136 lines
4.4 KiB
Python
136 lines
4.4 KiB
Python
from __future__ import annotations
|
|
|
|
from datetime import UTC, datetime, timedelta
|
|
|
|
from sqlalchemy import create_engine, select
|
|
from sqlalchemy.orm import Session
|
|
|
|
from govoplan_access.backend.db.base import AccessBase
|
|
from govoplan_access.backend.db.models import (
|
|
Account,
|
|
ApiKey,
|
|
AuthSession,
|
|
Group,
|
|
Role,
|
|
User,
|
|
)
|
|
from govoplan_access.backend.tenant_erasure_provider import (
|
|
AccessTenantErasureProvider,
|
|
)
|
|
|
|
|
|
def test_access_erasure_is_tenant_bounded_and_retains_global_account() -> None:
|
|
engine = create_engine("sqlite+pysqlite:///:memory:")
|
|
AccessBase.metadata.create_all(engine)
|
|
now = datetime.now(UTC)
|
|
with Session(engine) as session:
|
|
account = Account(
|
|
email="shared@example.test",
|
|
normalized_email="shared@example.test",
|
|
is_active=True,
|
|
auth_provider="local",
|
|
)
|
|
session.add(account)
|
|
session.flush()
|
|
first = User(
|
|
tenant_id="tenant-1",
|
|
account_id=account.id,
|
|
email="shared@example.test",
|
|
is_active=True,
|
|
is_tenant_admin=True,
|
|
auth_provider="local",
|
|
)
|
|
second = User(
|
|
tenant_id="tenant-2",
|
|
account_id=account.id,
|
|
email="shared@example.test",
|
|
is_active=True,
|
|
is_tenant_admin=False,
|
|
auth_provider="local",
|
|
)
|
|
session.add_all(
|
|
[
|
|
first,
|
|
second,
|
|
Group(tenant_id="tenant-1", slug="group", name="Group"),
|
|
Group(tenant_id="tenant-2", slug="group", name="Group"),
|
|
Role(tenant_id="tenant-1", slug="role", name="Role"),
|
|
Role(tenant_id="tenant-2", slug="role", name="Role"),
|
|
]
|
|
)
|
|
session.flush()
|
|
session.add_all(
|
|
[
|
|
ApiKey(
|
|
tenant_id="tenant-1",
|
|
user_id=first.id,
|
|
name="key",
|
|
prefix="prefix",
|
|
key_hash="hash",
|
|
scopes=[],
|
|
),
|
|
AuthSession(
|
|
tenant_id="tenant-1",
|
|
user_id=first.id,
|
|
account_id=account.id,
|
|
token_hash="token-hash",
|
|
expires_at=now + timedelta(hours=1),
|
|
),
|
|
]
|
|
)
|
|
session.commit()
|
|
|
|
provider = AccessTenantErasureProvider()
|
|
preview = provider.preview_tenant_erasure(session, "tenant-1")
|
|
|
|
assert preview.allowed
|
|
assert [step.step_id for step in preview.steps] == [
|
|
"revoke-tenant-credentials",
|
|
"erase-tenant-access",
|
|
]
|
|
assert "revoke-tenant-credentials" in preview.steps[1].depends_on
|
|
|
|
revoked = provider.execute_tenant_erasure_step(
|
|
session,
|
|
"tenant-1",
|
|
"revoke-tenant-credentials",
|
|
"operation:access:credentials",
|
|
)
|
|
erased = provider.execute_tenant_erasure_step(
|
|
session,
|
|
"tenant-1",
|
|
"erase-tenant-access",
|
|
"operation:access:tenant",
|
|
)
|
|
session.commit()
|
|
|
|
assert revoked.state == "completed"
|
|
assert erased.state == "completed"
|
|
assert provider.preview_tenant_erasure(session, "tenant-1").steps == ()
|
|
assert session.scalar(select(Account).where(Account.id == account.id)) is not None
|
|
assert session.scalar(select(User).where(User.tenant_id == "tenant-2")) is not None
|
|
assert session.scalar(select(Group).where(Group.tenant_id == "tenant-2")) is not None
|
|
assert session.scalar(select(Role).where(Role.tenant_id == "tenant-2")) is not None
|
|
|
|
|
|
def test_access_erasure_replay_is_idempotent() -> None:
|
|
engine = create_engine("sqlite+pysqlite:///:memory:")
|
|
AccessBase.metadata.create_all(engine)
|
|
provider = AccessTenantErasureProvider()
|
|
with Session(engine) as session:
|
|
first = provider.execute_tenant_erasure_step(
|
|
session,
|
|
"tenant-1",
|
|
"erase-tenant-access",
|
|
"operation:access:tenant",
|
|
)
|
|
second = provider.reconcile_tenant_erasure_step(
|
|
session,
|
|
"tenant-1",
|
|
"erase-tenant-access",
|
|
"operation:access:tenant",
|
|
)
|
|
|
|
assert first.metrics == {"deleted": 0}
|
|
assert second.metrics == {"deleted": 0}
|