Lars
910b1d7e07
Some checks failed
Deploy Development / deploy (push) Successful in 33s
Test Suite / pytest-backend (push) Failing after 4s
Test Suite / k6 /api/health Baseline (push) Has been skipped
Test Suite / playwright-smoke (push) Has been skipped
Test Suite / lint-backend (push) Successful in 1s
Test Suite / compose-smoke (push) Has been skipped
Co-authored-by: Cursor <cursoragent@cursor.com>
64 lines
2.2 KiB
Python
64 lines
2.2 KiB
Python
"""Capability resolution and require_capability tests."""
|
|
|
|
from __future__ import annotations
|
|
|
|
from auth import AUTH_HEADER
|
|
from tests.factories import provision_user_in_tenant
|
|
|
|
|
|
@pytest.fixture()
|
|
def enforce_capabilities(monkeypatch):
|
|
monkeypatch.setenv("CAPABILITY_ENFORCE", "enforce")
|
|
|
|
|
|
def test_portal_admin_has_admin_capability(client, enforce_capabilities):
|
|
admin = provision_user_in_tenant(tenant_role="member", portal_role="admin")
|
|
login = client.post(
|
|
"/api/auth/login",
|
|
json={"email": admin["email"], "password": admin["password"]},
|
|
)
|
|
token = login.json()["token"]
|
|
|
|
res = client.get("/api/me/admin/demo", headers={AUTH_HEADER: token})
|
|
assert res.status_code == 200
|
|
assert res.json()["ok"] is True
|
|
|
|
|
|
def test_tenant_member_denied_admin_capability(client, enforce_capabilities):
|
|
member = provision_user_in_tenant(tenant_role="member", portal_role="user")
|
|
login = client.post(
|
|
"/api/auth/login",
|
|
json={"email": member["email"], "password": member["password"]},
|
|
)
|
|
token = login.json()["token"]
|
|
|
|
res = client.get("/api/me/admin/demo", headers={AUTH_HEADER: token})
|
|
assert res.status_code == 403
|
|
|
|
|
|
def test_tenant_owner_has_manage_capabilities(client, enforce_capabilities):
|
|
owner = provision_user_in_tenant(tenant_role="owner", portal_role="user")
|
|
login = client.post(
|
|
"/api/auth/login",
|
|
json={"email": owner["email"], "password": owner["password"]},
|
|
)
|
|
token = login.json()["token"]
|
|
ctx = client.get("/api/me/context", headers={AUTH_HEADER: token}).json()
|
|
|
|
assert "kairo.tenant.manage" in ctx["capabilities"]
|
|
assert "kairo.actor.manage" in ctx["capabilities"]
|
|
assert "kairo.admin.access" not in ctx["capabilities"]
|
|
|
|
|
|
def test_probe_mode_allows_without_capability(client, monkeypatch):
|
|
monkeypatch.setenv("CAPABILITY_ENFORCE", "probe")
|
|
member = provision_user_in_tenant(tenant_role="member", portal_role="user")
|
|
login = client.post(
|
|
"/api/auth/login",
|
|
json={"email": member["email"], "password": member["password"]},
|
|
)
|
|
token = login.json()["token"]
|
|
|
|
res = client.get("/api/me/admin/demo", headers={AUTH_HEADER: token})
|
|
assert res.status_code == 200
|