tegwick
f762161d84
IAM Profile v0.3 and Tenancy Posture v0.1 are now live on policy.coulomb.social. Close the portal expansion workplan against those documents, keep the flex-auth live A2 probe waiting, and forward optional tenant_roles to flex-auth without authorizing from them locally.
37 lines
1.5 KiB
Python
37 lines
1.5 KiB
Python
import unittest
|
|
|
|
from user_engine.adapters import VerifiedIdentityClaimsAdapter
|
|
from user_engine.errors import ValidationError
|
|
|
|
|
|
class VerifiedIdentityClaimsAdapterTests(unittest.TestCase):
|
|
def setUp(self):
|
|
self.adapter = VerifiedIdentityClaimsAdapter(
|
|
expected_issuer="https://kc.example",
|
|
expected_audience="user-engine",
|
|
)
|
|
self.claims = {
|
|
"iss": "https://kc.example/",
|
|
"sub": "person-1",
|
|
"aud": ["user-engine"],
|
|
"tenant": "tenant:friendly:binky",
|
|
"principal_type": "human",
|
|
"roles": ["tenant-admin"],
|
|
}
|
|
|
|
def test_normalizes_verified_claims(self):
|
|
actor = self.adapter.normalize(self.claims)
|
|
self.assertEqual("person-1", actor.subject)
|
|
self.assertEqual(("tenant-admin",), actor.roles)
|
|
self.assertEqual((), actor.tenant_roles)
|
|
|
|
def test_optional_tenant_roles_are_preserved_without_local_authorization(self):
|
|
actor = self.adapter.normalize({**self.claims, "tenant_roles": ["CUS", "VEN"]})
|
|
self.assertEqual(("CUS", "VEN"), actor.tenant_roles)
|
|
self.assertEqual(("tenant-admin",), actor.roles)
|
|
|
|
def test_rejects_wrong_issuer_and_audience(self):
|
|
with self.assertRaises(ValidationError):
|
|
self.adapter.normalize({**self.claims, "iss": "https://evil.example"})
|
|
with self.assertRaises(ValidationError):
|
|
self.adapter.normalize({**self.claims, "aud": ["other"]})
|