| 232 | |
| 233 | #[test] |
| 234 | fn thresholds() { |
| 235 | let config = RiskConfig { |
| 236 | allow_threshold: 0.1, |
| 237 | deny_threshold: 0.5, |
| 238 | ..Default::default() |
| 239 | }; |
| 240 | let scorer = RiskScorer::new(config); |
| 241 | let auth = crate::control::security::auth_context::AuthContext::from_identity( |
| 242 | &crate::control::security::identity::AuthenticatedIdentity { |
| 243 | user_id: 1, |
| 244 | username: "test".into(), |
| 245 | tenant_id: crate::types::TenantId::new(1), |
| 246 | auth_method: crate::control::security::identity::AuthMethod::ApiKey, |
| 247 | roles: vec![], |
| 248 | is_superuser: false, |
| 249 | default_database: None, |
| 250 | accessible_databases: crate::control::security::identity::DatabaseSet::Some( |
| 251 | smallvec::smallvec![nodedb_types::id::DatabaseId::DEFAULT], |
| 252 | ), |
| 253 | }, |
| 254 | "test".into(), |
| 255 | ); |
| 256 | |
| 257 | // First request: new_ip + device_not_trusted = 0.15 + 0.20 = 0.35 → StepUpMfa |
| 258 | let (_, decision, _) = scorer.score("u1", "10.0.0.1", &auth); |
| 259 | assert_eq!(decision, RiskDecision::StepUpMfa); |
| 260 | } |
| 261 | } |