coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

identity-provisioner: platform group boundary test without pytest
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Identity provider journey acceptance / provider (push) Successful in 11s
Details
Build and Publish identity-provisioner / build-and-push (push) Successful in 3s
Details

Browse source 
The journeys workflow runs unittest in python:3.12-slim, which has no pytest;
this module failed to import there since e861f63 (2026-10-14).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 308701@bnt-lap001
Assistant-Session: 5548e447-444c-4dcc-bed1-05c16eebfe56
This commit is contained in:
tegwick 2026-10-29 22:48:54 +01:00
parent c1bedf1a6e
commit 4261a5a4f8
1 changed files with 25 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

46
identity-provisioner/tests/test_platform_group_boundary.py
View file

@ -1,27 +1,31 @@
"""Service group operations must never reach platform IAM groups.""" """Service group operations must never reach platform IAM groups."""
import unittest
from unittest.mock import Mock from unittest.mock import Mock
import pytest
from provisioner import LLDAPProvisioner, dispatch from provisioner import LLDAPProvisioner, dispatch
@pytest.mark.parametrize("path", ["/v1/groups/ensure", "/v1/groups/revoke"]) class PlatformGroupBoundaryTests(unittest.TestCase):
@pytest.mark.parametrize("group", [ # Standard library only: the CI image (python:3.12-slim) has no pytest.
"net-kingdom-admins", "net-kingdom-users", "net-kingdom-future-role", def test_platform_groups_refused_before_directory_login(self):
]) for path in ("/v1/groups/ensure", "/v1/groups/revoke"):
def test_platform_groups_refused_before_directory_login(path, group): for group in ("net-kingdom-admins", "net-kingdom-users", "net-kingdom-future-role"):
provider = LLDAPProvisioner( with self.subTest(path=path, group=group):
base_url="https://directory.invalid", admin_password="synthetic-fixture", provider = LLDAPProvisioner(
) base_url="https://directory.invalid", admin_password="synthetic-fixture",
provider._login = Mock(side_effect=AssertionError("must not contact directory")) )
payload = { provider._login = Mock(side_effect=AssertionError("must not contact directory"))
"groups": ["activity-core-operators", group], payload = {
"members": {group: ["agent-codex"]}, "groups": ["activity-core-operators", group],
"idempotency_key": "platform-boundary-test", "members": {group: ["agent-codex"]},
"correlation_id": "source-test", "idempotency_key": "platform-boundary-test",
"delete_if_empty": True, "correlation_id": "source-test",
} "delete_if_empty": True,
with pytest.raises(ValueError, match="reserved"): }
dispatch(provider, path, payload) with self.assertRaisesRegex(ValueError, "reserved"):
provider._login.assert_not_called() dispatch(provider, path, payload)
provider._login.assert_not_called()
if __name__ == "__main__":
unittest.main()