DataOps-platform/tests/knowledge/test_access_context.py

from __future__ import annotations


class GrantSession:
    def __init__(self, domains):
        self.domains = domains

    def execute(self, _statement, _params):
        return self

    def scalars(self):
        return self

    def all(self):
        return self.domains


def test_viewer_access_context_uses_only_server_side_domain_grants():
    from app.core.knowledge.access import build_access_context

    context = build_access_context(
        GrantSession(["domain-a", "domain-b"]),
        identity={"id": "user-1", "roles": ["viewer"]},
        requested_business_domains=["domain-b", "domain-not-granted"],
        correlation_id="correlation-1",
    )

    assert context.business_domain_uids == frozenset({"domain-b"})
    assert context.permissions == frozenset({"governance:read"})


def test_admin_access_context_is_explicitly_global():
    from app.core.knowledge.access import build_access_context

    context = build_access_context(
        GrantSession([]),
        identity={"id": "admin-1", "roles": ["admin"]},
        requested_business_domains=None,
        correlation_id="correlation-2",
    )

    assert context.global_access is True
    assert context.business_domain_uids == frozenset()