test task submission authz

Author: tpoliaw

tests/unit_tests/service/test_authorization.py

@@ -8,9 +8,12 @@
 from blueapi.config import OIDCConfig, OpaConfig, ServiceAccount
 from blueapi.service.authorization import (
     OpaClient,
+    OpaUserClient,
     opa,
+    submit_permission,
     validate_tiled_config,
 )
+from blueapi.service.model import TaskRequest
 
 # Reusable client patch decorator
 patch_client_session = patch(
@@ -25,6 +28,7 @@ def opa_config() -> OpaConfig:
     return OpaConfig(
         root=HttpUrl("http://auth.example.com"),
         submit_task_check="/auth/submit",
+        admin_check="/auth/admin",
         tiled_service_account_check="/auth/tiled",
     )
 
@@ -108,6 +112,105 @@ async def test_opa_adds_input_fields(session: MagicMock, opa_config: OpaConfig):
     )
 
 
+@pytest.mark.parametrize(
+    "result,context",
+    [(True, nullcontext()), (False, pytest.raises(HTTPException, match="403"))],
+)
+@patch_client_session
+async def test_require_submit_task(
+    session: MagicMock,
+    opa_config: OpaConfig,
+    result: bool,
+    context: AbstractContextManager,
+):
+    session.return_value.post = AsyncMock(
+        return_value=MagicMock(json=AsyncMock(return_value={"result": result}))
+    )
+
+    client = OpaClient(instrument="p99", config=opa_config)
+
+    session.assert_called_once_with(base_url="http://auth.example.com/")
+    with context:
+        await client.require_submit_task(
+            instrument_session="cm12345-1", token="foo_bar"
+        )
+
+    session().post.assert_called_once_with(
+        "/auth/submit",
+        json={
+            "input": {
+                "token": "foo_bar",
+                "beamline": "p99",
+                "audience": "account",
+                "visit": 1,
+                "proposal": 12345,
+            }
+        },
+    )
+
+
+@patch_client_session
+async def test_opa_require_submit_task_invalid_session(
+    session: MagicMock, opa_config: OpaConfig
+):
+    client = OpaClient(instrument="p45", config=opa_config)
+
+    with pytest.raises(ValueError):
+        await client.require_submit_task(
+            instrument_session="not a session", token="foo_bar"
+        )
+
+
+@pytest.mark.parametrize("result", [True, False])
+@patch_client_session
+async def test_opa_is_admin(session: MagicMock, opa_config: OpaConfig, result: bool):
+    session.return_value.post = AsyncMock(
+        return_value=MagicMock(json=AsyncMock(return_value={"result": result}))
+    )
+    client = OpaClient(instrument="p45", config=opa_config)
+
+    admin = await client.is_admin("foo_bar")
+
+    assert admin == result
+
+    session().post.assert_called_once_with(
+        "/auth/admin",
+        json={"input": {"token": "foo_bar", "beamline": "p45", "audience": "account"}},
+    )
+
+
+@pytest.mark.parametrize(
+    "result,context",
+    [
+        (None, nullcontext()),
+        (HTTPException(status_code=403), pytest.raises(HTTPException, match="403")),
+    ],
+)
+async def test_user_client_can_submit_task(result, context: AbstractContextManager):
+    opa = MagicMock(spec=OpaUserClient)
+    opa.require_submit_task = AsyncMock(side_effect=result)
+
+    user_client = OpaUserClient(opa, "foo_bar")
+
+    with context:
+        await user_client.can_submit_task(
+            TaskRequest(name="foo", params={}, instrument_session="cm12345-1")
+        )
+    opa.require_submit_task.assert_called_once_with("cm12345-1", "foo_bar")
+
+
+@pytest.mark.parametrize("result", [True, False])
+async def test_user_client_admin(result: bool):
+    opa = MagicMock(spec=OpaUserClient)
+    opa.is_admin = AsyncMock(return_value=result)
+
+    user_client = OpaUserClient(opa, "foo_bar")
+
+    admin = await user_client.admin()
+
+    assert admin == result
+
+
 async def test_validate_tiled_config():
     opa = MagicMock(spec=OpaClient)
     tiled = ServiceAccount()
@@ -177,3 +280,21 @@ async def test_opa_dependency_without_authz(token):
     del request.app.state.authz
     user_client = await opa(request, token)
     assert user_client is None
+
+
+@pytest.mark.parametrize(
+    "result,context",
+    [
+        (None, nullcontext()),
+        (HTTPException(status_code=403), pytest.raises(HTTPException, match="403")),
+    ],
+)
+async def test_submit_permission_dependency(result, context: AbstractContextManager):
+    opa = MagicMock(spec=OpaUserClient)
+    opa.can_submit_task.side_effect = result
+    with context:
+        await submit_permission(opa, Mock())
+
+
+async def test_submit_permission_dependency_without_opa():
+    assert await submit_permission(None, Mock()) is None