chelsealong
d7e4204e77
WEIXIN_DM_POLICY/ALLOWED_USERS/GROUP_ALLOWED_USERS, YUANBAO's equivalents, WECOM_DM_POLICY/ALLOWED_USERS/GROUP_POLICY, and the startup guard's GATEWAY_ALLOW_ALL_USERS check still read raw os.getenv at adapter construction time. Under gateway.multiplex_profiles that reads the process env instead of the per-profile secret scope, so a secondary profile either silently drops every DM (its own env-only allowlist is invisible) or inherits the default profile's allow-all/allowlist config. Route these reads through the existing scoped helpers (_wx_secret, _get_scoped_secret, gateway.authz_mixin._platform_gate_env, and gateway.config._getenv) already used for the adjacent credential reads in the same adapters. Fixes #93522.
73 lines
3.1 KiB
Python
73 lines
3.1 KiB
Python
"""Yuanbao authorization-scope regression tests (#93522).
|
|
|
|
``dm_policy``/``group_policy``/allowlist reads and the ``AccessPolicy``
|
|
allow-all opt-in must honor the active profile secret scope under
|
|
multiplexing: a secondary profile's own scope is authoritative and must
|
|
not inherit the default profile's process-env authorization config.
|
|
"""
|
|
|
|
import pytest
|
|
|
|
from agent import secret_scope
|
|
from gateway.config import PlatformConfig
|
|
from gateway.platforms.yuanbao import AccessPolicy, YuanbaoAdapter
|
|
|
|
|
|
@pytest.fixture()
|
|
def multiplex_on():
|
|
previous = secret_scope.is_multiplex_active()
|
|
secret_scope.set_multiplex_active(True)
|
|
try:
|
|
yield
|
|
finally:
|
|
secret_scope.set_multiplex_active(previous)
|
|
|
|
|
|
class TestYuanbaoAdapterAuthzScope:
|
|
def test_scoped_construction_reads_authz_from_scope_not_environ(self, multiplex_on, monkeypatch):
|
|
monkeypatch.setenv("YUANBAO_DM_POLICY", "pairing")
|
|
monkeypatch.setenv("YUANBAO_DM_ALLOW_FROM", "default-user")
|
|
token = secret_scope.set_secret_scope(
|
|
{"YUANBAO_DM_POLICY": "allowlist", "YUANBAO_DM_ALLOW_FROM": "scoped-user"}
|
|
)
|
|
try:
|
|
adapter = YuanbaoAdapter(PlatformConfig(enabled=True))
|
|
finally:
|
|
secret_scope.reset_secret_scope(token)
|
|
assert adapter._access_policy._dm_policy == "allowlist"
|
|
assert adapter._access_policy._dm_allow_from == ["scoped-user"]
|
|
|
|
def test_scoped_miss_does_not_admit_default_profiles_allowlist(self, multiplex_on, monkeypatch):
|
|
monkeypatch.setenv("YUANBAO_DM_POLICY", "allowlist")
|
|
monkeypatch.setenv("YUANBAO_DM_ALLOW_FROM", "default-user")
|
|
token = secret_scope.set_secret_scope({"SOMETHING_ELSE": "x"})
|
|
try:
|
|
adapter = YuanbaoAdapter(PlatformConfig(enabled=True))
|
|
finally:
|
|
secret_scope.reset_secret_scope(token)
|
|
assert adapter._access_policy._dm_policy == "pairing"
|
|
assert adapter._access_policy._dm_allow_from == []
|
|
|
|
|
|
class TestYuanbaoAccessPolicyOpenDmOptIn:
|
|
def test_scoped_allow_all_admits(self, multiplex_on, monkeypatch):
|
|
monkeypatch.delenv("GATEWAY_ALLOW_ALL_USERS", raising=False)
|
|
monkeypatch.delenv("YUANBAO_ALLOW_ALL_USERS", raising=False)
|
|
policy = AccessPolicy(dm_policy="open", dm_allow_from=[], group_policy="pairing", group_allow_from=[])
|
|
token = secret_scope.set_secret_scope({"YUANBAO_ALLOW_ALL_USERS": "true"})
|
|
try:
|
|
assert policy._open_dm_opted_in() is True
|
|
finally:
|
|
secret_scope.reset_secret_scope(token)
|
|
|
|
def test_default_profiles_allow_all_does_not_leak_into_scoped_miss(self, multiplex_on, monkeypatch):
|
|
"""The default profile's env-only GATEWAY_ALLOW_ALL_USERS must not
|
|
admit a secondary profile that never opted in."""
|
|
monkeypatch.setenv("GATEWAY_ALLOW_ALL_USERS", "true")
|
|
policy = AccessPolicy(dm_policy="open", dm_allow_from=[], group_policy="pairing", group_allow_from=[])
|
|
token = secret_scope.set_secret_scope({"SOMETHING_ELSE": "x"})
|
|
try:
|
|
assert policy._open_dm_opted_in() is False
|
|
finally:
|
|
secret_scope.reset_secret_scope(token)
|