97 lines
3.2 KiB
Python
97 lines
3.2 KiB
Python
from __future__ import annotations
|
|
|
|
import unittest
|
|
|
|
from govoplan_core.core.automation import (
|
|
CAPABILITY_AUTH_AUTOMATION_PRINCIPAL_PROVIDER,
|
|
AutomationInvocation,
|
|
AutomationPrincipalProvider,
|
|
AutomationPrincipalRequest,
|
|
AutomationPrincipalResolution,
|
|
automation_principal_provider,
|
|
)
|
|
from govoplan_core.core.modules import ModuleContext, ModuleManifest
|
|
from govoplan_core.core.registry import PlatformRegistry
|
|
|
|
|
|
class _Provider:
|
|
def resolve_automation_principal(self, session, *, request):
|
|
del session
|
|
return AutomationPrincipalResolution(
|
|
allowed=True,
|
|
principal={"account_id": request.account_id},
|
|
granted_scopes=request.grant_scopes,
|
|
)
|
|
|
|
|
|
class AutomationContractTests(unittest.TestCase):
|
|
def test_principal_request_has_explicit_subject_contracts(self) -> None:
|
|
service = AutomationPrincipalRequest.service_account(
|
|
tenant_id="tenant-1",
|
|
service_account_id="service-1",
|
|
authorization_ref="trigger:1",
|
|
grant_scopes=("dataflow:pipeline:run",),
|
|
)
|
|
|
|
self.assertEqual("service_account", service.subject_kind)
|
|
self.assertEqual("service-1", service.service_account_id)
|
|
self.assertIsNone(service.account_id)
|
|
with self.assertRaisesRegex(
|
|
ValueError,
|
|
"Delegated-user automation",
|
|
):
|
|
AutomationPrincipalRequest(
|
|
tenant_id="tenant-1",
|
|
authorization_ref="trigger:1",
|
|
grant_scopes=("dataflow:pipeline:run",),
|
|
)
|
|
|
|
def test_invocation_records_stable_trigger_provenance(self) -> None:
|
|
invocation = AutomationInvocation(
|
|
kind="event",
|
|
trigger_ref="dataflow-trigger:1",
|
|
event_id="event-1",
|
|
event_type="files.uploaded",
|
|
)
|
|
|
|
self.assertEqual("event", invocation.kind)
|
|
self.assertEqual("event-1", invocation.event_id)
|
|
|
|
def test_principal_provider_is_runtime_resolved(self) -> None:
|
|
provider = _Provider()
|
|
self.assertIsInstance(provider, AutomationPrincipalProvider)
|
|
registry = PlatformRegistry()
|
|
registry.register(
|
|
ModuleManifest(
|
|
id="automation_contract_test",
|
|
name="Automation contract test",
|
|
version="test",
|
|
capability_factories={
|
|
CAPABILITY_AUTH_AUTOMATION_PRINCIPAL_PROVIDER: (
|
|
lambda context: provider
|
|
),
|
|
},
|
|
)
|
|
)
|
|
registry.configure_capability_context(
|
|
ModuleContext(registry=registry, settings=object())
|
|
)
|
|
|
|
self.assertIs(provider, automation_principal_provider(registry))
|
|
result = provider.resolve_automation_principal(
|
|
object(),
|
|
request=AutomationPrincipalRequest(
|
|
tenant_id="tenant-1",
|
|
account_id="account-1",
|
|
membership_id="membership-1",
|
|
authorization_ref="trigger:1",
|
|
grant_scopes=("dataflow:pipeline:run",),
|
|
),
|
|
)
|
|
self.assertTrue(result.allowed)
|
|
self.assertEqual(("dataflow:pipeline:run",), result.granted_scopes)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|