Release govoplan-access v0.1.25: harden authentication and repair identity mappings

tests/test_permission_catalog_contract.py

@@ -30,6 +30,34 @@ class PermissionCatalogContractTests(unittest.TestCase):
         self.assertIn("files:file:read", scopes)
         self.assertIn("files:read", scopes)
 
+    def test_api_key_intersection_excludes_canonical_and_legacy_system_scopes(self) -> None:
+        for scope in ("access:system_credential:write", "access:tenant:create", "system:tenants:create"):
+            with self.subTest(scope=scope):
+                self.assertEqual([], access_catalog.intersect_api_key_scopes([scope], [scope]))
+
+    def test_api_key_module_wildcards_expand_only_to_concrete_tenant_scopes(self) -> None:
+        scopes = access_catalog.intersect_api_key_scopes(["access:*"], ["access:*"])
+        self.assertIn("access:membership:read", scopes)
+        self.assertNotIn("access:*", scopes)
+        self.assertFalse(access_catalog.scopes_grant(scopes, "access:system_credential:write"))
+        catalog = access_catalog.permission_map()
+        self.assertTrue(all(catalog[scope].level == "tenant" for scope in scopes if scope in catalog))
+
+    def test_api_key_intersection_preserves_unknown_concrete_module_grants(self) -> None:
+        self.assertEqual(
+            ["optional-module:record:read"],
+            access_catalog.intersect_api_key_scopes(["optional-module:record:read"], ["optional-module:record:read"]),
+        )
+
+    def test_api_key_intersection_preserves_concrete_tenant_compatibility_aliases(self) -> None:
+        scopes = access_catalog.intersect_api_key_scopes(["files:read"], ["files:file:read"])
+        self.assertIn("files:read", scopes)
+        self.assertIn("files:file:read", scopes)
+        self.assertTrue(access_catalog.scopes_grant(scopes, "files:file:read"))
+
+    def test_api_key_intersection_does_not_retain_unknown_wildcards(self) -> None:
+        self.assertEqual([], access_catalog.intersect_api_key_scopes(["optional-module:*"], ["optional-module:*"]))
+
 
 if __name__ == "__main__":
     unittest.main()