tegwick
e861f63513
Some checks failed
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a1346b-72a4-7d40-b8bd-8b8ca346cfa2
27 lines
1,019 B
Python
27 lines
1,019 B
Python
"""Service group operations must never reach platform IAM groups."""
|
|
from unittest.mock import Mock
|
|
|
|
import pytest
|
|
|
|
from provisioner import LLDAPProvisioner, dispatch
|
|
|
|
|
|
@pytest.mark.parametrize("path", ["/v1/groups/ensure", "/v1/groups/revoke"])
|
|
@pytest.mark.parametrize("group", [
|
|
"net-kingdom-admins", "net-kingdom-users", "net-kingdom-future-role",
|
|
])
|
|
def test_platform_groups_refused_before_directory_login(path, group):
|
|
provider = LLDAPProvisioner(
|
|
base_url="https://directory.invalid", admin_password="synthetic-fixture",
|
|
)
|
|
provider._login = Mock(side_effect=AssertionError("must not contact directory"))
|
|
payload = {
|
|
"groups": ["activity-core-operators", group],
|
|
"members": {group: ["agent-codex"]},
|
|
"idempotency_key": "platform-boundary-test",
|
|
"correlation_id": "source-test",
|
|
"delete_if_empty": True,
|
|
}
|
|
with pytest.raises(ValueError, match="reserved"):
|
|
dispatch(provider, path, payload)
|
|
provider._login.assert_not_called()
|