Publish curated ITWorx-ModelForge source from 990401737f96c8d46a9f7b0d84994516cadcb6a0

backend/tests/test_operator_authorization.py

@@ -2,7 +2,7 @@ from __future__ import annotations
 
 import json
 import uuid
-from collections.abc import Callable, Iterator
+from collections.abc import Callable, Iterable, Iterator
 from dataclasses import dataclass
 from datetime import UTC, datetime
 from unittest.mock import Mock
@@ -31,10 +31,12 @@ from modelforge_api.api.authorization import (
 from modelforge_api.api.request_limits import MAX_CONSECUTIVE_EMPTY_REQUEST_EVENTS
 from modelforge_api.api.routes.acquisition import get_acquisition_service
 from modelforge_api.api.routes.agent import authenticated_node, get_agent_service
+from modelforge_api.api.routes.external_creative import creative_client
 from modelforge_api.api.routes.hardware import get_hardware_service
 from modelforge_api.api.routes.registry import get_registry_service
 from modelforge_api.api.routes.runtime import get_runtime_service
 from modelforge_api.api.routes.serving import (
+    authenticate_check_client,
     authenticate_document_ocr_client,
     authenticate_rag_embedding_client,
     authenticate_rag_reranking_client,
@@ -70,6 +72,19 @@ ALLOWED_ORIGIN = application_settings.cors_origin_list[0]
 DISALLOWED_ORIGIN = "https://not-allowed.invalid"
 
 
+def _api_routes(routes: Iterable[object]) -> Iterator[APIRoute]:
+    """Walk both flattened and FastAPI 0.141+ nested included-router inventories."""
+
+    for route in routes:
+        if isinstance(route, APIRoute):
+            yield route
+            continue
+        nested_owner = getattr(route, "original_router", route)
+        nested_routes = getattr(nested_owner, "routes", None)
+        if isinstance(nested_routes, list):
+            yield from _api_routes(nested_routes)
+
+
 @dataclass(frozen=True, slots=True)
 class MachineBoundaryHarness:
     settings: Settings
@@ -308,6 +323,7 @@ def operator_client() -> Iterator[TestClient]:
 
 
 TARGET_MUTATION_POLICIES = {
+    ("POST", "/api/v1/admin/operations/notifications/test"): "admin",
     # Acquisition: operators prepare and run work; approval is an administrative decision.
     ("POST", "/api/v1/discovery/search"): "operator",
     ("POST", "/api/v1/models/{model_id}/refresh-upstream"): "operator",
@@ -350,6 +366,7 @@ TARGET_MUTATION_POLICIES = {
 
 
 DEPENDENCY_POLICIES = {
+    authenticate_check_client: "capability_client",
     require_viewer: "viewer",
     require_operator: "operator",
     require_admin: "admin",
@@ -359,14 +376,17 @@ DEPENDENCY_POLICIES = {
     authenticate_document_ocr_client: "capability_client",
     authenticate_vision_embedding_client: "capability_client",
     authenticate_speech_transcription_client: "capability_client",
+    creative_client: "capability_client",
 }
 
 CAPABILITY_AUTHENTICATORS = {
+    authenticate_check_client,
     authenticate_rag_embedding_client,
     authenticate_rag_reranking_client,
     authenticate_document_ocr_client,
     authenticate_vision_embedding_client,
     authenticate_speech_transcription_client,
+    creative_client,
 }
 
 CAPABILITY_AUTHENTICATOR_SCOPES = {
@@ -375,9 +395,16 @@ CAPABILITY_AUTHENTICATOR_SCOPES = {
     authenticate_document_ocr_client: "document.ocr@1",
     authenticate_vision_embedding_client: "vision.embedding@1",
     authenticate_speech_transcription_client: "speech.transcription@1",
+    creative_client: "creative.resource@1",
 }
 
 EXPECTED_CAPABILITY_AUTHENTICATORS = {
+    ("GET", "/api/v1/selected-model-comparisons/assigned"): authenticate_rag_embedding_client,
+    **{("POST", f"/api/v1/selected-model-comparisons/{{comparison_id}}/{action}"): authenticate_rag_embedding_client
+       for action in ("claim", "progress", "result", "finish")},
+    **{("GET", f"/api/v1/capabilities/{capability}/check"): authenticate_check_client for capability in (
+        "rag.embedding@1", "rag.reranking@1", "document.ocr@1", "vision.embedding@1", "speech.transcription@1",
+    )},
     ("POST", "/api/v1/capabilities/rag.embedding@1/invoke"): authenticate_rag_embedding_client,
     ("POST", "/api/v1/capabilities/rag.reranking@1/invoke"): authenticate_rag_reranking_client,
     ("POST", "/api/v1/capabilities/document.ocr@1/invoke"): authenticate_document_ocr_client,
@@ -394,6 +421,13 @@ EXPECTED_CAPABILITY_AUTHENTICATORS = {
         "/api/v1/capability-experiments/{route_key}/invoke",
     ): authenticate_rag_embedding_client,
     ("POST", "/v1/embeddings"): authenticate_rag_embedding_client,
+    ("POST", "/api/v1/capabilities/creative.resource@1/allocations"): creative_client,
+    ("GET", "/api/v1/capabilities/creative.resource@1/allocations/{allocation_id}"): creative_client,
+    ("POST", "/api/v1/capabilities/creative.resource@1/allocations/{allocation_id}/heartbeat"): creative_client,
+    ("POST", "/api/v1/capabilities/creative.resource@1/allocations/{allocation_id}/attest"): creative_client,
+    ("POST", "/api/v1/capabilities/creative.resource@1/allocations/{allocation_id}/release"): creative_client,
+    ("POST", "/api/v1/capabilities/creative.resource@1/allocations/{allocation_id}/uncertain"): creative_client,
+    ("POST", "/api/v1/capabilities/creative.resource@1/profiles/observations"): creative_client,
 }
 
 
@@ -423,9 +457,7 @@ def route_policy(route: APIRoute, method: str) -> str | None:
 
 def test_every_route_has_one_explicit_access_policy() -> None:
     unclassified: list[tuple[str, str]] = []
-    for route in app.routes:
-        if not isinstance(route, APIRoute):
-            continue
+    for route in _api_routes(app.routes):
         for method in route.methods:
             if route_policy(route, method) is None:
                 unclassified.append((method, route.path))
@@ -434,9 +466,7 @@ def test_every_route_has_one_explicit_access_policy() -> None:
 
 def test_every_control_plane_route_has_an_explicit_human_role_dependency() -> None:
     missing: list[tuple[str, str]] = []
-    for route in app.routes:
-        if not isinstance(route, APIRoute):
-            continue
+    for route in _api_routes(app.routes):
         dependencies = {dependency.call for dependency in route.dependant.dependencies}
         for method in route.methods:
             if access_boundary_for_request(
@@ -451,11 +481,11 @@ def test_every_control_plane_route_has_an_explicit_human_role_dependency() -> No
 def test_only_contractual_routes_bypass_the_control_plane_boundary() -> None:
     boundaries = {
         (method, route.path): access_boundary_for_request(method, route.path)
-        for route in app.routes
-        if isinstance(route, APIRoute)
+        for route in _api_routes(app.routes)
         for method in route.methods
     }
     assert {key for key, boundary in boundaries.items() if boundary is AccessBoundary.PUBLIC} == {
+        ("POST", "/api/v1/operator/login"),
         ("GET", "/"),
         ("GET", "/api/v1/health/live"),
         ("GET", "/api/v1/health/ready"),
@@ -481,8 +511,14 @@ def test_only_contractual_routes_bypass_the_control_plane_boundary() -> None:
         ("GET", "/api/v1/agent/serving-jobs/next"),
         ("POST", "/api/v1/agent/serving-jobs/{job_id}/complete"),
         ("POST", "/api/v1/agent/serving-jobs/{job_id}/fail"),
+        ("POST", "/api/v1/agent/serving-jobs/{job_id}/cancellation"),
+        ("POST", "/api/v1/agent/serving-jobs/{job_id}/cancelled"),
         ("POST", "/api/v1/agent/serving-state"),
     }
+    for action in ("cancellation", "cancelled"):
+        assert access_boundary_for_request(
+            "POST", f"/api/v1/agent/serving-jobs/00000000-0000-0000-0000-000000000001/{action}"
+        ) is AccessBoundary.NODE
     assert {
         key for key, boundary in boundaries.items() if boundary is AccessBoundary.CAPABILITY_CLIENT
     } == set(EXPECTED_CAPABILITY_AUTHENTICATORS)
@@ -490,9 +526,7 @@ def test_only_contractual_routes_bypass_the_control_plane_boundary() -> None:
 
 def test_machine_routes_have_direct_authentication_dependency_evidence() -> None:
     missing: list[tuple[str, str, str]] = []
-    for route in app.routes:
-        if not isinstance(route, APIRoute):
-            continue
+    for route in _api_routes(app.routes):
         dependency_calls = {dependency.call for dependency in route.dependant.dependencies}
         for method in route.methods:
             boundary = access_boundary_for_request(method, route.path)
@@ -508,8 +542,7 @@ def test_machine_routes_have_direct_authentication_dependency_evidence() -> None
 def test_each_capability_route_authenticates_its_exact_required_scope() -> None:
     routes = {
         (method, route.path): route
-        for route in app.routes
-        if isinstance(route, APIRoute)
+        for route in _api_routes(app.routes)
         for method in route.methods
     }
     for key, expected_authenticator in EXPECTED_CAPABILITY_AUTHENTICATORS.items():
@@ -586,8 +619,7 @@ def test_interactive_api_schema_is_enabled_only_for_development() -> None:
 def test_audited_mutations_have_the_intended_operator_or_admin_policy() -> None:
     routes = {
         (method, route.path): route_policy(route, method)
-        for route in app.routes
-        if isinstance(route, APIRoute)
+        for route in _api_routes(app.routes)
         for method in route.methods
     }
     assert {key: routes[key] for key in TARGET_MUTATION_POLICIES} == TARGET_MUTATION_POLICIES