class.new(@keytab_name)
+      kt = described_class.new(name: @keytab_name)
       kt.close
       expect { kt.keytab_type }.to raise_error(Kerberos::Krb5::Exception)
     end
 
     it 'does not segfault when garbage collected after close' do
-      kt = described_class.new(@keytab_name)
+      kt = described_class.new(name: @keytab_name)
       kt.close
       kt = nil
       GC.start
@@ -152,7 +180,7 @@ RSpec.describe Kerberos::Krb5::Keytab, :kadm5 do
 
   describe '#each' do
     it 'yields keytab entries for a valid keytab' do
-      kt = described_class.new(@keytab_name)
+      kt = described_class.new(name: @keytab_name)
       entries = []
       kt.each { |entry| entries << entry }
       expect(entries.length).to eq(2)
@@ -166,14 +194,14 @@ RSpec.describe Kerberos::Krb5::Keytab, :kadm5 do
     end
 
     it 'does not leak resources when the block raises' do
-      kt = described_class.new(@keytab_name)
+      kt = described_class.new(name: @keytab_name)
       expect {
         kt.each { |_| raise "boom" }
       }.to raise_error(RuntimeError, "boom")
     end
 
     it 'does not leak resources when the block breaks' do
-      kt = described_class.new(@keytab_name)
+      kt = described_class.new(name: @keytab_name)
       result = catch(:done) do
         kt.each { |_| throw :done, :escaped }
         :completed
@@ -184,7 +212,7 @@ RSpec.describe Kerberos::Krb5::Keytab, :kadm5 do
 
   describe '#get_entry' do
     it 'finds an entry by principal name' do
-      kt = described_class.new(@keytab_name)
+      kt = described_class.new(name: @keytab_name)
       entry = kt.get_entry("testuser1@#{@realm}")
       expect(entry).to be_a(Kerberos::Krb5::Keytab::Entry)
       expect(entry.principal).to eq("testuser1@#{@realm}")
@@ -194,14 +222,14 @@ RSpec.describe Kerberos::Krb5::Keytab, :kadm5 do
     end
 
     it 'finds an entry filtering by vno' do
-      kt = described_class.new(@keytab_name)
+      kt = described_class.new(name: @keytab_name)
       entry = kt.get_entry("testuser1@#{@realm}", 1)
       expect(entry.principal).to eq("testuser1@#{@realm}")
       expect(entry.vno).to eq(1)
     end
 
     it 'finds an entry filtering by vno and enctype' do
-      kt = described_class.new(@keytab_name)
+      kt = described_class.new(name: @keytab_name)
       # aes128-cts-hmac-sha1-96 is enctype 17
       entry = kt.get_entry("testuser1@#{@realm}", 1, 17)
       expect(entry.principal).to eq("testuser1@#{@realm}")
@@ -210,21 +238,21 @@ RSpec.describe Kerberos::Krb5::Keytab, :kadm5 do
     end
 
     it 'raises an error for a non-existent principal' do
-      kt = described_class.new(@keytab_name)
+      kt = described_class.new(name: @keytab_name)
       expect {
         kt.get_entry("bogus@#{@realm}")
       }.to raise_error(Kerberos::Krb5::Exception)
     end
 
     it 'is aliased as find' do
-      kt = described_class.new(@keytab_name)
+      kt = described_class.new(name: @keytab_name)
       expect(kt.method(:find)).to eq(kt.method(:get_entry))
     end
   end
 
   describe '#dup' do
     it 'creates an independent handle referring to same keytab' do
-      kt1 = described_class.new(@keytab_name)
+      kt1 = described_class.new(name: @keytab_name)
       kt2 = kt1.dup
       expect(kt2).to be_a(described_class)
       expect(kt2.keytab_name).to eq(kt1.keytab_name)
@@ -235,8 +263,184 @@ RSpec.describe Kerberos::Krb5::Keytab, :kadm5 do
     end
 
     it 'clone is an alias for dup' do
-      kt = described_class.new(@keytab_name)
+      kt = described_class.new(name: @keytab_name)
       expect(kt.method(:clone)).to eq(kt.method(:dup))
     end
   end
+
+  describe '#have_content?' do
+    it 'returns true for a keytab with entries' do
+      kt = described_class.new(name: @keytab_name)
+      expect(kt.have_content?).to be true
+      kt.close
+    end
+
+    it 'returns false for an empty keytab' do
+      empty_file = File.join(Dir.tmpdir, 'empty_test.keytab')
+      FileUtils.touch(empty_file)
+      kt = described_class.new(name: "FILE:#{empty_file}")
+      expect(kt.have_content?).to be false
+      kt.close
+      FileUtils.rm_f(empty_file)
+    end
+
+    it 'raises when the context is closed' do
+      kt = described_class.new(name: @keytab_name)
+      kt.close
+      expect { kt.have_content? }.to raise_error(Kerberos::Krb5::Exception)
+    end
+  end
+
+  describe '#add_entry' do
+    let(:add_kt_file) { File.join(Dir.tmpdir, 'add_test.keytab') }
+    let(:add_kt_name) { "FILE:#{add_kt_file}" }
+
+    after(:each) { FileUtils.rm_f(add_kt_file) }
+
+    it 'adds an entry that is retrievable via get_entry' do
+      kt = described_class.new(name: add_kt_name)
+      kt.add_entry(principal: "testuser1@#{@realm}", password: 'secret', vno: 1)
+
+      entry = kt.get_entry("testuser1@#{@realm}")
+      expect(entry).to be_a(Kerberos::Krb5::Keytab::Entry)
+      expect(entry.principal).to eq("testuser1@#{@realm}")
+      expect(entry.vno).to eq(1)
+      # default enctype is aes256-cts-hmac-sha1-96 = 18
+      expect(entry.key).to eq(18)
+      kt.close
+    end
+
+    it 'accepts an explicit enctype' do
+      kt = described_class.new(name: add_kt_name)
+      # aes128-cts-hmac-sha1-96 = 17
+      kt.add_entry(principal: "testuser1@#{@realm}", password: 'secret', vno: 2, enctype: 17)
+
+      entry = kt.get_entry("testuser1@#{@realm}", 2, 17)
+      expect(entry.vno).to eq(2)
+      expect(entry.key).to eq(17)
+      kt.close
+    end
+
+    it 'can add multiple entries for the same principal' do
+      kt = described_class.new(name: add_kt_name)
+      kt.add_entry(principal: "testuser1@#{@realm}", password: 'secret', vno: 1, enctype: 18)
+      kt.add_entry(principal: "testuser1@#{@realm}", password: 'secret', vno: 1, enctype: 17)
+
+      entries = []
+      kt.each { |e| entries << e }
+      expect(entries.length).to eq(2)
+      kt.close
+    end
+
+    it 'returns self for chaining' do
+      kt = described_class.new(name: add_kt_name)
+      result = kt.add_entry(principal: "testuser1@#{@realm}", password: 'secret')
+      expect(result).to equal(kt)
+      kt.close
+    end
+
+    it 'raises ArgumentError when principal is missing' do
+      kt = described_class.new(name: add_kt_name)
+      expect { kt.add_entry(password: 'secret') }.to raise_error(ArgumentError)
+      kt.close
+    end
+
+    it 'raises ArgumentError when password is missing' do
+      kt = described_class.new(name: add_kt_name)
+      expect { kt.add_entry(principal: "testuser1@#{@realm}") }.to raise_error(ArgumentError)
+      kt.close
+    end
+
+    it 'raises ArgumentError with no arguments' do
+      kt = described_class.new(name: add_kt_name)
+      expect { kt.add_entry }.to raise_error(ArgumentError)
+      kt.close
+    end
+
+    it 'rejects unknown keywords' do
+      kt = described_class.new(name: add_kt_name)
+      expect {
+        kt.add_entry(principal: "testuser1@#{@realm}", password: 'secret', unknown: true)
+      }.to raise_error(ArgumentError, /unknown keyword/)
+      kt.close
+    end
+
+    it 'raises when the keytab is closed' do
+      kt = described_class.new(name: add_kt_name)
+      kt.close
+      expect {
+        kt.add_entry(principal: "testuser1@#{@realm}", password: 'secret')
+      }.to raise_error(Kerberos::Krb5::Exception)
+    end
+  end
+
+  describe '#remove_entry' do
+    let(:rm_kt_file) { File.join(Dir.tmpdir, 'remove_test.keytab') }
+    let(:rm_kt_name) { "FILE:#{rm_kt_file}" }
+
+    before(:each) do
+      @rm_kt = described_class.new(name: rm_kt_name)
+      @rm_kt.add_entry(principal: "testuser1@#{@realm}", password: 'secret', vno: 1, enctype: 18)
+      @rm_kt.add_entry(principal: "testuser1@#{@realm}", password: 'secret', vno: 2, enctype: 17)
+      @rm_kt.add_entry(principal: "testuser2@#{@realm}", password: 'secret', vno: 1, enctype: 18)
+    end
+
+    after(:each) do
+      @rm_kt.close rescue nil
+      FileUtils.rm_f(rm_kt_file)
+    end
+
+    it 'removes all entries for a principal when vno and enctype are defaulted' do
+      @rm_kt.remove_entry(principal: "testuser1@#{@realm}")
+      entries = []
+      @rm_kt.each { |e| entries << e }
+      principals = entries.map(&:principal)
+      expect(principals).not_to include("testuser1@#{@realm}")
+      expect(principals).to include("testuser2@#{@realm}")
+    end
+
+    it 'removes only the entry matching a specific vno' do
+      @rm_kt.remove_entry(principal: "testuser1@#{@realm}", vno: 1)
+      entry = @rm_kt.get_entry("testuser1@#{@realm}")
+      expect(entry.vno).to eq(2)
+    end
+
+    it 'removes only the entry matching a specific enctype' do
+      @rm_kt.remove_entry(principal: "testuser1@#{@realm}", enctype: 17)
+      entry = @rm_kt.get_entry("testuser1@#{@realm}")
+      expect(entry.key).to eq(18)
+    end
+
+    it 'returns self for chaining' do
+      result = @rm_kt.remove_entry(principal: "testuser2@#{@realm}")
+      expect(result).to equal(@rm_kt)
+    end
+
+    it 'raises ArgumentError when principal is missing' do
+      expect { @rm_kt.remove_entry(vno: 1) }.to raise_error(ArgumentError)
+    end
+
+    it 'raises ArgumentError with no arguments' do
+      expect { @rm_kt.remove_entry }.to raise_error(ArgumentError)
+    end
+
+    it 'rejects unknown keywords' do
+      expect {
+        @rm_kt.remove_entry(principal: "testuser1@#{@realm}", unknown: true)
+      }.to raise_error(ArgumentError, /unknown keyword/)
+    end
+
+    it 'raises when the keytab is closed' do
+      @rm_kt.close
+      expect {
+        @rm_kt.remove_entry(principal: "testuser1@#{@realm}")
+      }.to raise_error(Kerberos::Krb5::Exception)
+    end
+
+    it 'raises for a non-existent entry' do
+      expect {
+        @rm_kt.remove_entry(principal: "nobody@#{@realm}")
+      }.to raise_error(Kerberos::Krb5::Keytab::Exception)
+    end
+  end
 end

data/spec/krb5_spec.rb

@@ -23,7 +23,7 @@ RSpec.describe Kerberos::Krb5 do
   let(:service) { 'kadmin/admin' }
 
   it 'has the correct version constant' do
-    expect(Kerberos::Krb5::VERSION).to eq('0.2.3')
+    expect(Kerberos::Krb5::VERSION).to eq('0.3.0')
   end
 
   it 'accepts a block and yields itself' do
@@ -31,6 +31,31 @@ RSpec.describe Kerberos::Krb5 do
     described_class.new { |k| expect(k).to be_a(described_class) }
   end
 
+  describe 'constructor' do
+    it 'accepts a context keyword argument' do
+      context = Kerberos::Krb5::Context.new
+      k = described_class.new(context: context)
+      expect(k).to be_a(described_class)
+      expect(k.get_default_realm).to eq(@realm)
+      k.close
+    end
+
+    it 'raises TypeError if context is not a Kerberos::Krb5::Context' do
+      expect { described_class.new(context: 'bad') }.to raise_error(TypeError, /context must be/)
+    end
+
+    it 'raises an error if the context is closed' do
+      context = Kerberos::Krb5::Context.new
+      context.close
+      expect { described_class.new(context: context) }.to raise_error(Kerberos::Krb5::Exception, /context is closed/)
+    end
+
+    it 'rejects positional option hashes and unknown keywords' do
+      expect { described_class.new({context: nil}) }.to raise_error(ArgumentError)
+      expect { described_class.new(unknown: true) }.to raise_error(ArgumentError, /unknown keyword/)
+    end
+  end
+
   describe '#get_default_realm' do
     it 'responds to get_default_realm' do
       expect(krb5).to respond_to(:get_default_realm)
@@ -68,53 +93,74 @@ RSpec.describe Kerberos::Krb5 do
       expect(krb5).to respond_to(:verify_init_creds)
     end
 
+    it 'requires get_init_creds_password arguments as keywords' do
+      expect { krb5.get_init_creds_password(user, 'changeme') }.to raise_error(ArgumentError)
+      expect {
+        krb5.get_init_creds_password(principal: user, password: 'changeme', unknown: true)
+      }.to raise_error(ArgumentError, /unknown keyword/)
+    end
+
     it 'raises when no credentials have been acquired' do
       expect { krb5.verify_init_creds }.to raise_error(Kerberos::Krb5::Exception)
     end
 
     it 'validates argument types' do
-      expect { krb5.verify_init_creds(true) }.to raise_error(TypeError)
-      expect { krb5.verify_init_creds(nil, true) }.to raise_error(TypeError)
-      expect { krb5.verify_init_creds(nil, nil, true) }.to raise_error(TypeError)
+      expect { krb5.verify_init_creds(server: true) }.to raise_error(TypeError)
+      expect { krb5.verify_init_creds(keytab: true) }.to raise_error(TypeError)
+      expect { krb5.verify_init_creds(ccache: true) }.to raise_error(TypeError)
+    end
+
+    it 'accepts only documented keyword arguments' do
+      expect { krb5.verify_init_creds(nil) }.to raise_error(ArgumentError)
+      expect { krb5.verify_init_creds(unknown: true) }.to raise_error(ArgumentError, /unknown keyword/)
     end
 
     it 'verifies credentials obtained via password' do
-      krb5.get_init_creds_password(user, 'changeme')
+      krb5.get_init_creds_password(principal: user, password: 'changeme')
       expect(krb5.verify_init_creds).to be true
     end
 
     it 'accepts a server principal string' do
-      krb5.get_init_creds_password(user, 'changeme')
-      expect(krb5.verify_init_creds("kadmin/admin@#{@realm}")).to be true
+      krb5.get_init_creds_password(principal: user, password: 'changeme')
+      expect(krb5.verify_init_creds(server: "kadmin/admin@#{@realm}")).to be true
     end
 
     it 'accepts a Keytab object' do
-      krb5.get_init_creds_password(user, 'changeme')
+      krb5.get_init_creds_password(principal: user, password: 'changeme')
       kt = Kerberos::Krb5::Keytab.new
-      expect(krb5.verify_init_creds(nil, kt)).to be true
+      expect(krb5.verify_init_creds(keytab: kt)).to be true
     end
 
     it 'stores additional credentials in provided CredentialsCache' do
       ccache = Kerberos::Krb5::CredentialsCache.new
-      krb5.get_init_creds_password(user, 'changeme')
-      expect(krb5.verify_init_creds(nil, nil, ccache)).to be true
+      krb5.get_init_creds_password(principal: user, password: 'changeme')
+      expect(krb5.verify_init_creds(ccache: ccache)).to be true
       expect(ccache.primary_principal).to be_a(String)
       expect(ccache.primary_principal).to include('@')
     end
 
     it 'provides authenticate! which acquires and verifies (Zanarotti mitigation)' do
       expect(krb5).to respond_to(:authenticate!)
-      expect(krb5.authenticate!(user, 'changeme')).to be true
+      expect(krb5.authenticate!(principal: user, password: 'changeme')).to be true
       expect(krb5.verify_init_creds).to be true
     end
 
     it 'accepts an optional service argument' do
-      expect { krb5.authenticate!(user, 'changeme', 'kadmin/changepw') }.not_to raise_error
+      expect {
+        krb5.authenticate!(principal: user, password: 'changeme', service: 'kadmin/changepw')
+      }.not_to raise_error
       expect(krb5.verify_init_creds).to be true
     end
 
     it 'validates argument types for authenticate!' do
-      expect { krb5.authenticate!(true, true) }.to raise_error(TypeError)
+      expect { krb5.authenticate!(principal: true, password: true) }.to raise_error(TypeError)
+    end
+
+    it 'requires authenticate! arguments as keywords' do
+      expect { krb5.authenticate!(user, 'changeme') }.to raise_error(ArgumentError)
+      expect {
+        krb5.authenticate!(principal: user, password: 'changeme', unknown: true)
+      }.to raise_error(ArgumentError, /unknown keyword/)
     end
   end
 
@@ -154,16 +200,16 @@ RSpec.describe Kerberos::Krb5 do
     end
 
     it 'changes the password successfully' do
-      krb5.get_init_creds_password(user, 'changeme')
+      krb5.get_init_creds_password(principal: user, password: 'changeme')
       expect(krb5.change_password('changeme', 'Newpass99!')).to be true
       # Verify we can authenticate with the new password
       krb5_check = described_class.new
-      expect(krb5_check.get_init_creds_password(user, 'Newpass99!')).to be true
+      expect(krb5_check.get_init_creds_password(principal: user, password: 'Newpass99!')).to be true
       krb5_check.close
     end
 
     it 'raises with a meaningful message when the old password is wrong' do
-      krb5.get_init_creds_password(user, 'changeme')
+      krb5.get_init_creds_password(principal: user, password: 'changeme')
       expect {
         krb5.change_password('wrongpass', 'Newpass99!')
       }.to raise_error(Kerberos::Krb5::Exception, /krb5_(get_init_creds_password|change_password)/)
@@ -180,7 +226,7 @@ RSpec.describe Kerberos::Krb5 do
       let(:compliant_pw) { 'Changeme1!' }
 
       it 'raises an exception with the KDC rejection reason' do
-        krb5.get_init_creds_password(policy_user, compliant_pw)
+        krb5.get_init_creds_password(principal: policy_user, password: compliant_pw)
         expect {
           krb5.change_password(compliant_pw, 'a')
         }.to raise_error(Kerberos::Krb5::Exception, /krb5_change_password/)
@@ -208,18 +254,83 @@ RSpec.describe Kerberos::Krb5 do
       expect(krb5).to respond_to(:get_init_creds_keytab)
     end
 
+    it 'accepts only documented keyword arguments' do
+      expect { krb5.get_init_creds_keytab(user) }.to raise_error(ArgumentError)
+      expect { krb5.get_init_creds_keytab(unknown: true) }.to raise_error(ArgumentError, /unknown keyword/)
+    end
+
     it 'acquires credentials for a principal from a supplied keytab file' do
       kt_name = "FILE:#{@kt_file}"
-      expect { krb5.get_init_creds_keytab(user, kt_name) }.not_to raise_error
+      expect { krb5.get_init_creds_keytab(principal: user, keytab: kt_name) }.not_to raise_error
       expect(krb5.verify_init_creds).to be true
     end
 
     it 'accepts a CredentialsCache to receive credentials' do
       ccache = Kerberos::Krb5::CredentialsCache.new
       kt_name = "FILE:#{@kt_file}"
-      expect { krb5.get_init_creds_keytab(user, kt_name, nil, ccache) }.not_to raise_error
+      expect { krb5.get_init_creds_keytab(principal: user, keytab: kt_name, ccache: ccache) }.not_to raise_error
       expect(ccache.primary_principal).to be_a(String)
       expect(ccache.primary_principal).to include('@')
     end
   end
+
+  describe '.thread_safe?' do
+    it 'returns a boolean' do
+      result = described_class.thread_safe?
+      expect([true, false]).to include(result)
+    end
+
+    it 'is callable without an instance' do
+      expect(described_class).to respond_to(:thread_safe?)
+    end
+  end
+
+  describe '#get_host_realm' do
+    it 'responds to get_host_realm' do
+      expect(krb5).to respond_to(:get_host_realm)
+    end
+
+    it 'returns an array of realm strings' do
+      result = krb5.get_host_realm('localhost')
+      expect(result).to be_a(Array)
+      result.each { |r| expect(r).to be_a(String) }
+    end
+
+    it 'returns a non-empty array for a known hostname' do
+      result = krb5.get_host_realm('localhost')
+      expect(result).not_to be_empty
+    end
+
+    it 'raises TypeError for non-string argument' do
+      expect { krb5.get_host_realm(123) }.to raise_error(TypeError)
+    end
+
+    it 'raises ArgumentError when called without arguments' do
+      expect { krb5.get_host_realm }.to raise_error(ArgumentError)
+    end
+  end
+
+  describe '#expand_hostname' do
+    it 'responds to expand_hostname' do
+      expect(krb5).to respond_to(:expand_hostname)
+    end
+
+    it 'returns a string' do
+      result = krb5.expand_hostname('localhost')
+      expect(result).to be_a(String)
+    end
+
+    it 'returns a non-empty string' do
+      result = krb5.expand_hostname('localhost')
+      expect(result.size).to be > 0
+    end
+
+    it 'raises TypeError for non-string argument' do
+      expect { krb5.expand_hostname(123) }.to raise_error(TypeError)
+    end
+
+    it 'raises ArgumentError when called without arguments' do
+      expect { krb5.expand_hostname }.to raise_error(ArgumentError)
+    end
+  end
 end

data/spec/policy_spec.rb

@@ -21,6 +21,10 @@ RSpec.describe 'Kerberos::Kadm5::Policy', :kadm5 do
     it 'must be present' do
       expect { klass.new(max_life: 10000) }.to raise_error(ArgumentError)
     end
+    it 'rejects positional option hashes and unknown keywords' do
+      expect { klass.new({name: 'test'}) }.to raise_error(ArgumentError)
+      expect { klass.new(name: 'test', unknown: true) }.to raise_error(ArgumentError, /unknown keyword/)
+    end
   end
 
   describe 'min_life' do