65 lines
1.9 KiB
Python
65 lines
1.9 KiB
Python
from __future__ import annotations
|
|
|
|
import unittest
|
|
|
|
from fastapi import HTTPException
|
|
|
|
from govoplan_core.auth import ApiPrincipal
|
|
from govoplan_core.core.access import PrincipalRef
|
|
from govoplan_views.backend.router import (
|
|
_require_definition_read,
|
|
_require_definition_write,
|
|
)
|
|
|
|
|
|
def principal(
|
|
*,
|
|
account_id: str = "account-1",
|
|
scopes: tuple[str, ...],
|
|
group_ids: tuple[str, ...] = (),
|
|
) -> ApiPrincipal:
|
|
return ApiPrincipal(
|
|
principal=PrincipalRef(
|
|
account_id=account_id,
|
|
membership_id="membership-1",
|
|
tenant_id="tenant-1",
|
|
scopes=frozenset(scopes),
|
|
group_ids=frozenset(group_ids),
|
|
),
|
|
account=object(),
|
|
user=object(),
|
|
)
|
|
|
|
|
|
class ViewDefinitionAuthorizationTests(unittest.TestCase):
|
|
def test_personal_writer_cannot_edit_another_accounts_view(self) -> None:
|
|
actor = principal(scopes=("views:personal_definition:write",))
|
|
|
|
_require_definition_write(actor, "user", "account-1")
|
|
with self.assertRaises(HTTPException) as caught:
|
|
_require_definition_write(actor, "user", "account-2")
|
|
|
|
self.assertEqual(403, caught.exception.status_code)
|
|
|
|
def test_group_reader_is_limited_to_current_memberships(self) -> None:
|
|
actor = principal(
|
|
scopes=("views:group_definition:read",),
|
|
group_ids=("group-1",),
|
|
)
|
|
|
|
_require_definition_read(actor, "group", "group-1")
|
|
with self.assertRaises(HTTPException) as caught:
|
|
_require_definition_read(actor, "group", "group-2")
|
|
|
|
self.assertEqual(403, caught.exception.status_code)
|
|
|
|
def test_tenant_manager_can_manage_owned_views(self) -> None:
|
|
actor = principal(scopes=("views:definition:write",))
|
|
|
|
_require_definition_write(actor, "group", "group-2")
|
|
_require_definition_write(actor, "user", "account-2")
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|