(self)
| 164 | """Test role-based access control.""" |
| 165 | |
| 166 | def test_admin_can_create_provider(self) -> None: |
| 167 | token = _get_token("admin@test", "admin", scopes="openid openshell:all") |
| 168 | stub, metadata = _stub_with_token(token) |
| 169 | req = openshell_pb2.CreateProviderRequest( |
| 170 | provider=datamodel_pb2.Provider( |
| 171 | name="e2e-oidc-admin-test", |
| 172 | type="claude", |
| 173 | credentials={"API_KEY": "test-value"}, |
| 174 | ) |
| 175 | ) |
| 176 | try: |
| 177 | stub.CreateProvider(req, metadata=metadata) |
| 178 | except grpc.RpcError as e: |
| 179 | if e.code() == grpc.StatusCode.ALREADY_EXISTS: |
| 180 | pass # fine, provider exists from a previous run |
| 181 | else: |
| 182 | raise |
| 183 | finally: |
| 184 | with contextlib.suppress(grpc.RpcError): |
| 185 | stub.DeleteProvider( |
| 186 | openshell_pb2.DeleteProviderRequest(name="e2e-oidc-admin-test"), |
| 187 | metadata=metadata, |
| 188 | ) |
| 189 | |
| 190 | def test_user_cannot_create_provider(self) -> None: |
| 191 | token = _get_token("user@test", "user", scopes="openid openshell:all") |
nothing calls this directly
no test coverage detected