Skip to content

Commit 7169afa

Browse files
johntmyersjohntmyers
committed
test(e2e): migrate workspace request selectors
Signed-off-by: John Myers <[email protected]>
1 parent 89b2ea8 commit 7169afa

4 files changed

Lines changed: 281 additions & 87 deletions

File tree

‎e2e/python/oidc/oidc_auth_test.py‎

Lines changed: 49 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -51,11 +51,12 @@ def test_admin_can_create_provider(self) -> None:
5151
token = get_token("admin@test", "admin", scopes="openid openshell:all")
5252
stub, metadata = stub_with_token(token)
5353
req = openshell_pb2.CreateProviderRequest(
54+
workspace_scope=datamodel_pb2.WorkspaceSelector(workspace="default"),
5455
provider=datamodel_pb2.Provider(
5556
metadata=datamodel_pb2.ObjectMeta(name="e2e-oidc-admin-test"),
5657
type="claude",
5758
credentials={"ANTHROPIC_API_KEY": "test-value"},
58-
)
59+
),
5960
)
6061
try:
6162
stub.CreateProvider(req, metadata=metadata)
@@ -67,19 +68,25 @@ def test_admin_can_create_provider(self) -> None:
6768
finally:
6869
with contextlib.suppress(grpc.RpcError):
6970
stub.DeleteProvider(
70-
openshell_pb2.DeleteProviderRequest(name="e2e-oidc-admin-test"),
71+
openshell_pb2.DeleteProviderRequest(
72+
workspace_scope=datamodel_pb2.WorkspaceSelector(
73+
workspace="default"
74+
),
75+
name="e2e-oidc-admin-test",
76+
),
7177
metadata=metadata,
7278
)
7379

7480
def test_user_cannot_create_provider(self) -> None:
7581
token = get_token("user@test", "user", scopes="openid openshell:all")
7682
stub, metadata = stub_with_token(token)
7783
req = openshell_pb2.CreateProviderRequest(
84+
workspace_scope=datamodel_pb2.WorkspaceSelector(workspace="default"),
7885
provider=datamodel_pb2.Provider(
7986
metadata=datamodel_pb2.ObjectMeta(name="e2e-oidc-user-blocked"),
8087
type="claude",
8188
credentials={"ANTHROPIC_API_KEY": "test-value"},
82-
)
89+
),
8390
)
8491
with pytest.raises(grpc.RpcError) as exc_info:
8592
stub.CreateProvider(req, metadata=metadata)
@@ -103,7 +110,10 @@ def test_user_can_list_sandboxes(self) -> None:
103110
)
104111
try:
105112
user_stub.ListSandboxes(
106-
openshell_pb2.ListSandboxesRequest(), metadata=user_md
113+
openshell_pb2.ListSandboxesRequest(
114+
workspace_scope=datamodel_pb2.WorkspaceSelector(workspace="default")
115+
),
116+
metadata=user_md,
107117
)
108118
finally:
109119
with contextlib.suppress(grpc.RpcError):
@@ -118,7 +128,11 @@ def test_request_without_bearer_token_rejected(self) -> None:
118128
channel = grpc_channel()
119129
stub = openshell_pb2_grpc.OpenShellStub(channel)
120130
with pytest.raises(grpc.RpcError) as exc_info:
121-
stub.ListSandboxes(openshell_pb2.ListSandboxesRequest())
131+
stub.ListSandboxes(
132+
openshell_pb2.ListSandboxesRequest(
133+
workspace_scope=datamodel_pb2.WorkspaceSelector(workspace="default")
134+
)
135+
)
122136
assert exc_info.value.code() in (
123137
grpc.StatusCode.UNAUTHENTICATED,
124138
grpc.StatusCode.PERMISSION_DENIED,
@@ -151,29 +165,54 @@ def test_sandbox_scoped_token_can_list_sandboxes(self) -> None:
151165
"admin@test", "admin", scopes="openid sandbox:read sandbox:write"
152166
)
153167
stub, metadata = stub_with_token(token)
154-
stub.ListSandboxes(openshell_pb2.ListSandboxesRequest(), metadata=metadata)
168+
stub.ListSandboxes(
169+
openshell_pb2.ListSandboxesRequest(
170+
workspace_scope=datamodel_pb2.WorkspaceSelector(workspace="default")
171+
),
172+
metadata=metadata,
173+
)
155174

156175
def test_sandbox_scoped_token_cannot_list_providers(self) -> None:
157176
token = get_token(
158177
"admin@test", "admin", scopes="openid sandbox:read sandbox:write"
159178
)
160179
stub, metadata = stub_with_token(token)
161180
with pytest.raises(grpc.RpcError) as exc_info:
162-
stub.ListProviders(openshell_pb2.ListProvidersRequest(), metadata=metadata)
181+
stub.ListProviders(
182+
openshell_pb2.ListProvidersRequest(
183+
workspace_scope=datamodel_pb2.WorkspaceSelector(workspace="default")
184+
),
185+
metadata=metadata,
186+
)
163187
assert exc_info.value.code() == grpc.StatusCode.PERMISSION_DENIED
164188
assert "provider:read" in exc_info.value.details()
165189

166190
def test_openshell_all_grants_full_access(self) -> None:
167191
token = get_token("admin@test", "admin", scopes="openid openshell:all")
168192
stub, metadata = stub_with_token(token)
169-
stub.ListSandboxes(openshell_pb2.ListSandboxesRequest(), metadata=metadata)
170-
stub.ListProviders(openshell_pb2.ListProvidersRequest(), metadata=metadata)
193+
stub.ListSandboxes(
194+
openshell_pb2.ListSandboxesRequest(
195+
workspace_scope=datamodel_pb2.WorkspaceSelector(workspace="default")
196+
),
197+
metadata=metadata,
198+
)
199+
stub.ListProviders(
200+
openshell_pb2.ListProvidersRequest(
201+
workspace_scope=datamodel_pb2.WorkspaceSelector(workspace="default")
202+
),
203+
metadata=metadata,
204+
)
171205

172206
def test_no_openshell_scopes_denied(self) -> None:
173207
token = get_token("admin@test", "admin")
174208
stub, metadata = stub_with_token(token)
175209
with pytest.raises(grpc.RpcError) as exc_info:
176-
stub.ListSandboxes(openshell_pb2.ListSandboxesRequest(), metadata=metadata)
210+
stub.ListSandboxes(
211+
openshell_pb2.ListSandboxesRequest(
212+
workspace_scope=datamodel_pb2.WorkspaceSelector(workspace="default")
213+
),
214+
metadata=metadata,
215+
)
177216
assert exc_info.value.code() == grpc.StatusCode.PERMISSION_DENIED
178217

179218

0 commit comments

Comments
 (0)