Initial curated RAGcore source from c16667f0c9397e2bfc8dd0255b114fba23c8d05e

tests/security/oidc/test_role_mapping.py

@@ -0,0 +1,74 @@
+"""Role mapping is deny-by-default: unmapped groups grant nothing."""
+
+from __future__ import annotations
+
+from datetime import UTC, datetime, timedelta
+from uuid import uuid4
+
+import pytest
+
+from ragcore.application.authorization import AuthorizationService
+from ragcore.domain.auth import OidcClaims, Session, map_roles
+from ragcore.domain.authorization import Permission, PermissionDenied, Principal, PrincipalType
+from ragcore.domain.control import Role
+
+
+def test_recognized_groups_map_to_their_configured_role() -> None:
+    roles = map_roles(("ragcore-admins",), {"ragcore-admins": Role.PLATFORM_ADMIN})
+    assert roles == frozenset({Role.PLATFORM_ADMIN})
+
+
+def test_unrecognized_groups_grant_nothing() -> None:
+    roles = map_roles(("some-other-app-group",), {"ragcore-admins": Role.PLATFORM_ADMIN})
+    assert roles == frozenset()
+
+
+def test_no_groups_at_all_grants_nothing() -> None:
+    roles = map_roles((), {"ragcore-admins": Role.PLATFORM_ADMIN})
+    assert roles == frozenset()
+
+
+def test_mixed_recognized_and_unrecognized_groups_only_map_the_known_ones() -> None:
+    roles = map_roles(
+        ("ragcore-editors", "some-unrelated-group", "ragcore-viewers"),
+        {"ragcore-editors": Role.EDITOR, "ragcore-viewers": Role.VIEWER},
+    )
+    assert roles == frozenset({Role.EDITOR, Role.VIEWER})
+
+
+def test_oidc_claims_bounds_are_enforced() -> None:
+    with pytest.raises(ValueError, match="subject"):
+        OidcClaims(subject="", email=None, groups=())
+    with pytest.raises(ValueError, match="groups"):
+        OidcClaims(subject="alice", email=None, groups=tuple(f"g{i}" for i in range(101)))
+
+
+def test_a_session_with_no_mapped_roles_is_denied_everywhere() -> None:
+    """Ties role mapping's deny-by-default guarantee to the real, already-
+    established authorization system: an authenticated identity with an
+    empty roles set (because none of its groups were recognized) is denied
+    exactly like any other roleless principal -- there is no separate
+    "authenticated but unmapped" bypass anywhere in the authorization path.
+    """
+
+    workspace_id = uuid4()
+    claims = OidcClaims(subject="alice", email="alice@example.test", groups=("unmapped-group",))
+    roles = map_roles(claims.groups, {"ragcore-admins": Role.PLATFORM_ADMIN})
+    now = datetime.now(UTC)
+    session = Session(
+        id=uuid4(),
+        subject=claims.subject,
+        workspace_id=workspace_id,
+        issued_at=now,
+        expires_at=now + timedelta(hours=1),
+        csrf_token="a" * 32,
+        roles=roles,
+    )
+
+    assert session.roles == frozenset()
+
+    principal = Principal(uuid4(), workspace_id, PrincipalType.HUMAN, session.roles)
+    with pytest.raises(PermissionDenied):
+        AuthorizationService().authorize(
+            principal, Permission.SEARCH, resource_workspace_id=workspace_id
+        )