Merge remote-tracking branch 'origin/enterprise' into fix/mssql-schema-case-sensitive

Author: testgen-ci-bot

testgen/mcp/tools/table_groups.py

@@ -18,7 +18,7 @@
 from testgen.common.models import with_database_session
 from testgen.common.models.connection import Connection
 from testgen.common.models.table_group import TableGroup
-from testgen.mcp.exceptions import MCPResourceNotAccessible, MCPUserError
+from testgen.mcp.exceptions import MCPPermissionDenied, MCPResourceNotAccessible, MCPUserError
 from testgen.mcp.permissions import get_project_permissions, mcp_permission
 from testgen.mcp.tools.common import (
     format_flavor_label,
@@ -33,6 +33,10 @@
 from testgen.utils import friendly_score
 
 _DUPLICATE_NAME_MESSAGE = "A Table Group with the same name already exists."
+_PII_FLAG_DENIED_MESSAGE = (
+    "Changing PII detection requires permission to view PII. "
+    "Leave this setting unchanged or contact your administrator."
+)
 _SCHEMA_LOCKED_MESSAGE = (
     "Schema cannot be changed once the table group has been used. "
     "Delete and recreate the table group to use a different schema."
@@ -402,6 +406,13 @@ def update_table_group(
     ):
         raise MCPUserError(_SCHEMA_LOCKED_MESSAGE)
 
+    if (
+        profile_flag_pii is not None
+        and profile_flag_pii != table_group.profile_flag_pii
+        and not get_project_permissions().has_permission("view_pii", table_group.project_code)
+    ):
+        raise MCPPermissionDenied(_PII_FLAG_DENIED_MESSAGE)
+
     before = _snapshot(table_group)
     _apply_args_to_table_group(table_group, **supplied)
 

testgen/ui/components/frontend/js/pages/table_group_list.js

@@ -120,6 +120,7 @@ const TableGroupList = (props) => {
                 connections: van.derive(() => getValue(props.edit_dialog)?.connections),
                 table_group: van.derive(() => getValue(props.edit_dialog)?.table_group),
                 is_in_use: van.derive(() => getValue(props.edit_dialog)?.is_in_use),
+                can_view_pii: van.derive(() => getValue(props.permissions)?.can_view_pii),
                 table_group_preview: van.derive(() => getValue(props.edit_dialog)?.table_group_preview),
                 result: van.derive(() => getValue(props.edit_dialog)?.result),
             }));

testgen/ui/static/js/components/table_group_edit_dialog.js

@@ -14,6 +14,7 @@
  * @property {Connection[]} connections
  * @property {TableGroup} table_group
  * @property {boolean} is_in_use
+ * @property {boolean?} can_view_pii
  * @property {TableGroupPreview?} table_group_preview
  * @property {EditResult?} result
  */
@@ -61,6 +62,7 @@ const TableGroupEditDialog = (props) => {
         showConnectionSelector: connections.length > 1,
         disableConnectionSelector: false,
         disableSchemaField: getValue(props.is_in_use) ?? false,
+        disablePiiFlag: !(getValue(props.can_view_pii) ?? false),
         onChange: (updatedTableGroup, state) => {
             tableGroupState.val = updatedTableGroup;
             formValid.val = state.valid;

testgen/ui/views/table_groups.py

@@ -539,10 +539,14 @@ def on_close_edit(_params: dict) -> None:
         is_in_use = TableGroup.is_in_use([table_group_id])
 
         edit_tg_data = get_edit_tg()
+        can_view_pii = session.auth.user_has_permission("view_pii")
         add_scorecard_definition = False
         for key, value in edit_tg_data.items():
             if key == "add_scorecard_definition":
                 add_scorecard_definition = value
+            elif key == "profile_flag_pii" and not can_view_pii:
+                # Users without view_pii cannot change the PII flag — keep the stored value.
+                continue
             else:
                 setattr(table_group, key, value)
 

tests/unit/mcp/conftest.py

@@ -5,12 +5,16 @@
 
 from testgen.mcp.permissions import set_mcp_token, set_mcp_username
 
-# Fictional role matrix for tests. role_a has full access, role_c is restricted.
+# Fictional role matrix for tests. role_a has full access (but NOT view_pii — several
+# tests rely on that to exercise the no-view_pii path), role_c is restricted, and
+# role_d holds edit + view_pii so deny/allow pairs can be distinguished against a real
+# ProjectPermissions without role_a accidentally granting view_pii.
 TEST_PERM_MATRIX = {
     "view": ["role_a", "role_b"],
     "catalog": ["role_a", "role_b", "role_c"],
-    "edit": ["role_a"],
+    "edit": ["role_a", "role_d"],
     "administer": ["role_a"],
+    "view_pii": ["role_d"],
 }
 
 

tests/unit/mcp/test_tools_table_groups.py

@@ -19,8 +19,9 @@
 # ---------------------------------------------------------------------------
 
 
-def _patch_perms(allowed=("demo",), memberships=None, permission="edit"):
-    memberships = memberships or dict.fromkeys(allowed, "role_a")
+def _patch_perms(allowed=("demo",), memberships=None, permission="edit", role="role_a"):
+    # role_a has edit but NOT view_pii; role_d has edit + view_pii (see conftest matrix).
+    memberships = memberships or dict.fromkeys(allowed, role)
     return patch(
         "testgen.mcp.permissions._compute_project_permissions",
         return_value=ProjectPermissions(
@@ -363,6 +364,34 @@ def test_create_table_group_requires_edit(db_session_mock):
         )
 
 
+# ---------------------------------------------------------------------------
+# create_table_group — PII flag is not gated on create
+# ---------------------------------------------------------------------------
+
+
+@patch(f"{MODULE}.TableGroup")
+@patch(f"{MODULE}.resolve_connection")
+def test_create_table_group_pii_on_allowed_without_view_pii(mock_resolve, mock_tg_cls, db_session_mock):
+    """A new table group has no manually-marked PII to overwrite, so creating with the
+    flag on is allowed even without view_pii — the gate applies only to editing it."""
+    mock_resolve.return_value = _mock_connection()
+    instance = _mock_table_group(profile_flag_pii=False)
+    mock_tg_cls.return_value = instance
+
+    from testgen.mcp.tools.table_groups import create_table_group
+
+    with _patch_perms():  # role_a: edit, no view_pii
+        create_table_group(
+            connection_id=42,
+            table_group_name="Sample TG",
+            schema="public",
+            profile_flag_pii=True,
+        )
+
+    instance.save.assert_called_once()
+    assert instance.profile_flag_pii is True
+
+
 # ---------------------------------------------------------------------------
 # update_table_group
 # ---------------------------------------------------------------------------
@@ -525,6 +554,85 @@ def test_update_table_group_delay_days_int_cast_to_str(mock_resolve, mock_tg_cls
     assert tg.profiling_delay_days == "3"
 
 
+# ---------------------------------------------------------------------------
+# update_table_group — PII flag gating (view_pii permission)
+# ---------------------------------------------------------------------------
+
+
+@patch(f"{MODULE}.TableGroup")
+@patch(f"{MODULE}.resolve_table_group")
+def test_update_table_group_enable_pii_denied_without_view_pii(mock_resolve, mock_tg_cls, db_session_mock):
+    """role_a has edit but not view_pii (real ProjectPermissions) — enabling PII is denied.
+
+    role_a *does* hold administer, so this also proves the gate checks view_pii
+    specifically, not some broader permission.
+    """
+    tg = _mock_table_group(profile_flag_pii=False)
+    mock_resolve.return_value = tg
+    mock_tg_cls.is_in_use.return_value = False
+
+    from testgen.mcp.tools.table_groups import update_table_group
+
+    with _patch_perms(role="role_a"), pytest.raises(MCPPermissionDenied):
+        update_table_group(table_group_id=str(tg.id), profile_flag_pii=True)
+    tg.save.assert_not_called()
+
+
+@patch(f"{MODULE}.TableGroup")
+@patch(f"{MODULE}.resolve_table_group")
+def test_update_table_group_disable_pii_denied_without_view_pii(mock_resolve, mock_tg_cls, db_session_mock):
+    """Change-detection mirrors the disabled checkbox — the value can't be touched either way."""
+    tg = _mock_table_group(profile_flag_pii=True)
+    mock_resolve.return_value = tg
+    mock_tg_cls.is_in_use.return_value = False
+
+    from testgen.mcp.tools.table_groups import update_table_group
+
+    with _patch_perms(role="role_a"), pytest.raises(MCPPermissionDenied):
+        update_table_group(table_group_id=str(tg.id), profile_flag_pii=False)
+    tg.save.assert_not_called()
+
+
+@patch(f"{MODULE}.TableGroup")
+@patch(f"{MODULE}.resolve_table_group")
+def test_update_table_group_unchanged_pii_allowed_without_view_pii(mock_resolve, mock_tg_cls, db_session_mock):
+    """Re-sending the current PII value (as the disabled UI checkbox does) is not a change."""
+    tg = _mock_table_group(profile_flag_pii=True, description=None)
+    mock_resolve.return_value = tg
+    mock_tg_cls.is_in_use.return_value = False
+
+    from testgen.mcp.tools.table_groups import update_table_group
+
+    with _patch_perms(role="role_a"):
+        out = update_table_group(
+            table_group_id=str(tg.id),
+            profile_flag_pii=True,
+            description="Edited elsewhere",
+        )
+
+    tg.save.assert_called_once()
+    assert tg.profile_flag_pii is True
+    assert "Description" in out
+
+
+@patch(f"{MODULE}.TableGroup")
+@patch(f"{MODULE}.resolve_table_group")
+def test_update_table_group_enable_pii_allowed_with_view_pii(mock_resolve, mock_tg_cls, db_session_mock):
+    """role_d holds edit + view_pii (real ProjectPermissions) — enabling PII is allowed."""
+    tg = _mock_table_group(profile_flag_pii=False)
+    mock_resolve.return_value = tg
+    mock_tg_cls.is_in_use.return_value = False
+
+    from testgen.mcp.tools.table_groups import update_table_group
+
+    with _patch_perms(role="role_d"):
+        out = update_table_group(table_group_id=str(tg.id), profile_flag_pii=True)
+
+    tg.save.assert_called_once()
+    assert tg.profile_flag_pii is True
+    assert "Flag PII" in out
+
+
 # ---------------------------------------------------------------------------
 # preview_table_group
 # ---------------------------------------------------------------------------