fix(connectors): retain exact CSV source evidence

Release v0.1.27. Coordinated integrity review: GovOPlaN/govoplan-core#298.

tests/test_search_principal.py

@@ -0,0 +1,52 @@
+from __future__ import annotations
+
+import unittest
+from types import SimpleNamespace
+
+from govoplan_connectors.backend.search_principal import principal_acl_tokens
+
+
+class SearchPrincipalTests(unittest.TestCase):
+    def test_legacy_first_seen_projection_and_cap_are_unchanged(self) -> None:
+        principal = SimpleNamespace(
+            account_id=" actor ",
+            membership_id="m",
+            identity_id="i",
+            group_ids=("g", "", "g", "2"),
+            role_ids=("r", "r"),
+            function_assignment_ids=("f",),
+            scopes=tuple(f"scope-{i}" for i in range(700)),
+        )
+        legacy = []
+        for prefix, attribute in (
+            ("account", "account_id"),
+            ("membership", "membership_id"),
+            ("identity", "identity_id"),
+        ):
+            value = getattr(principal, attribute, None)
+            if value:
+                legacy.append(f"{prefix}:{value}")
+        for prefix, attribute in (
+            ("group", "group_ids"),
+            ("role", "role_ids"),
+            ("function", "function_assignment_ids"),
+            ("scope", "scopes"),
+        ):
+            legacy.extend(
+                f"{prefix}:{value}"
+                for value in getattr(principal, attribute, ())
+                if value
+            )
+        expected = tuple(dict.fromkeys(legacy))[:500]
+        self.assertEqual(expected, principal_acl_tokens(principal))
+        self.assertEqual(500, len(expected))
+        self.assertEqual((), principal_acl_tokens(object()))
+
+    def test_projection_stops_consuming_at_authorization_cap(self) -> None:
+        def bounded_scopes():
+            yield from (str(i) for i in range(500))
+            raise AssertionError("ACL projection scanned beyond its effective cap")
+
+        self.assertEqual(
+            500, len(principal_acl_tokens(SimpleNamespace(scopes=bounded_scopes())))
+        )