73 lines
3.1 KiB
Python
73 lines
3.1 KiB
Python
"""Yuanbao authorization-scope regression tests (#93522).
|
|
|
|
``dm_policy``/``group_policy``/allowlist reads and the ``AccessPolicy``
|
|
allow-all opt-in must honor the active profile secret scope under
|
|
multiplexing: a secondary profile's own scope is authoritative and must
|
|
not inherit the default profile's process-env authorization config.
|
|
"""
|
|
|
|
import pytest
|
|
|
|
from agent import secret_scope
|
|
from gateway.config import PlatformConfig
|
|
from gateway.platforms.yuanbao import AccessPolicy, YuanbaoAdapter
|
|
|
|
|
|
@pytest.fixture()
|
|
def multiplex_on():
|
|
previous = secret_scope.is_multiplex_active()
|
|
secret_scope.set_multiplex_active(True)
|
|
try:
|
|
yield
|
|
finally:
|
|
secret_scope.set_multiplex_active(previous)
|
|
|
|
|
|
class TestYuanbaoAdapterAuthzScope:
|
|
def test_scoped_construction_reads_authz_from_scope_not_environ(self, multiplex_on, monkeypatch):
|
|
monkeypatch.setenv("YUANBAO_DM_POLICY", "pairing")
|
|
monkeypatch.setenv("YUANBAO_DM_ALLOW_FROM", "default-user")
|
|
token = secret_scope.set_secret_scope(
|
|
{"YUANBAO_DM_POLICY": "allowlist", "YUANBAO_DM_ALLOW_FROM": "scoped-user"}
|
|
)
|
|
try:
|
|
adapter = YuanbaoAdapter(PlatformConfig(enabled=True))
|
|
finally:
|
|
secret_scope.reset_secret_scope(token)
|
|
assert adapter._access_policy._dm_policy == "allowlist"
|
|
assert adapter._access_policy._dm_allow_from == ["scoped-user"]
|
|
|
|
def test_scoped_miss_does_not_admit_default_profiles_allowlist(self, multiplex_on, monkeypatch):
|
|
monkeypatch.setenv("YUANBAO_DM_POLICY", "allowlist")
|
|
monkeypatch.setenv("YUANBAO_DM_ALLOW_FROM", "default-user")
|
|
token = secret_scope.set_secret_scope({"SOMETHING_ELSE": "x"})
|
|
try:
|
|
adapter = YuanbaoAdapter(PlatformConfig(enabled=True))
|
|
finally:
|
|
secret_scope.reset_secret_scope(token)
|
|
assert adapter._access_policy._dm_policy == "pairing"
|
|
assert adapter._access_policy._dm_allow_from == []
|
|
|
|
|
|
class TestYuanbaoAccessPolicyOpenDmOptIn:
|
|
def test_scoped_allow_all_admits(self, multiplex_on, monkeypatch):
|
|
monkeypatch.delenv("GATEWAY_ALLOW_ALL_USERS", raising=False)
|
|
monkeypatch.delenv("YUANBAO_ALLOW_ALL_USERS", raising=False)
|
|
policy = AccessPolicy(dm_policy="open", dm_allow_from=[], group_policy="pairing", group_allow_from=[])
|
|
token = secret_scope.set_secret_scope({"YUANBAO_ALLOW_ALL_USERS": "true"})
|
|
try:
|
|
assert policy._open_dm_opted_in() is True
|
|
finally:
|
|
secret_scope.reset_secret_scope(token)
|
|
|
|
def test_default_profiles_allow_all_does_not_leak_into_scoped_miss(self, multiplex_on, monkeypatch):
|
|
"""The default profile's env-only GATEWAY_ALLOW_ALL_USERS must not
|
|
admit a secondary profile that never opted in."""
|
|
monkeypatch.setenv("GATEWAY_ALLOW_ALL_USERS", "true")
|
|
policy = AccessPolicy(dm_policy="open", dm_allow_from=[], group_policy="pairing", group_allow_from=[])
|
|
token = secret_scope.set_secret_scope({"SOMETHING_ELSE": "x"})
|
|
try:
|
|
assert policy._open_dm_opted_in() is False
|
|
finally:
|
|
secret_scope.reset_secret_scope(token)
|