user-engine/tests/test_verified_claims.py

import unittest

from user_engine.adapters import VerifiedIdentityClaimsAdapter
from user_engine.errors import ValidationError


class VerifiedIdentityClaimsAdapterTests(unittest.TestCase):
    def setUp(self):
        self.adapter = VerifiedIdentityClaimsAdapter(
            expected_issuer="https://kc.example",
            expected_audience="user-engine",
        )
        self.claims = {
            "iss": "https://kc.example/",
            "sub": "person-1",
            "aud": ["user-engine"],
            "tenant": "tenant:friendly:binky",
            "principal_type": "human",
            "roles": ["tenant-admin"],
        }

    def test_normalizes_verified_claims(self):
        actor = self.adapter.normalize(self.claims)
        self.assertEqual("person-1", actor.subject)
        self.assertEqual(("tenant-admin",), actor.roles)
        self.assertEqual((), actor.tenant_roles)

    def test_optional_tenant_roles_are_preserved_without_local_authorization(self):
        actor = self.adapter.normalize({**self.claims, "tenant_roles": ["CUS", "VEN"]})
        self.assertEqual(("CUS", "VEN"), actor.tenant_roles)
        self.assertEqual(("tenant-admin",), actor.roles)

    def test_rejects_wrong_issuer_and_audience(self):
        with self.assertRaises(ValidationError):
            self.adapter.normalize({**self.claims, "iss": "https://evil.example"})
        with self.assertRaises(ValidationError):
            self.adapter.normalize({**self.claims, "aud": ["other"]})