test: add unit tests for role definitions retrieval with namespace wildcards

Author: BryanttV

openedx_authz/tests/api/test_roles.py

@@ -15,7 +15,6 @@
 
 from openedx_authz.api.data import (
     ActionData,
-    ContentLibraryData,
     PermissionData,
     RoleAssignmentData,
     RoleData,
@@ -43,6 +42,7 @@
 )
 from openedx_authz.constants import permissions, roles
 from openedx_authz.constants.roles import (
+    COURSE_AUDITOR_PERMISSIONS,
     LIBRARY_ADMIN_PERMISSIONS,
     LIBRARY_AUTHOR_PERMISSIONS,
     LIBRARY_CONTRIBUTOR_PERMISSIONS,
@@ -494,6 +494,59 @@ def test_get_permissions_for_active_role_in_specific_scope(self, role_name, scop
             expected_permissions,
         )
 
+    @ddt_data(
+        (
+            "lib^*",
+            {
+                roles.LIBRARY_ADMIN.external_key,
+                roles.LIBRARY_AUTHOR.external_key,
+                roles.LIBRARY_CONTRIBUTOR.external_key,
+                roles.LIBRARY_USER.external_key,
+            },
+            roles.LIBRARY_ADMIN.external_key,
+            LIBRARY_ADMIN_PERMISSIONS,
+        ),
+        (
+            "course-v1^*",
+            {
+                roles.COURSE_AUDITOR.external_key,
+                roles.COURSE_EDITOR.external_key,
+                roles.COURSE_STAFF.external_key,
+                roles.COURSE_ADMIN.external_key,
+                roles.COURSE_LIMITED_STAFF.external_key,
+                roles.COURSE_DATA_RESEARCHER.external_key,
+                roles.COURSE_BETA_TESTER.external_key,
+            },
+            roles.COURSE_AUDITOR.external_key,
+            COURSE_AUDITOR_PERMISSIONS,
+        ),
+    )
+    @unpack
+    def test_get_role_definitions_in_scope(
+        self,
+        namespaced_scope,
+        expected_roles,
+        sample_role,
+        expected_permissions,
+    ):
+        """Test retrieving role definitions from policy for a namespace wildcard scope.
+
+        Expected result:
+            - Role definitions defined in authz.policy for the scope are returned.
+            - Each role includes the permissions declared in its policy rules.
+        """
+        roles_in_scope = get_role_definitions_in_scope(ScopeData(namespaced_key=namespaced_scope))
+        roles_by_key = {role.external_key: role for role in roles_in_scope}
+
+        self.assertEqual(set(roles_by_key.keys()), expected_roles)
+        self.assertEqual(roles_by_key[sample_role].permissions, expected_permissions)
+
+    def test_get_role_definitions_in_scope_returns_empty_for_concrete_scope(self):
+        """Concrete scopes do not match namespace wildcard policy definitions."""
+        roles_in_scope = get_role_definitions_in_scope(ScopeData(external_key="lib:Org1:math_101"))
+
+        self.assertEqual(roles_in_scope, [])
+
     @ddt_data(
         ("alice", "lib:Org1:math_101", {roles.LIBRARY_ADMIN.external_key}),
         ("bob", "lib:Org1:history_201", {roles.LIBRARY_AUTHOR.external_key}),