38 lines
1,011 B
Python
38 lines
1,011 B
Python
"""RBAC wiring invariants (Val 2).
|
|
|
|
Asserts that human-facing read routers carry the auth dependency, while the
|
|
service-to-service routers (config polling, ingest) stay open — breaking the
|
|
latter would cut config propagation / event ingestion to the AI services.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
from dashboard.api.routes import (
|
|
audit,
|
|
catalog,
|
|
config,
|
|
history,
|
|
ingest,
|
|
monitoring,
|
|
proxy,
|
|
stats,
|
|
)
|
|
|
|
|
|
def test_human_read_routers_are_protected():
|
|
for r in (
|
|
monitoring.router,
|
|
stats.router,
|
|
history.router,
|
|
audit.router,
|
|
proxy.router,
|
|
catalog.router,
|
|
):
|
|
assert len(r.dependencies) >= 1, "expected router-level auth dependency"
|
|
|
|
|
|
def test_service_routers_stay_open():
|
|
# config (polled by AI services) and ingest (service-to-service) must NOT
|
|
# gain router-level auth — that would break the platform.
|
|
assert len(config.router.dependencies) == 0
|
|
assert len(ingest.router.dependencies) == 0
|