PR13 — Add role-tier x service permission forwarding tests - #5
Merged
Merged
Conversation
Confirms Policy Engine receives the correct permissions/required_permission per role tier (Platform Admin/Org Admin/Scientist/Viewer) for each of the 5 SERVICE_MAP-mapped services, and X-Permissions varies correctly by tier. No functional code change -- gateway forwarding was already correct. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
No functional code change in this repo. This PR adds test coverage confirming the Gateway correctly forwards the right permissions and
required_permissionto the Policy Engine for every role tier in PR13's scenario matrix (Platform Admin, Org Admin, Scientist, Viewer) across all 5SERVICE_PERMISSION_MAP-mapped services (workbench, tes, toolserver, model-registry, rag).SERVICE_PERMISSION_MAP, header forwarding (X-Permissions, deliberately no roles header — matches PR13's "rely on permissions, not hardcoded roles" direction), andPolicyMiddleware's unconditional gating of all 5 services were already correct from PR12 — this PR proves it holds for the new dynamic role tiers specifically, rather than assuming it does.New file:
tests/test_pr13_role_tier_permission_forwarding.py— parametrized over 4 role tiers × 5 services (20 cases), asserting the exactpermissionslist andrequired_permissionvalue reachPolicyClient.evaluate, plus a follow-up confirmingX-Permissionsvaries correctly per tier for the two new PR13 default roles (scientist/viewer).Dependency
This PR is part of PR13 — Dynamic Enterprise RBAC Activation.
It must be reviewed and merged in dependency order with the other PR13 repositories.
Do not merge independently.
Dependency order: auth → policy-engine → api-gateway (this PR) → control-center → studio → docs.
Validation
Tests performed: 178 passed (full suite, including 25 new PR13 tests — 20 role-tier × service forwarding cases + 5
X-Permissionsvariation checks).Security checks: none required beyond the new coverage — this repo's authorization-relevant code (permission forwarding, header construction) is unchanged. Confirmed via test that no roles header is ever forwarded downstream (by design) and permissions are forwarded verbatim from the JWT, unmodified.
Compatibility notes: purely additive test file, zero production code touched. New tests mock
PolicyClient.evaluaterather than exercising real Policy Engine decision logic, matching this repo's existing test convention (the actual allow/deny decision is tested in and owned byomnibioai-policy-engine).Related PRs
Part of the PR13 review set, all on
feature/pr13-dynamic-rbac-activation:omnibioai-auth— PR #32 (draft, open)omnibioai-policy-engine— PR #2 (draft, open) — the enforcement fix this repo's forwarding feeds intoomnibioai-control-center— PR #20 (draft, open)omnibioai-studio— deployment runbook + smoke test exercising this end to endomnibioai-docs— architecture documentationReview only — do not merge. No migration applied, no deployment performed, live stack untouched.