Spaces:
Runtime error
Runtime error
| from __future__ import annotations | |
| import unittest | |
| from app.security.context import AuthContext | |
| from app.security.errors import ForbiddenError | |
| from app.security.service import APIKeyService | |
| class SecurityRoleEnforcementTests(unittest.TestCase): | |
| def test_viewer_scope_is_enforced_by_authoritative_membership_role(self) -> None: | |
| context = AuthContext( | |
| api_key_id="key", | |
| key_name="Viewer Key", | |
| key_prefix="mp_test_viewer", | |
| environment="test", | |
| role="viewer", | |
| scopes=frozenset({"projects:read", "projects:write", "jobs:create"}), | |
| requests_per_minute=60, | |
| concurrent_jobs=1, | |
| uploads_per_hour=1, | |
| processing_bytes_per_day=1024, | |
| ) | |
| APIKeyService.authorize(context, "projects:read") | |
| APIKeyService.authorize(context, "jobs:read") | |
| with self.assertRaises(ForbiddenError): | |
| APIKeyService.authorize(context, "projects:write") | |
| with self.assertRaises(ForbiddenError): | |
| APIKeyService.authorize(context, "jobs:create") | |
| def test_explicit_scopes_still_bypass_role_when_authorized(self) -> None: | |
| context = AuthContext( | |
| api_key_id="key", | |
| key_name="Developer Key", | |
| key_prefix="mp_test_dev", | |
| environment="test", | |
| role="developer", | |
| scopes=frozenset({"projects:write", "jobs:create"}), | |
| requests_per_minute=60, | |
| concurrent_jobs=1, | |
| uploads_per_hour=1, | |
| processing_bytes_per_day=1024, | |
| ) | |
| APIKeyService.authorize(context, "projects:write") | |
| APIKeyService.authorize(context, "jobs:create") | |
| if __name__ == "__main__": | |
| unittest.main() | |