| Age | Commit message (Collapse) | Author |
|---|
|
Four tests covering the revoke endpoint (401/403/200/DB removal).
Success tests pre-assign the role via _assign_target_role and use
try/finally with _cleanup_target_role to restore DB state.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
|
Checks resource:user:assign-role via can_assign_role (gn_libs.privileges.resources)
on the caller's roles for the request's resource_id — caller must hold
resource-owner (or masquerade as one) on that resource.
Updates test setup to grant resource-owner on SYSTEM_RESOURCE instead of
system-administrator, matching the actual privilege model.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Reviewed-By: Frederick M. Muriithi <fredmanglis@gmail.com>
|
|
Adds 200-status and DB-persistence checks. Both use try/finally to call
_revoke_assigned_role so the DB is left in the state the fixtures expect,
preventing surprises in teardown or future tests.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Reviewed-By: Frederick M. Muriithi <fredmanglis@gmail.com>
|
|
401 (no token) and 403 (non-admin token) — both expect 404 until the
stub endpoint is added.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Reviewed-By: Frederick M. Muriithi <fredmanglis@gmail.com>
|
