refactor(files): centralize connector visibility
This commit is contained in:
240
tests/test_connector_visibility.py
Normal file
240
tests/test_connector_visibility.py
Normal file
@@ -0,0 +1,240 @@
|
||||
from __future__ import annotations
|
||||
|
||||
import unittest
|
||||
from dataclasses import replace
|
||||
from unittest.mock import patch
|
||||
|
||||
from govoplan_files.backend.storage.connector_policy import ConnectorPolicySource
|
||||
from govoplan_files.backend.storage.connector_profiles import ConnectorProfile
|
||||
from govoplan_files.backend.storage.connector_visibility import (
|
||||
connector_profile_usable_for_import,
|
||||
visible_connector_profiles_for_actor,
|
||||
)
|
||||
|
||||
|
||||
def _profile(
|
||||
profile_id: str,
|
||||
*,
|
||||
scope_type: str = "system",
|
||||
scope_id: str | None = None,
|
||||
provider: str = "webdav",
|
||||
enabled: bool = True,
|
||||
) -> ConnectorProfile:
|
||||
return ConnectorProfile(
|
||||
id=profile_id,
|
||||
label=profile_id,
|
||||
provider=provider,
|
||||
scope_type=scope_type,
|
||||
scope_id=scope_id,
|
||||
endpoint_url=f"https://{profile_id}.example.invalid",
|
||||
enabled=enabled,
|
||||
credential_mode="anonymous",
|
||||
)
|
||||
|
||||
|
||||
class ConnectorVisibilityTests(unittest.TestCase):
|
||||
@patch(
|
||||
"govoplan_files.backend.storage.connector_visibility.effective_connector_policy_sources",
|
||||
return_value=[],
|
||||
)
|
||||
@patch(
|
||||
"govoplan_files.backend.storage.connector_visibility.connector_profiles_from_settings"
|
||||
)
|
||||
@patch(
|
||||
"govoplan_files.backend.storage.connector_visibility.list_database_connector_profiles"
|
||||
)
|
||||
def test_profiles_are_filtered_to_actor_scopes_and_database_definition_wins(
|
||||
self,
|
||||
database_profiles,
|
||||
configured_profiles,
|
||||
_policy_sources,
|
||||
) -> None:
|
||||
database_profiles.return_value = [
|
||||
_profile("system"),
|
||||
_profile("tenant", scope_type="tenant", scope_id="tenant-1"),
|
||||
_profile("other-tenant", scope_type="tenant", scope_id="tenant-2"),
|
||||
_profile("user", scope_type="user", scope_id="user-1"),
|
||||
_profile("other-user", scope_type="user", scope_id="user-2"),
|
||||
_profile("group", scope_type="group", scope_id="group-1"),
|
||||
_profile("campaign", scope_type="campaign", scope_id="campaign-1"),
|
||||
_profile("disabled", enabled=False),
|
||||
_profile("duplicate", provider="webdav"),
|
||||
]
|
||||
configured_profiles.return_value = [_profile("duplicate", provider="nextcloud")]
|
||||
|
||||
visible = visible_connector_profiles_for_actor(
|
||||
object(), # type: ignore[arg-type]
|
||||
tenant_id="tenant-1",
|
||||
user_id="user-1",
|
||||
group_ids={"group-1"},
|
||||
settings=object(),
|
||||
campaign_visible=lambda campaign_id: campaign_id == "campaign-1",
|
||||
)
|
||||
|
||||
self.assertEqual(
|
||||
{"system", "tenant", "user", "group", "campaign", "duplicate"},
|
||||
{profile.id for profile in visible},
|
||||
)
|
||||
duplicate = next(profile for profile in visible if profile.id == "duplicate")
|
||||
self.assertEqual("webdav", duplicate.provider)
|
||||
|
||||
@patch(
|
||||
"govoplan_files.backend.storage.connector_visibility.effective_connector_policy_sources",
|
||||
return_value=[],
|
||||
)
|
||||
@patch(
|
||||
"govoplan_files.backend.storage.connector_visibility.connector_profiles_from_settings",
|
||||
return_value=[],
|
||||
)
|
||||
@patch(
|
||||
"govoplan_files.backend.storage.connector_visibility.list_database_connector_profiles"
|
||||
)
|
||||
def test_campaign_and_admin_visibility_remain_explicit(
|
||||
self,
|
||||
database_profiles,
|
||||
_configured_profiles,
|
||||
_policy_sources,
|
||||
) -> None:
|
||||
database_profiles.return_value = [
|
||||
_profile("campaign-a", scope_type="campaign", scope_id="campaign-a"),
|
||||
_profile("campaign-b", scope_type="campaign", scope_id="campaign-b"),
|
||||
_profile("other-user", scope_type="user", scope_id="user-2"),
|
||||
]
|
||||
|
||||
campaign_only = visible_connector_profiles_for_actor(
|
||||
object(), # type: ignore[arg-type]
|
||||
tenant_id="tenant-1",
|
||||
user_id="user-1",
|
||||
group_ids=(),
|
||||
settings=None,
|
||||
campaign_id="campaign-a",
|
||||
campaign_visible=lambda _campaign_id: True,
|
||||
)
|
||||
self.assertEqual(["campaign-a"], [profile.id for profile in campaign_only])
|
||||
|
||||
admin = visible_connector_profiles_for_actor(
|
||||
object(), # type: ignore[arg-type]
|
||||
tenant_id="tenant-1",
|
||||
user_id="user-1",
|
||||
group_ids=(),
|
||||
settings=None,
|
||||
campaign_visible=None,
|
||||
include_admin_scopes=True,
|
||||
)
|
||||
self.assertEqual(
|
||||
{"campaign-a", "campaign-b", "other-user"},
|
||||
{profile.id for profile in admin},
|
||||
)
|
||||
|
||||
@patch(
|
||||
"govoplan_files.backend.storage.connector_visibility.connector_profiles_from_settings",
|
||||
return_value=[],
|
||||
)
|
||||
@patch(
|
||||
"govoplan_files.backend.storage.connector_visibility.list_database_connector_profiles"
|
||||
)
|
||||
@patch(
|
||||
"govoplan_files.backend.storage.connector_visibility.effective_connector_policy_sources"
|
||||
)
|
||||
def test_effective_policy_is_attached_without_mutating_profile(
|
||||
self,
|
||||
policy_sources,
|
||||
database_profiles,
|
||||
_configured_profiles,
|
||||
) -> None:
|
||||
profile = _profile("profile")
|
||||
source = ConnectorPolicySource(
|
||||
scope_type="system",
|
||||
label="System",
|
||||
policy={"allow": {"providers": ["webdav"]}},
|
||||
)
|
||||
database_profiles.return_value = [profile]
|
||||
policy_sources.return_value = [source]
|
||||
|
||||
visible = visible_connector_profiles_for_actor(
|
||||
object(), # type: ignore[arg-type]
|
||||
tenant_id="tenant-1",
|
||||
user_id="user-1",
|
||||
group_ids=(),
|
||||
settings=None,
|
||||
)
|
||||
|
||||
self.assertEqual((), profile.policy_sources)
|
||||
self.assertEqual((source,), visible[0].policy_sources)
|
||||
|
||||
def test_import_usability_requires_safe_provider_credentials_endpoint_and_identity_policy(
|
||||
self,
|
||||
) -> None:
|
||||
self.assertTrue(connector_profile_usable_for_import(_profile("webdav")))
|
||||
self.assertFalse(
|
||||
connector_profile_usable_for_import(_profile("s3", provider="s3"))
|
||||
)
|
||||
self.assertFalse(
|
||||
connector_profile_usable_for_import(_profile("smb", provider="smb"))
|
||||
)
|
||||
self.assertFalse(
|
||||
connector_profile_usable_for_import(
|
||||
_profile("sharepoint", provider="sharepoint")
|
||||
)
|
||||
)
|
||||
self.assertFalse(
|
||||
connector_profile_usable_for_import(
|
||||
ConnectorProfile(
|
||||
id="no-endpoint",
|
||||
label="No endpoint",
|
||||
provider="webdav",
|
||||
credential_mode="anonymous",
|
||||
)
|
||||
)
|
||||
)
|
||||
self.assertFalse(
|
||||
connector_profile_usable_for_import(
|
||||
ConnectorProfile(
|
||||
id="no-credentials",
|
||||
label="No credentials",
|
||||
provider="webdav",
|
||||
endpoint_url="https://files.example.invalid",
|
||||
credential_mode="basic",
|
||||
)
|
||||
)
|
||||
)
|
||||
|
||||
denied = replace(
|
||||
_profile("denied"),
|
||||
policy_sources=(
|
||||
ConnectorPolicySource(
|
||||
scope_type="system",
|
||||
label="System",
|
||||
policy={"deny": {"providers": ["webdav"]}},
|
||||
),
|
||||
),
|
||||
)
|
||||
self.assertFalse(connector_profile_usable_for_import(denied))
|
||||
|
||||
path_limited = replace(
|
||||
_profile("path-limited"),
|
||||
policy_sources=(
|
||||
ConnectorPolicySource(
|
||||
scope_type="system",
|
||||
label="System",
|
||||
policy={"allow": {"external_paths": ["/approved/*"]}},
|
||||
),
|
||||
),
|
||||
)
|
||||
self.assertFalse(connector_profile_usable_for_import(path_limited))
|
||||
|
||||
endpoint_allowed = replace(
|
||||
_profile("endpoint-allowed"),
|
||||
policy_sources=(
|
||||
ConnectorPolicySource(
|
||||
scope_type="system",
|
||||
label="System",
|
||||
policy={"allow": {"external_urls": ["https://*.example.invalid"]}},
|
||||
),
|
||||
),
|
||||
)
|
||||
self.assertTrue(connector_profile_usable_for_import(endpoint_allowed))
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
unittest.main()
|
||||
Reference in New Issue
Block a user