coulomb/user-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Adapt USER-WP-0021 and USER-WP-0023 to published policy-nexus contracts
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
Build and Publish Container Image / build-and-push (push) Successful in 1m1s
Details

Browse source 
IAM Profile v0.3 and Tenancy Posture v0.1 are now live on
policy.coulomb.social. Close the portal expansion workplan against those
documents, keep the flex-auth live A2 probe waiting, and forward optional
tenant_roles to flex-auth without authorizing from them locally.
This commit is contained in:
tegwick 2026-08-19 09:51:08 +02:00
parent 166788228d
commit f762161d84
13 changed files with 109 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

6
tests/test_verified_claims.py
View file

@ -23,6 +23,12 @@ class VerifiedIdentityClaimsAdapterTests(unittest.TestCase):
actor = self.adapter.normalize(self.claims)
self.assertEqual("person-1", actor.subject)
self.assertEqual(("tenant-admin",), actor.roles)
self.assertEqual((), actor.tenant_roles)
def test_optional_tenant_roles_are_preserved_without_local_authorization(self):
actor = self.adapter.normalize({**self.claims, "tenant_roles": ["CUS", "VEN"]})
self.assertEqual(("CUS", "VEN"), actor.tenant_roles)
self.assertEqual(("tenant-admin",), actor.roles)
def test_rejects_wrong_issuer_and_audience(self):
with self.assertRaises(ValidationError):