Assembly Management Rework - Stage 5 & 6 Complete (Stage 4 Pending)

Data/Engine/tests/assemblies/test_permissions.py

@@ -0,0 +1,122 @@
+# ======================================================
+# Data\Engine\tests\assemblies\test_permissions.py
+# Description: Verifies Assembly API domain guards and Dev Mode permissions.
+#
+# API Endpoints (if applicable): None
+# ======================================================
+
+from __future__ import annotations
+
+import base64
+
+from flask.testing import FlaskClient
+
+from Data.Engine.assembly_management.models import AssemblyDomain
+
+from Data.Engine.Unit_Tests.conftest import EngineTestHarness
+
+
+def _script_document(name: str = "Permission Script") -> dict:
+    script = 'Write-Host "permissions"'
+    encoded = base64.b64encode(script.encode("utf-8")).decode("ascii")
+    return {
+        "version": 1,
+        "name": name,
+        "description": "Permission test script.",
+        "category": "script",
+        "type": "powershell",
+        "script": encoded,
+        "timeout_seconds": 60,
+        "sites": {"mode": "all", "values": []},
+        "variables": [],
+        "files": [],
+        "script_encoding": "base64",
+    }
+
+
+def _user_client(harness: EngineTestHarness) -> FlaskClient:
+    client = harness.app.test_client()
+    with client.session_transaction() as sess:
+        sess["username"] = "operator"
+        sess["role"] = "User"
+    return client
+
+
+def _admin_client(harness: EngineTestHarness) -> FlaskClient:
+    client = harness.app.test_client()
+    with client.session_transaction() as sess:
+        sess["username"] = "admin"
+        sess["role"] = "Admin"
+    return client
+
+
+def test_non_admin_cannot_write_official_domain(engine_harness: EngineTestHarness) -> None:
+    client = _user_client(engine_harness)
+    response = client.post(
+        "/api/assemblies",
+        json={
+            "domain": AssemblyDomain.OFFICIAL.value,
+            "assembly_kind": "script",
+            "display_name": "User Attempt",
+            "summary": "Should fail",
+            "category": "script",
+            "assembly_type": "powershell",
+            "version": 1,
+            "metadata": {},
+            "payload": _script_document("User Attempt"),
+        },
+    )
+    assert response.status_code == 403
+    payload = response.get_json()
+    assert payload["error"] == "forbidden"
+
+
+def test_admin_requires_dev_mode_for_official_mutation(engine_harness: EngineTestHarness) -> None:
+    client = _admin_client(engine_harness)
+    response = client.post(
+        "/api/assemblies",
+        json={
+            "domain": AssemblyDomain.OFFICIAL.value,
+            "assembly_kind": "script",
+            "display_name": "Dev Mode Required",
+            "summary": "Should request dev mode",
+            "category": "script",
+            "assembly_type": "powershell",
+            "version": 1,
+            "metadata": {},
+            "payload": _script_document("Dev Mode Required"),
+        },
+    )
+    assert response.status_code == 403
+    payload = response.get_json()
+    assert payload["error"] == "dev_mode_required"
+
+
+def test_admin_with_dev_mode_can_mutate_official(engine_harness: EngineTestHarness) -> None:
+    client = _admin_client(engine_harness)
+    response = client.post("/api/assemblies/dev-mode/switch", json={"enabled": True})
+    assert response.status_code == 200
+    assert response.get_json()["dev_mode"] is True
+
+    create_response = client.post(
+        "/api/assemblies",
+        json={
+            "domain": AssemblyDomain.OFFICIAL.value,
+            "assembly_kind": "script",
+            "display_name": "Official Dev Mode Script",
+            "summary": "Created while Dev Mode enabled",
+            "category": "script",
+            "assembly_type": "powershell",
+            "version": 1,
+            "metadata": {},
+            "payload": _script_document("Official Dev Mode Script"),
+        },
+    )
+    assert create_response.status_code == 201
+    record = create_response.get_json()
+    assert record["source"] == AssemblyDomain.OFFICIAL.value
+    assert record["is_dirty"] is True
+
+    flush_response = client.post("/api/assemblies/dev-mode/write")
+    assert flush_response.status_code == 200
+    assert flush_response.get_json()["status"] == "flushed"