Livrare LOT 1 - Didi

ai_platform/modules/dashboard/tests/test_rbac.py

@@ -0,0 +1,38 @@
+"""RBAC wiring invariants (Val 2).
+
+Asserts that human-facing read routers carry the auth dependency, while the
+service-to-service routers (config polling, ingest) stay open — breaking the
+latter would cut config propagation / event ingestion to the AI services.
+"""
+
+from __future__ import annotations
+
+from dashboard.api.routes import (
+    audit,
+    catalog,
+    config,
+    history,
+    ingest,
+    monitoring,
+    proxy,
+    stats,
+)
+
+
+def test_human_read_routers_are_protected():
+    for r in (
+        monitoring.router,
+        stats.router,
+        history.router,
+        audit.router,
+        proxy.router,
+        catalog.router,
+    ):
+        assert len(r.dependencies) >= 1, "expected router-level auth dependency"
+
+
+def test_service_routers_stay_open():
+    # config (polled by AI services) and ingest (service-to-service) must NOT
+    # gain router-level auth — that would break the platform.
+    assert len(config.router.dependencies) == 0
+    assert len(ingest.router.dependencies) == 0