feat: govern selected-user access diagnostics

2026-08-20 06:16:43 +02:00
parent a8ec72d8a9
commit 8fcc12dbb2
4 changed files with 184 additions and 0 deletions
@@ -0,0 +1,63 @@
+from __future__ import annotations
+
+import unittest
+
+from govoplan_core.core.access import PrincipalRef
+from govoplan_policy.backend.access_explanation_subjects import (
+    ACCESS_EXPLANATION_SUBJECT_SCOPE,
+    AccessExplanationSubjectPolicyProvider,
+)
+
+
+class AccessExplanationSubjectPolicyTests(unittest.TestCase):
+    def setUp(self) -> None:
+        self.provider = AccessExplanationSubjectPolicyProvider()
+
+    def test_defaults_to_current_user_without_permission(self) -> None:
+        decision = self.provider.decide_subject_selection(
+            object(),
+            PrincipalRef(
+                account_id="account-1",
+                membership_id="user-1",
+                tenant_id="tenant-1",
+            ),
+            tenant_id="tenant-1",
+        )
+
+        self.assertFalse(decision.allow_other_users)
+        self.assertEqual(ACCESS_EXPLANATION_SUBJECT_SCOPE, decision.required_scope)
+        self.assertEqual("current_user", decision.provenance["mode"])
+
+    def test_permission_enables_cross_user_diagnostics(self) -> None:
+        decision = self.provider.decide_subject_selection(
+            object(),
+            PrincipalRef(
+                account_id="account-1",
+                membership_id="user-1",
+                tenant_id="tenant-1",
+                scopes=frozenset({ACCESS_EXPLANATION_SUBJECT_SCOPE}),
+            ),
+            tenant_id="tenant-1",
+        )
+
+        self.assertTrue(decision.allow_other_users)
+        self.assertEqual("cross_user", decision.provenance["mode"])
+
+    def test_never_crosses_the_active_tenant(self) -> None:
+        decision = self.provider.decide_subject_selection(
+            object(),
+            PrincipalRef(
+                account_id="account-1",
+                membership_id="user-1",
+                tenant_id="tenant-1",
+                scopes=frozenset({ACCESS_EXPLANATION_SUBJECT_SCOPE}),
+            ),
+            tenant_id="tenant-2",
+        )
+
+        self.assertFalse(decision.allow_other_users)
+        self.assertEqual("policy.tenant_boundary", decision.source)
+
+
+if __name__ == "__main__":
+    unittest.main()