tests/test_security_role_enforcement.py

from __future__ import annotations

import unittest

from app.security.context import AuthContext
from app.security.errors import ForbiddenError
from app.security.service import APIKeyService


class SecurityRoleEnforcementTests(unittest.TestCase):
    def test_viewer_scope_is_enforced_by_authoritative_membership_role(self) -> None:
        context = AuthContext(
            api_key_id="key",
            key_name="Viewer Key",
            key_prefix="mp_test_viewer",
            environment="test",
            role="viewer",
            scopes=frozenset({"projects:read", "projects:write", "jobs:create"}),
            requests_per_minute=60,
            concurrent_jobs=1,
            uploads_per_hour=1,
            processing_bytes_per_day=1024,
        )

        APIKeyService.authorize(context, "projects:read")
        APIKeyService.authorize(context, "jobs:read")

        with self.assertRaises(ForbiddenError):
            APIKeyService.authorize(context, "projects:write")
        with self.assertRaises(ForbiddenError):
            APIKeyService.authorize(context, "jobs:create")

    def test_explicit_scopes_still_bypass_role_when_authorized(self) -> None:
        context = AuthContext(
            api_key_id="key",
            key_name="Developer Key",
            key_prefix="mp_test_dev",
            environment="test",
            role="developer",
            scopes=frozenset({"projects:write", "jobs:create"}),
            requests_per_minute=60,
            concurrent_jobs=1,
            uploads_per_hour=1,
            processing_bytes_per_day=1024,
        )

        APIKeyService.authorize(context, "projects:write")
        APIKeyService.authorize(context, "jobs:create")


if __name__ == "__main__":
    unittest.main()