Add governed automation contracts
This commit is contained in:
75
tests/test_automation_contract.py
Normal file
75
tests/test_automation_contract.py
Normal file
@@ -0,0 +1,75 @@
|
||||
from __future__ import annotations
|
||||
|
||||
import unittest
|
||||
|
||||
from govoplan_core.core.automation import (
|
||||
CAPABILITY_AUTH_AUTOMATION_PRINCIPAL_PROVIDER,
|
||||
AutomationInvocation,
|
||||
AutomationPrincipalProvider,
|
||||
AutomationPrincipalRequest,
|
||||
AutomationPrincipalResolution,
|
||||
automation_principal_provider,
|
||||
)
|
||||
from govoplan_core.core.modules import ModuleContext, ModuleManifest
|
||||
from govoplan_core.core.registry import PlatformRegistry
|
||||
|
||||
|
||||
class _Provider:
|
||||
def resolve_automation_principal(self, session, *, request):
|
||||
del session
|
||||
return AutomationPrincipalResolution(
|
||||
allowed=True,
|
||||
principal={"account_id": request.account_id},
|
||||
granted_scopes=request.grant_scopes,
|
||||
)
|
||||
|
||||
|
||||
class AutomationContractTests(unittest.TestCase):
|
||||
def test_invocation_records_stable_trigger_provenance(self) -> None:
|
||||
invocation = AutomationInvocation(
|
||||
kind="event",
|
||||
trigger_ref="dataflow-trigger:1",
|
||||
event_id="event-1",
|
||||
event_type="files.uploaded",
|
||||
)
|
||||
|
||||
self.assertEqual("event", invocation.kind)
|
||||
self.assertEqual("event-1", invocation.event_id)
|
||||
|
||||
def test_principal_provider_is_runtime_resolved(self) -> None:
|
||||
provider = _Provider()
|
||||
self.assertIsInstance(provider, AutomationPrincipalProvider)
|
||||
registry = PlatformRegistry()
|
||||
registry.register(
|
||||
ModuleManifest(
|
||||
id="automation_contract_test",
|
||||
name="Automation contract test",
|
||||
version="test",
|
||||
capability_factories={
|
||||
CAPABILITY_AUTH_AUTOMATION_PRINCIPAL_PROVIDER: (
|
||||
lambda context: provider
|
||||
),
|
||||
},
|
||||
)
|
||||
)
|
||||
registry.configure_capability_context(
|
||||
ModuleContext(registry=registry, settings=object())
|
||||
)
|
||||
|
||||
self.assertIs(provider, automation_principal_provider(registry))
|
||||
result = provider.resolve_automation_principal(
|
||||
object(),
|
||||
request=AutomationPrincipalRequest(
|
||||
tenant_id="tenant-1",
|
||||
account_id="account-1",
|
||||
membership_id="membership-1",
|
||||
authorization_ref="trigger:1",
|
||||
grant_scopes=("dataflow:pipeline:run",),
|
||||
),
|
||||
)
|
||||
self.assertTrue(result.allowed)
|
||||
self.assertEqual(("dataflow:pipeline:run",), result.granted_scopes)
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
unittest.main()
|
||||
56
tests/test_dataflow_trigger_worker.py
Normal file
56
tests/test_dataflow_trigger_worker.py
Normal file
@@ -0,0 +1,56 @@
|
||||
from __future__ import annotations
|
||||
|
||||
import unittest
|
||||
from unittest.mock import MagicMock, patch
|
||||
|
||||
from govoplan_core.celery_app import celery, dispatch_dataflow_triggers
|
||||
|
||||
|
||||
class DataflowTriggerWorkerTests(unittest.TestCase):
|
||||
def test_worker_commits_dispatch_outcome(self) -> None:
|
||||
session = MagicMock()
|
||||
database = MagicMock()
|
||||
database.SessionLocal.return_value.__enter__.return_value = session
|
||||
provider = MagicMock()
|
||||
provider.dispatch_due.return_value = {
|
||||
"queued": 1,
|
||||
"processed": 1,
|
||||
"succeeded": 1,
|
||||
"failed": 0,
|
||||
"blocked": 0,
|
||||
"skipped": 0,
|
||||
}
|
||||
|
||||
with (
|
||||
patch(
|
||||
"govoplan_core.celery_app._dataflow_trigger_dispatcher",
|
||||
return_value=provider,
|
||||
),
|
||||
patch(
|
||||
"govoplan_core.db.session.get_database",
|
||||
return_value=database,
|
||||
),
|
||||
):
|
||||
result = dispatch_dataflow_triggers.run(25)
|
||||
|
||||
provider.dispatch_due.assert_called_once_with(session, limit=25)
|
||||
session.commit.assert_called_once_with()
|
||||
self.assertEqual(result["succeeded"], 1)
|
||||
|
||||
def test_worker_route_and_periodic_dispatch_are_registered(self) -> None:
|
||||
self.assertEqual(
|
||||
celery.conf.task_routes["govoplan.dataflow.dispatch_triggers"],
|
||||
{"queue": "dataflow"},
|
||||
)
|
||||
schedule = celery.conf.beat_schedule[
|
||||
"dataflow-triggers-every-minute"
|
||||
]
|
||||
self.assertEqual(
|
||||
schedule["task"],
|
||||
"govoplan.dataflow.dispatch_triggers",
|
||||
)
|
||||
self.assertEqual(schedule["schedule"], 60.0)
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
unittest.main()
|
||||
79
tests/test_definition_governance_contract.py
Normal file
79
tests/test_definition_governance_contract.py
Normal file
@@ -0,0 +1,79 @@
|
||||
from __future__ import annotations
|
||||
|
||||
import unittest
|
||||
|
||||
from govoplan_core.core.access import PrincipalRef
|
||||
from govoplan_core.core.modules import ModuleContext, ModuleManifest
|
||||
from govoplan_core.core.policy import (
|
||||
CAPABILITY_POLICY_DEFINITION_GOVERNANCE,
|
||||
DefinitionGovernancePolicy,
|
||||
DefinitionGovernanceRequest,
|
||||
DefinitionScopeRef,
|
||||
PolicyDecision,
|
||||
definition_governance_policy,
|
||||
)
|
||||
from govoplan_core.core.registry import PlatformRegistry
|
||||
|
||||
|
||||
class _Policy:
|
||||
def resolve_definition_action(self, *, request):
|
||||
return PolicyDecision(
|
||||
allowed=request.definition_kind != "template"
|
||||
or request.action != "run",
|
||||
)
|
||||
|
||||
|
||||
class DefinitionGovernanceContractTests(unittest.TestCase):
|
||||
def test_scope_paths_reuse_policy_provenance_format(self) -> None:
|
||||
self.assertEqual("system", DefinitionScopeRef("system").path)
|
||||
self.assertEqual(
|
||||
"tenant:tenant-1",
|
||||
DefinitionScopeRef("tenant", "tenant-1").path,
|
||||
)
|
||||
|
||||
def test_policy_is_runtime_resolved(self) -> None:
|
||||
provider = _Policy()
|
||||
self.assertIsInstance(provider, DefinitionGovernancePolicy)
|
||||
registry = PlatformRegistry()
|
||||
registry.register(
|
||||
ModuleManifest(
|
||||
id="definition_governance_test",
|
||||
name="Definition governance test",
|
||||
version="test",
|
||||
capability_factories={
|
||||
CAPABILITY_POLICY_DEFINITION_GOVERNANCE: (
|
||||
lambda context: provider
|
||||
),
|
||||
},
|
||||
)
|
||||
)
|
||||
registry.configure_capability_context(
|
||||
ModuleContext(registry=registry, settings=object())
|
||||
)
|
||||
|
||||
resolved = definition_governance_policy(registry)
|
||||
self.assertIs(provider, resolved)
|
||||
decision = resolved.resolve_definition_action(
|
||||
request=DefinitionGovernanceRequest(
|
||||
module_id="dataflow",
|
||||
definition_ref="pipeline:1",
|
||||
tenant_id="tenant-1",
|
||||
definition_scope=DefinitionScopeRef(
|
||||
"tenant",
|
||||
"tenant-1",
|
||||
),
|
||||
target_scope=DefinitionScopeRef("tenant", "tenant-1"),
|
||||
definition_kind="template",
|
||||
action="run",
|
||||
actor=PrincipalRef(
|
||||
account_id="account-1",
|
||||
membership_id="membership-1",
|
||||
tenant_id="tenant-1",
|
||||
),
|
||||
)
|
||||
)
|
||||
self.assertFalse(decision.allowed)
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
unittest.main()
|
||||
Reference in New Issue
Block a user