@@ -71,9 +71,13 @@ def test_edit_can_disable_certificate(self):
7171
7272 def test_edit_can_re_enable_certificate (self ):
7373 with self .secured_document_store as store :
74+ # Use READ_WRITE rather than READ: a READ-only DatabaseAccess is
75+ # treated by the server as a "read-only certificate", which is a
76+ # licensed feature (AssertCanAddReadOnlyCertificates). This test
77+ # is about the disabled-flag round-trip, not permission levels.
7478 create_op = CreateClientCertificateOperation (
7579 "test-reenable-cert" ,
76- {"test_db" : DatabaseAccess .READ },
80+ {"test_db" : DatabaseAccess .READ_WRITE },
7781 SecurityClearance .VALID_USER ,
7882 )
7983 store .maintenance .server .send (create_op )
@@ -87,7 +91,7 @@ def test_edit_can_re_enable_certificate(self):
8791 EditClientCertificateOperation (
8892 EditClientCertificateOperation .Parameters (
8993 thumbprint = mine .thumbprint ,
90- permissions = {"test_db" : DatabaseAccess .READ },
94+ permissions = {"test_db" : DatabaseAccess .READ_WRITE },
9195 name = "test-reenable-cert" ,
9296 clearance = SecurityClearance .VALID_USER ,
9397 disabled = desired_state ,
0 commit comments