| import pytest |
| from fastapi import Depends, FastAPI |
| from fastapi.testclient import TestClient |
|
|
| from mathly2.access import GRANTABLE, PERMISSIONS, ROLES, allowed, need, permissions_of |
|
|
| KNOWN = set().union(*PERMISSIONS.values()) - {"*"} |
|
|
|
|
| def test_there_are_five_roles_and_developer_is_never_grantable(): |
| assert ROLES == ("student", "teacher", "manager", "admin", "developer") |
| assert "developer" not in GRANTABLE and set(GRANTABLE) < set(ROLES) |
|
|
|
|
| @pytest.mark.parametrize("role,yes,no", [ |
| ("student", {"path.use"}, {"class.teach", "class.roster", "classes.manage", "students.list", "roles.manage", "content.manage"}), |
| ("teacher", {"path.use", "class.teach", "class.roster"}, {"classes.manage", "students.list", "roles.manage", "content.manage"}), |
| ("manager", {"classes.manage", "class.roster", "students.list", "content.manage"}, {"path.use", "class.teach", "roles.manage"}), |
| ("admin", {"roles.manage"}, {"path.use", "class.teach", "class.roster", "classes.manage", "students.list", "content.manage"}), |
| ]) |
| def test_each_role_has_only_its_permissions(role, yes, no): |
| for permission in yes: |
| assert allowed([role], permission), (role, permission) |
| for permission in no: |
| assert not allowed([role], permission), (role, permission) |
|
|
|
|
| def test_developer_has_every_permission_even_ones_not_invented_yet(): |
| assert all(allowed(["developer"], p) for p in KNOWN | {"something.new"}) |
|
|
|
|
| def test_several_roles_add_up(): |
| assert permissions_of(["manager", "teacher"]) >= {"classes.manage", "class.teach", "path.use"} |
| assert not allowed([], "path.use") and permissions_of(["nonsense"]) == frozenset() |
|
|
|
|
| def test_manager_and_admin_see_no_learning_data(): |
| |
| for role in ("manager", "admin"): |
| assert not allowed([role], "path.use") and not allowed([role], "class.teach") |
|
|
|
|
| def test_need_refuses_a_missing_permission_with_403_and_a_missing_sign_in_with_401(): |
| from mathly2.auth import DevAuthenticator |
| app = FastAPI() |
| app.state.authenticator = DevAuthenticator() |
|
|
| class Roles: |
| def resolve(self, email, source=None): |
| return {"boss@x.test": frozenset({"manager"})}.get(email, frozenset({"student"})) |
| app.state.roles = Roles() |
|
|
| @app.get("/manage") |
| def manage(user: dict = Depends(need("classes.manage"))): |
| return {"ok": user["email"]} |
|
|
| client = TestClient(app) |
| assert client.get("/manage").status_code == 401 |
| assert client.get("/manage", headers={"Authorization": "Bearer dev:kid@x.test"}).status_code == 403 |
| assert client.get("/manage", headers={"Authorization": "Bearer dev:boss@x.test"}).json() == {"ok": "boss@x.test"} |
|
|
