feat: classify audit evidence export scope

2026-08-20 18:00:18 +02:00
parent 6a2da94e47
commit 604f20eed7
3 changed files with 20 additions and 0 deletions
@@ -342,7 +342,25 @@ class ModuleSystemTests(unittest.TestCase):
        self.assertTrue(scopes_grant_compatible(["admin:users:read"], "access:membership:read"))
        self.assertTrue(scopes_grant_compatible(["access:tenant:read"], "system:tenants:read"))
        self.assertTrue(scopes_grant_compatible(["system:*"], "access:tenant:read"))
+        self.assertTrue(
+            scopes_grant_compatible(
+                ["system:*"],
+                "audit:system_evidence:export",
+            )
+        )
+        self.assertTrue(
+            scopes_grant_compatible(
+                ["system:audit:evidence:export"],
+                "audit:system_evidence:export",
+            )
+        )
        self.assertFalse(scopes_grant_compatible(["tenant:*"], "system:tenants:read"))
+        self.assertFalse(
+            scopes_grant_compatible(
+                ["tenant:*"],
+                "audit:system_evidence:export",
+            )
+        )
        self.assertFalse(scopes_grant_compatible(["tenant:*"], "access:tenant:read"))

    def test_core_webui_retired_legacy_admin_api_surface(self) -> None: