Initial curated RAGcore source from c16667f0c9397e2bfc8dd0255b114fba23c8d05e

tests/unit/domain/control/test_entities.py

@@ -0,0 +1,75 @@
+"""Control-plane domain invariants."""
+
+from __future__ import annotations
+
+from uuid import uuid4
+
+import pytest
+
+from ragcore.domain.control import (
+    CrossWorkspaceRelationship,
+    InvalidEntity,
+    Role,
+    Scope,
+    Workspace,
+)
+
+
+def test_workspace_creates_typed_control_plane_entities() -> None:
+    workspace = Workspace(uuid4(), "Platform", "platform")
+    application = workspace.create_application(
+        id=uuid4(), name="Search client", scopes={Scope.SEARCH, Scope.DOCUMENTS_READ}
+    )
+    space = workspace.create_knowledge_space(
+        id=uuid4(), name="Runbooks", slug="runbooks", retention_days=30
+    )
+    service_account = application.create_service_account(
+        id=uuid4(), name="worker", scopes={Scope.SEARCH}
+    )
+    policy = workspace.create_policy(
+        id=uuid4(), operation="search", knowledge_space=space, required_scopes={Scope.SEARCH}
+    )
+    grant = workspace.grant(
+        id=uuid4(), application=application, knowledge_space=space, role=Role.VIEWER
+    )
+
+    assert application.workspace_id == workspace.id
+    assert service_account.application_id == application.id
+    assert service_account.workspace_id == workspace.id
+    assert policy.knowledge_space_id == space.id
+    assert grant.knowledge_space_id == space.id
+
+
+def test_service_account_cannot_escalate_application_scopes() -> None:
+    workspace = Workspace(uuid4(), "Platform", "platform")
+    application = workspace.create_application(id=uuid4(), name="Search", scopes={Scope.SEARCH})
+
+    with pytest.raises(InvalidEntity, match="scopes"):
+        application.create_service_account(
+            id=uuid4(), name="overreach", scopes={Scope.SEARCH, Scope.ANSWER}
+        )
+
+
+def test_cross_workspace_grant_is_rejected() -> None:
+    first = Workspace(uuid4(), "First", "first")
+    second = Workspace(uuid4(), "Second", "second")
+    application = first.create_application(id=uuid4(), name="Client", scopes={Scope.SEARCH})
+    space = second.create_knowledge_space(id=uuid4(), name="Private", slug="private")
+
+    with pytest.raises(CrossWorkspaceRelationship, match="same workspace"):
+        first.grant(id=uuid4(), application=application, knowledge_space=space, role=Role.VIEWER)
+
+
+@pytest.mark.parametrize("slug", ["Upper", "with space", "-leading", "trailing-"])
+def test_workspace_and_space_slugs_are_normalized_by_contract(slug: str) -> None:
+    with pytest.raises(InvalidEntity, match="slug"):
+        Workspace(uuid4(), "Invalid", slug)
+
+
+def test_retention_policy_must_be_positive() -> None:
+    workspace = Workspace(uuid4(), "Platform", "platform")
+
+    with pytest.raises(InvalidEntity, match="retention_days"):
+        workspace.create_knowledge_space(
+            id=uuid4(), name="Runbooks", slug="runbooks", retention_days=0
+        )