64 lines
2.1 KiB
Python
64 lines
2.1 KiB
Python
from __future__ import annotations
|
|
|
|
import unittest
|
|
|
|
from govoplan_core.core.access import PrincipalRef
|
|
from govoplan_policy.backend.access_explanation_subjects import (
|
|
ACCESS_EXPLANATION_SUBJECT_SCOPE,
|
|
AccessExplanationSubjectPolicyProvider,
|
|
)
|
|
|
|
|
|
class AccessExplanationSubjectPolicyTests(unittest.TestCase):
|
|
def setUp(self) -> None:
|
|
self.provider = AccessExplanationSubjectPolicyProvider()
|
|
|
|
def test_defaults_to_current_user_without_permission(self) -> None:
|
|
decision = self.provider.decide_subject_selection(
|
|
object(),
|
|
PrincipalRef(
|
|
account_id="account-1",
|
|
membership_id="user-1",
|
|
tenant_id="tenant-1",
|
|
),
|
|
tenant_id="tenant-1",
|
|
)
|
|
|
|
self.assertFalse(decision.allow_other_users)
|
|
self.assertEqual(ACCESS_EXPLANATION_SUBJECT_SCOPE, decision.required_scope)
|
|
self.assertEqual("current_user", decision.provenance["mode"])
|
|
|
|
def test_permission_enables_cross_user_diagnostics(self) -> None:
|
|
decision = self.provider.decide_subject_selection(
|
|
object(),
|
|
PrincipalRef(
|
|
account_id="account-1",
|
|
membership_id="user-1",
|
|
tenant_id="tenant-1",
|
|
scopes=frozenset({ACCESS_EXPLANATION_SUBJECT_SCOPE}),
|
|
),
|
|
tenant_id="tenant-1",
|
|
)
|
|
|
|
self.assertTrue(decision.allow_other_users)
|
|
self.assertEqual("cross_user", decision.provenance["mode"])
|
|
|
|
def test_never_crosses_the_active_tenant(self) -> None:
|
|
decision = self.provider.decide_subject_selection(
|
|
object(),
|
|
PrincipalRef(
|
|
account_id="account-1",
|
|
membership_id="user-1",
|
|
tenant_id="tenant-1",
|
|
scopes=frozenset({ACCESS_EXPLANATION_SUBJECT_SCOPE}),
|
|
),
|
|
tenant_id="tenant-2",
|
|
)
|
|
|
|
self.assertFalse(decision.allow_other_users)
|
|
self.assertEqual("policy.tenant_boundary", decision.source)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|