Initial curated RAGcore source from c16667f0c9397e2bfc8dd0255b114fba23c8d05e

tests/security/authorization/test_policy_engine.py

@@ -0,0 +1,109 @@
+"""Negative and matrix tests for centralized authorization."""
+
+from __future__ import annotations
+
+from uuid import uuid4
+
+import pytest
+
+from ragcore.application.authorization import AuthorizationService
+from ragcore.domain.authorization import (
+    ROLE_PERMISSIONS,
+    Permission,
+    PermissionDenied,
+    Principal,
+    PrincipalType,
+    ResourceNotFound,
+)
+from ragcore.domain.control import Role
+
+
+def principal(*roles: Role, active: bool = True) -> Principal:
+    return Principal(uuid4(), uuid4(), PrincipalType.HUMAN, frozenset(roles), active)
+
+
+@pytest.mark.security
+def test_deny_by_default_for_empty_or_unknown_role_context() -> None:
+    service = AuthorizationService()
+    current = principal()
+
+    assert not service.can(current, Permission.SEARCH, resource_workspace_id=current.workspace_id)
+    with pytest.raises(PermissionDenied, match="permission denied"):
+        service.authorize(current, Permission.SEARCH, resource_workspace_id=current.workspace_id)
+
+
+@pytest.mark.security
+def test_role_permission_matrix_is_explicit() -> None:
+    assert ROLE_PERMISSIONS[Role.VIEWER] == frozenset({Permission.DOCUMENT_READ, Permission.SEARCH})
+    assert Permission.SOURCE_MANAGE in ROLE_PERMISSIONS[Role.EDITOR]
+    assert Permission.GRANT_MANAGE in ROLE_PERMISSIONS[Role.SPACE_MANAGER]
+    assert Permission.AUDIT_READ in ROLE_PERMISSIONS[Role.AUDITOR]
+    assert ROLE_PERMISSIONS[Role.PLATFORM_ADMIN] == frozenset(Permission)
+
+
+@pytest.mark.security
+def test_authorization_requires_active_principal_and_same_workspace() -> None:
+    service = AuthorizationService()
+    current = principal(Role.WORKSPACE_ADMIN)
+
+    assert service.can(
+        current, Permission.APPLICATION_MANAGE, resource_workspace_id=current.workspace_id
+    )
+    assert not service.can(current, Permission.APPLICATION_MANAGE, resource_workspace_id=uuid4())
+    assert not service.can(
+        principal(Role.WORKSPACE_ADMIN, active=False),
+        Permission.APPLICATION_MANAGE,
+        resource_workspace_id=current.workspace_id,
+    )
+
+
+@pytest.mark.security
+def test_hidden_resource_denial_does_not_leak_existence() -> None:
+    service = AuthorizationService()
+    viewer = principal(Role.VIEWER)
+
+    with pytest.raises(ResourceNotFound) as error:
+        service.authorize(
+            viewer, Permission.APPLICATION_MANAGE, resource_workspace_id=viewer.workspace_id
+        )
+    assert str(error.value) == "resource not found"
+    assert error.value.code == "RESOURCE_NOT_FOUND"
+
+
+@pytest.mark.security
+def test_resource_workspace_mismatch_is_hidden_when_requested() -> None:
+    service = AuthorizationService()
+    viewer = principal(Role.VIEWER)
+
+    with pytest.raises(ResourceNotFound):
+        service.authorize(
+            viewer,
+            Permission.DOCUMENT_READ,
+            resource_workspace_id=uuid4(),
+        )
+
+
+@pytest.mark.security
+def test_resource_workspace_context_is_mandatory_at_the_api_boundary() -> None:
+    service = AuthorizationService()
+    viewer = principal(Role.VIEWER)
+
+    with pytest.raises(TypeError):
+        service.authorize(viewer, Permission.SEARCH)  # type: ignore[call-arg]
+
+
+@pytest.mark.security
+def test_malformed_active_state_is_rejected_instead_of_treated_as_truthy() -> None:
+    with pytest.raises(ValueError, match="active state must be a boolean"):
+        Principal(uuid4(), uuid4(), PrincipalType.HUMAN, frozenset({Role.VIEWER}), "false")  # type: ignore[arg-type]
+
+
+@pytest.mark.security
+def test_action_denial_is_403_while_resource_denial_is_centrally_hidden() -> None:
+    service = AuthorizationService()
+    viewer = principal(Role.VIEWER)
+
+    with pytest.raises(PermissionDenied, match="permission denied"):
+        service.authorize(
+            viewer, Permission.ANSWER, resource_workspace_id=viewer.workspace_id
+        )