| Age | Commit message (Collapse) | Author |
|---|
|
Update HTTP endpoint tests to use the new URL
POST /auth/system/administration/users/create
and the new mock path
gn_auth.auth.system.admin.users.require_oauth.acquire
Model-level tests (create_verified_user) are unchanged.
Reviewed-By: Frederick M. Muriith <fredmanglis@gmail.com>
|
|
Four tests covering the two new endpoints added in the previous commit:
POST /auth/system/administration/resources/<id>/assign-owner
POST /auth/system/administration/resources/<id>/revoke-owner
Tests:
- assign-owner returns 401 when no Authorization header is sent
- revoke-owner returns 401 when no Authorization header is sent
- assign-owner returns 403 for a user without system:resource:assign-owner
- revoke-owner returns 403 for a user without system:resource:assign-owner
The 401 tests exercise the @require_oauth decorator directly. The 403 tests
mock require_oauth.acquire (same pattern as test_admin_user_roles.py) and use
unaff@iliated.user (TEST_USERS[3]) who has no roles and therefore no
system:resource:assign-owner privilege on the system resource.
Reviewed-By: Frederick M. Muriithi <fredmanglis@gmail.com>
|
|
Four tests covering the revoke endpoint (401/403/200/DB removal).
Success tests pre-assign the role via _assign_target_role and use
try/finally with _cleanup_target_role to restore DB state.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
|
Checks resource:user:assign-role via can_assign_role (gn_libs.privileges.resources)
on the caller's roles for the request's resource_id — caller must hold
resource-owner (or masquerade as one) on that resource.
Updates test setup to grant resource-owner on SYSTEM_RESOURCE instead of
system-administrator, matching the actual privilege model.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Reviewed-By: Frederick M. Muriithi <fredmanglis@gmail.com>
|
|
Adds 200-status and DB-persistence checks. Both use try/finally to call
_revoke_assigned_role so the DB is left in the state the fixtures expect,
preventing surprises in teardown or future tests.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Reviewed-By: Frederick M. Muriithi <fredmanglis@gmail.com>
|
|
401 (no token) and 403 (non-admin token) — both expect 404 until the
stub endpoint is added.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Reviewed-By: Frederick M. Muriithi <fredmanglis@gmail.com>
|
|
Two TDD tests for the admin create-user endpoint success case:
- Valid admin token + valid body → 201
- Response body contains the new user's email and name
Both fail (501) until the endpoint body is implemented.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Reviewed-By: Frederick M. Muriithi <fredmanglis@gmail.com>
|
|
Two TDD tests that define the expected auth behaviour of the new
create-user endpoint before it is implemented:
- No Authorization header → 401
- Valid token for a non-admin user → 403
Both tests fail (404) until the endpoint exists.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Reviewed-By: Frederick M. Muriithi <fredmanglis@gmail.com>
Add's aso a dummy endpoint.
|
|
Two additional unit tests for create_verified_user:
* test_create_verified_user_stores_credentials — asserts a password
credential row is persisted in user_credentials after creation
* test_create_verified_user_raises_on_duplicate_email — asserts an
exception is raised when the same email is registered twice (enforced
by the UNIQUE constraint on users.email)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Reviewed-By: Frederick M. Muriithi <fredmanglis@gmail.com>
|
|
Two unit tests for the (not yet implemented) create_verified_user function
in gn_auth.auth.authorisation.users.admin.models:
* test_create_verified_user_sets_verified_flag — asserts user.verified is
True and the flag is persisted in the DB
* test_create_verified_user_has_no_roles — asserts no roles are assigned
to the newly created user
Both tests use conn_after_auth_migrations to run against a fully migrated
SQLite test database.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Reviewed-By: Frederick M. Muriithi <fredmanglis@gmail.com>
|
|
The startup checks should be used sparingly, if at all, and they
override every other setting.
|
|
In preparation for migrating to pyproject.toml (from setup.py and
friends) we need to have only one top-level package. This will also
help in improving testing and checks down the line, since everything
will be relative to one single top-level directory.
|
|
Return a count of the total number of resources that the user has
access to even if we are only interested in a few of the records.
|
|
|
|
|
|
|
|
|
|
|
|
In order to decouple the `create_resource` function from the related
functions that assign roles to users, this commit changes the code to
pass in a cursor rather than a connection.
The cursor will be the same cursor passed into the role assignment
functions ensuring that the resource creation and role assignment
happen in a single transaction.
|
|
|
|
|
|
Reorganise test fixtures to more closely follow the design of the auth
system.
Fix the broken tests due to refactors and fix all issues caught by the
running tests.
|
|
* Create a jwt token generator in place of a static token
* Update some fixtures
* Skip some tests that will require more work to fix
|
|
|
|
|
|
|
|
|
|
|
|
BCrypt has been superceded by argon, and this commit removes it and
all code depending on it from the repository.
|
|
Provide a new migration to create tables to handle the InbredSet
resources. The migration also sets up the resource category and the
related privileges.
|
|
* The system resource is public, and should be present for all users.
* Each user that is a member of a group, should have their group show
up in their list of resources.
* Fix the SQL join: add an `ON ...` clause.
|
|
|
|
With user groups being resources that users can act on (with the
recent changes), this commit moves the `groups` module to under the
`resources` module.
It also renames the `*_resources.py` modules by dropping the
`_resources` part since the code is under the `resources` module
anyway.
|
|
|
|
|
|
New table to link resources to groups, where relevant.
|
|
|
|
|
|
|
|
Change from gn3 to gn_auth
|
|
|
