coulomb/tenant-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Implement TEN-WP-0011 security layer conformance
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 37s
Details

Browse source 
Engine/PIP declaration is now checkable (layer.yaml plus a Tooling-client
scan). Writes persist a decision record or the published fail-closed
stance, live-lookup freshness is published, events_for is tenant-scoped,
and mutation evidence drains to audit-core from a local outbox without
blocking the mutation.

Sender registration is requested as AUDIT-IN-0002. Boundary-contract
amendment is requested as NET-IN-0002.

Assistant: grok
Assistant-Session: 01a04cea-e5e8-7081-a0fc-808ebbc35fa9
This commit is contained in:
tegwick 2026-08-29 13:02:51 +02:00
parent 80961af91e
commit 672cf4da6e
40 changed files with 2285 additions and 361 deletions
Download patch file Download diff file Expand all files Collapse all files

25
tests/test_store.py
View file

@ -11,7 +11,9 @@ from tenant_engine.store import (
)
def _store_with_tenant(*, grouping: str = "friendly", name: str = "binky") -> tuple[InMemoryTenantStore, Tenant]:
def _store_with_tenant(
*, grouping: str = "friendly", name: str = "binky"
) -> tuple[InMemoryTenantStore, Tenant]:
store = InMemoryTenantStore()
tenant = Tenant.create(tenant_id=f"t-{name}", identifier=f"tenant:{grouping}:{name}")
store.create_tenant(tenant)
@ -93,15 +95,22 @@ def test_non_exclusive_roles_coexist() -> None:
)
)
assert store.active_roles(tenant.tenant_id) == frozenset({CapabilityRole.CUS, CapabilityRole.VEN})
assert store.active_roles(tenant.tenant_id) == frozenset(
{CapabilityRole.CUS, CapabilityRole.VEN}
)
def test_assign_plan() -> None:
store, tenant = _store_with_tenant()
store.assign_plan(PlanAssignment(tenant_id=tenant.tenant_id, plan_id="plan-x", assigned_at=datetime.now(UTC)))
store.assign_plan(
PlanAssignment(tenant_id=tenant.tenant_id, plan_id="plan-x", assigned_at=datetime.now(UTC))
)
events = store.events()
assert any(event.event_type == "plan_assigned" and event.payload["plan_id"] == "plan-x" for event in events)
events = store.events_for(tenant.tenant_id)
assert any(
event.event_type == "plan_assigned" and event.payload["plan_id"] == "plan-x"
for event in events
)
def test_get_tenant_resolves_by_identifier_not_only_internal_id() -> None:
@ -181,7 +190,9 @@ def test_every_mutation_emits_an_event() -> None:
)
store.grant_role(grant)
store.revoke_role(tenant_id=tenant.tenant_id, grant_id="g-1", at=datetime.now(UTC))
store.assign_plan(PlanAssignment(tenant_id=tenant.tenant_id, plan_id="plan-x", assigned_at=datetime.now(UTC)))
store.assign_plan(
PlanAssignment(tenant_id=tenant.tenant_id, plan_id="plan-x", assigned_at=datetime.now(UTC))
)
event_types = [event.event_type for event in store.events()]
event_types = [event.event_type for event in store.events_for(tenant.tenant_id)]
assert event_types == ["tenant_created", "role_granted", "role_revoked", "plan_assigned"]