67 lines
1.9 KiB
Python
67 lines
1.9 KiB
Python
from __future__ import annotations
|
|
|
|
import unittest
|
|
|
|
from govoplan_files.backend.storage.connector_policy import (
|
|
ConnectorAccessRequest,
|
|
ConnectorPolicySource,
|
|
connector_policy_decision,
|
|
)
|
|
|
|
|
|
class ConnectorPolicyPatternTests(unittest.TestCase):
|
|
def test_resource_reference_allow_patterns_match(self) -> None:
|
|
decision = connector_policy_decision(
|
|
ConnectorAccessRequest(
|
|
connector_id="dev-smb",
|
|
credential_id="credential-primary",
|
|
provider="smb",
|
|
),
|
|
(
|
|
ConnectorPolicySource(
|
|
scope_type="tenant",
|
|
scope_id="tenant-1",
|
|
label="Tenant",
|
|
policy={
|
|
"allow": {
|
|
"connectors": ["dev-*"],
|
|
"credentials": ["credential-*"],
|
|
"providers": ["s?b"],
|
|
}
|
|
},
|
|
),
|
|
),
|
|
)
|
|
|
|
self.assertTrue(decision.allowed)
|
|
|
|
def test_resource_reference_deny_patterns_take_precedence(self) -> None:
|
|
decision = connector_policy_decision(
|
|
ConnectorAccessRequest(
|
|
connector_id="dev-smb",
|
|
credential_id="credential-legacy",
|
|
provider="smb",
|
|
),
|
|
(
|
|
ConnectorPolicySource(
|
|
scope_type="tenant",
|
|
scope_id="tenant-1",
|
|
label="Tenant",
|
|
policy={
|
|
"allow": {"connectors": ["dev-*"]},
|
|
"deny": {"credentials": ["*-legacy"]},
|
|
},
|
|
),
|
|
),
|
|
)
|
|
|
|
self.assertFalse(decision.allowed)
|
|
self.assertEqual(
|
|
("connector_policy_denylist",),
|
|
decision.requirements,
|
|
)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|