tegwick
44439f8d8d
Local + HTTP POST /v1/check PEP with fail-closed transport errors; shell:view enforced on /app/. Vocabulary docs for T07. Helm chart lives in railiance-apps; Dockerfile already present for T08.
62 lines
2 KiB
Python
62 lines
2 KiB
Python
import json
|
|
from unittest.mock import MagicMock, patch
|
|
|
|
from coulomb_social.apps.identity import flex_auth
|
|
|
|
|
|
def test_local_shell_view_allow():
|
|
d = flex_auth.check("shell:view", resource="shell", subject="s1")
|
|
assert d.allow is True
|
|
assert d.effect == "allow"
|
|
|
|
|
|
def test_local_member_self_read():
|
|
ok = flex_auth.check(
|
|
"member:self:read", resource="member", resource_id="sub-1", subject="sub-1"
|
|
)
|
|
assert ok.allow is True
|
|
bad = flex_auth.check(
|
|
"member:self:read", resource="member", resource_id="sub-1", subject="other"
|
|
)
|
|
assert bad.allow is False
|
|
|
|
|
|
def test_local_unknown_deny():
|
|
d = flex_auth.check("member:admin", resource="member", subject="s1")
|
|
assert d.allow is False
|
|
|
|
|
|
def test_http_allow(settings):
|
|
settings.FLEX_AUTH_BASE_URL = "http://flex.example"
|
|
settings.FLEX_AUTH_PROTECTED_SYSTEM_ID = "coulomb-social"
|
|
settings.DEFAULT_TENANT_ID = "tenant:coulomb"
|
|
settings.USER_ENGINE_APPLICATION_ID = "coulomb-social"
|
|
|
|
body = json.dumps({"id": "dec-1", "effect": "allow", "reason": "policy"}).encode()
|
|
mock_resp = MagicMock()
|
|
mock_resp.__enter__.return_value = mock_resp
|
|
mock_resp.__exit__.return_value = False
|
|
mock_resp.read.return_value = body
|
|
|
|
# json.load on response
|
|
import coulomb_social.apps.identity.flex_auth as mod
|
|
|
|
with patch.object(mod, "urlopen", return_value=mock_resp):
|
|
with patch.object(mod, "json") as j:
|
|
j.load.return_value = {"id": "dec-1", "effect": "allow", "reason": "policy"}
|
|
j.dumps = json.dumps
|
|
d = flex_auth.check("shell:view", subject="s1", tenant="tenant:coulomb")
|
|
assert d.allow is True
|
|
assert d.decision_id == "dec-1"
|
|
|
|
|
|
def test_http_fail_closed(settings):
|
|
settings.FLEX_AUTH_BASE_URL = "http://flex.example"
|
|
from urllib.error import URLError
|
|
|
|
import coulomb_social.apps.identity.flex_auth as mod
|
|
|
|
with patch.object(mod, "urlopen", side_effect=URLError("down")):
|
|
d = flex_auth.check("shell:view", subject="s1")
|
|
assert d.allow is False
|
|
assert "fail-closed" in d.reason
|