SameerMesiah97 commented on code in PR #74371:
URL: https://github.com/apache/airflow/pull/74371#discussion_r4200799992
##########
providers/keycloak/tests/unit/keycloak/auth_manager/cli/test_commands.py:
##########
@@ -585,22 +585,26 @@ def
test_create_permissions_attaches_default_role_policies(
decision_strategy="AFFIRMATIVE",
_dry_run=False,
)
- mock_attach_resource_policy.assert_any_call(
- client,
- "test-id",
- permission_name="User",
- policy_name="Allow-User",
- resource_names=["Dag", "Asset"],
- _dry_run=False,
- )
- mock_attach_resource_policy.assert_any_call(
- client,
- "test-id",
- permission_name="Op",
- policy_name="Allow-Op",
- resource_names=["Connection", "Pool", "Variable", "Backfill"],
- _dry_run=False,
- )
+ for role_name in ("User", "Op", "Admin"):
+ mock_attach_resource_policy.assert_any_call(
+ client,
+ "test-id",
+ permission_name="User",
+ policy_name=f"Allow-{role_name}",
+ resource_names=["Dag", "Asset"],
+ decision_strategy="AFFIRMATIVE",
+ _dry_run=False,
+ )
+ for role_name in ("Op", "Admin"):
+ mock_attach_resource_policy.assert_any_call(
+ client,
+ "test-id",
+ permission_name="Op",
+ policy_name=f"Allow-{role_name}",
+ resource_names=["Connection", "Pool", "Variable", "Backfill"],
+ decision_strategy="AFFIRMATIVE",
+ _dry_run=False,
+ )
Review Comment:
Not sure if the existing tests cover the enforcment of the permissions
hierarchy.
Could we add a parametrized test covering the different roles and their
expected access, including both positive and negative scenarios? For example,
User should satisfy the User permission but not Op or Admin, Op should satisfy
User and Op but not Admin, and Admin should satisfy all three.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
