tegwick
4261a5a4f8
All checks were successful
The journeys workflow runs unittest in python:3.12-slim, which has no pytest;
this module failed to import there since e861f63 (2026-10-14).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 308701@bnt-lap001
Assistant-Session: 5548e447-444c-4dcc-bed1-05c16eebfe56
31 lines
1.4 KiB
Python
31 lines
1.4 KiB
Python
"""Service group operations must never reach platform IAM groups."""
|
|
import unittest
|
|
from unittest.mock import Mock
|
|
|
|
from provisioner import LLDAPProvisioner, dispatch
|
|
|
|
|
|
class PlatformGroupBoundaryTests(unittest.TestCase):
|
|
# Standard library only: the CI image (python:3.12-slim) has no pytest.
|
|
def test_platform_groups_refused_before_directory_login(self):
|
|
for path in ("/v1/groups/ensure", "/v1/groups/revoke"):
|
|
for group in ("net-kingdom-admins", "net-kingdom-users", "net-kingdom-future-role"):
|
|
with self.subTest(path=path, group=group):
|
|
provider = LLDAPProvisioner(
|
|
base_url="https://directory.invalid", admin_password="synthetic-fixture",
|
|
)
|
|
provider._login = Mock(side_effect=AssertionError("must not contact directory"))
|
|
payload = {
|
|
"groups": ["activity-core-operators", group],
|
|
"members": {group: ["agent-codex"]},
|
|
"idempotency_key": "platform-boundary-test",
|
|
"correlation_id": "source-test",
|
|
"delete_if_empty": True,
|
|
}
|
|
with self.assertRaisesRegex(ValueError, "reserved"):
|
|
dispatch(provider, path, payload)
|
|
provider._login.assert_not_called()
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|