Add permission-aware datasource search source

tests/test_search_source.py

@@ -0,0 +1,162 @@
+from __future__ import annotations
+
+from types import SimpleNamespace
+import unittest
+
+from sqlalchemy import create_engine
+from sqlalchemy.orm import Session
+
+from govoplan_core.auth import ApiPrincipal
+from govoplan_core.core.access import PrincipalRef
+from govoplan_core.core.search import (
+    SearchAuthorizationRequest,
+    SearchBackfillRequest,
+    SearchResourceReference,
+)
+from govoplan_core.db.base import Base
+from govoplan_datasources.backend.db.models import DatasourceRecord
+from govoplan_datasources.backend.manifest import get_manifest
+from govoplan_datasources.backend.search_source import (
+    DatasourcesSearchSource,
+    PROVIDER_ID,
+    RESOURCE_TYPE,
+)
+from govoplan_datasources.backend.service import ADMIN_SCOPE, CATALOGUE_READ_SCOPE
+
+
+class DatasourcesSearchSourceTests(unittest.TestCase):
+    def setUp(self) -> None:
+        self.engine = create_engine("sqlite://")
+        Base.metadata.create_all(
+            self.engine,
+            tables=(DatasourceRecord.__table__,),
+        )
+        self.session = Session(self.engine)
+        self.session.add_all(
+            (
+                _datasource("source-1", "tenant-1", "Monthly source"),
+                _datasource("source-other", "tenant-2", "Other tenant"),
+            )
+        )
+        self.session.commit()
+        self.source = DatasourcesSearchSource()
+
+    def tearDown(self) -> None:
+        self.session.close()
+        self.engine.dispose()
+
+    def test_manifest_registers_optional_search_source(self) -> None:
+        manifest = get_manifest()
+
+        self.assertIn("search", manifest.optional_dependencies)
+        self.assertIn(
+            PROVIDER_ID,
+            {registration.id for registration in manifest.search_sources},
+        )
+
+    def test_backfill_is_tenant_bound_and_excludes_protected_payloads(self) -> None:
+        page = self.source.backfill(
+            self.session,
+            request=SearchBackfillRequest(
+                tenant_id="tenant-1",
+                provider_id=PROVIDER_ID,
+                resource_type=RESOURCE_TYPE,
+                rebuild_id="rebuild-1",
+            ),
+        )
+
+        self.assertEqual(("source-1",), tuple(doc.resource_id for doc in page.documents))
+        document = page.documents[0]
+        serialized = repr(document)
+        self.assertNotIn("must-not-be-indexed", serialized)
+        self.assertNotIn("secret_field", serialized)
+        self.assertNotIn("credential-1", serialized)
+        self.assertTrue(document.requires_authorization_recheck)
+        self.assertEqual(
+            "/datasources?datasource=datasource%3Asource-1",
+            document.url,
+        )
+
+    def test_authorization_rechecks_scope_tenant_and_current_existence(self) -> None:
+        reference = SearchResourceReference(
+            tenant_id="tenant-1",
+            module_id="datasources",
+            resource_type=RESOURCE_TYPE,
+            resource_id="source-1",
+        )
+        request = SearchAuthorizationRequest(reference=reference, source_revision="1")
+
+        self.assertTrue(
+            self.source.authorize(
+                self.session,
+                _principal({CATALOGUE_READ_SCOPE}),
+                requests=(request,),
+            )[reference.key]
+        )
+        self.assertTrue(
+            self.source.authorize(
+                self.session,
+                _principal({ADMIN_SCOPE}),
+                requests=(request,),
+            )[reference.key]
+        )
+        self.assertFalse(
+            self.source.authorize(
+                self.session,
+                _principal(set()),
+                requests=(request,),
+            )[reference.key]
+        )
+        other_reference = SearchResourceReference(
+            tenant_id="tenant-2",
+            module_id="datasources",
+            resource_type=RESOURCE_TYPE,
+            resource_id="source-other",
+        )
+        other_request = SearchAuthorizationRequest(
+            reference=other_reference,
+            source_revision="1",
+        )
+        self.assertFalse(
+            self.source.authorize(
+                self.session,
+                _principal({CATALOGUE_READ_SCOPE}),
+                requests=(other_request,),
+            )[other_reference.key]
+        )
+
+
+def _datasource(identifier: str, tenant_id: str, name: str) -> DatasourceRecord:
+    return DatasourceRecord(
+        id=identifier,
+        tenant_id=tenant_id,
+        source_name=identifier.replace("-", "_"),
+        name=name,
+        description="Safe catalogue description",
+        kind="database",
+        mode="cached",
+        shape="tabular",
+        status="active",
+        provider="connectors.sql",
+        provider_ref="credential-1",
+        schema_=[{"name": "secret_field", "type": "string"}],
+        provenance_={"query": "must-not-be-indexed"},
+        metadata_={"password": "must-not-be-indexed"},
+    )
+
+
+def _principal(scopes: set[str]) -> ApiPrincipal:
+    return ApiPrincipal(
+        principal=PrincipalRef(
+            account_id="account-1",
+            membership_id="user-1",
+            tenant_id="tenant-1",
+            scopes=frozenset(scopes),
+        ),
+        account=SimpleNamespace(id="account-1"),
+        user=SimpleNamespace(id="user-1"),
+    )
+
+
+if __name__ == "__main__":
+    unittest.main()