DataOps-platform/tests/test_permission_matrix.py

def test_fixed_role_permission_matrix_is_monotonic():
    from app.core.system.permissions import ROLE_PERMISSIONS

    viewer = ROLE_PERMISSIONS["viewer"]
    editor = ROLE_PERMISSIONS["editor"]
    admin = ROLE_PERMISSIONS["admin"]

    assert viewer < editor < admin
    assert "governance:read" in viewer
    assert "governance:edit" in editor
    assert "users:manage" in admin
    assert "workflow:activate" in admin


def test_permissions_are_derived_server_side_from_roles():
    from app.core.system.permissions import permissions_for_roles

    permissions = permissions_for_roles(["viewer", "editor"])

    assert "governance:read" in permissions
    assert "governance:edit" in permissions
    assert "users:manage" not in permissions


def test_every_api_path_has_an_explicit_policy():
    from app import create_app
    from app.core.system.permissions import permission_for_request

    app = create_app()
    for rule in app.url_map.iter_rules():
        if not rule.rule.startswith("/api/"):
            continue
        for method in rule.methods - {"HEAD", "OPTIONS"}:
            assert permission_for_request(rule.rule, method) is not None, (
                method,
                rule.rule,
            )


def test_knowledge_search_and_ask_posts_are_read_only():
    from app.core.system.permissions import READ_GOVERNANCE, permission_for_request

    assert permission_for_request("/api/knowledge/search", "POST") == (
        READ_GOVERNANCE,
    )
    assert permission_for_request("/api/knowledge/ask", "POST") == (READ_GOVERNANCE,)


def test_knowledge_admin_routes_require_dedicated_manage_permission():
    from app.core.system.permissions import KNOWLEDGE_MANAGE, permission_for_request

    assert permission_for_request("/api/knowledge/admin/sync", "GET") == (
        KNOWLEDGE_MANAGE,
    )
    assert permission_for_request(
        "/api/knowledge/admin/change-sets/id/retry", "POST"
    ) == (KNOWLEDGE_MANAGE,)