Updated tests for this story

Author: Peibing Gu

backend-api/tests/conftest.py

@@ -42,6 +42,11 @@ def admin_user() -> User:
     return make_user(role=Role.ADMIN.value, user_id=2)
 
 
+@pytest.fixture
+def auditor_user() -> User:
+    return make_user(role=Role.AUDITOR.value, user_id=3)
+
+
 def _make_execute_result(items: list | None = None, single=None):
     result = MagicMock()
     scalars = MagicMock()

backend-api/tests/test_permissions.py

@@ -0,0 +1,85 @@
+"""Unit tests for RBAC permission dependencies."""
+
+import pytest
+from fastapi import HTTPException
+
+from app.core.permissions import (
+    RoleChecker,
+    require_admin,
+    require_auditor_or_above,
+    require_viewer_or_above,
+)
+from app.models.user import Role
+from tests.conftest import make_user
+
+
+def test_require_auditor_or_above_allows_admin():
+    user = make_user(role=Role.ADMIN.value)
+
+    result = require_auditor_or_above(user=user)
+
+    assert result is user
+
+
+def test_require_auditor_or_above_allows_auditor():
+    user = make_user(role=Role.AUDITOR.value)
+
+    result = require_auditor_or_above(user=user)
+
+    assert result is user
+
+
+def test_require_auditor_or_above_rejects_viewer():
+    user = make_user(role=Role.VIEWER.value)
+
+    with pytest.raises(HTTPException) as exc_info:
+        require_auditor_or_above(user=user)
+
+    assert exc_info.value.status_code == 403
+    assert exc_info.value.detail == "Auditor or Admin access required"
+
+
+def test_require_admin_allows_admin():
+    user = make_user(role=Role.ADMIN.value)
+
+    result = require_admin(user=user)
+
+    assert result is user
+
+
+def test_require_admin_rejects_auditor():
+    user = make_user(role=Role.AUDITOR.value)
+
+    with pytest.raises(HTTPException) as exc_info:
+        require_admin(user=user)
+
+    assert exc_info.value.status_code == 403
+    assert exc_info.value.detail == "Admin access required"
+
+
+def test_require_viewer_or_above_allows_viewer():
+    user = make_user(role=Role.VIEWER.value)
+
+    result = require_viewer_or_above(user=user)
+
+    assert result is user
+
+
+def test_role_checker_allows_listed_roles():
+    checker = RoleChecker([Role.ADMIN, Role.AUDITOR])
+    auditor = make_user(role=Role.AUDITOR.value)
+
+    result = checker(user=auditor)
+
+    assert result is auditor
+
+
+def test_role_checker_rejects_unlisted_role():
+    checker = RoleChecker([Role.ADMIN])
+    viewer = make_user(role=Role.VIEWER.value)
+
+    with pytest.raises(HTTPException) as exc_info:
+        checker(user=viewer)
+
+    assert exc_info.value.status_code == 403
+    assert "Insufficient permissions" in exc_info.value.detail

backend-api/tests/test_rbac_m365_connections.py

@@ -80,3 +80,19 @@ async def test_admin_passes_rbac_on_update_connection(client_factory, admin_user
         )
 
     assert response.status_code != 403
+
+
+@pytest.mark.asyncio
+async def test_auditor_passes_rbac_on_create_connection(client_factory, auditor_user):
+    async with client_factory(auditor_user) as client:
+        response = await client.post("/v1/m365-connections/", json=CONNECTION_CREATE_BODY)
+
+    assert response.status_code != 403
+
+
+@pytest.mark.asyncio
+async def test_auditor_passes_rbac_on_delete_connection(client_factory, auditor_user):
+    async with client_factory(auditor_user) as client:
+        response = await client.delete("/v1/m365-connections/1")
+
+    assert response.status_code != 403

backend-api/tests/test_rbac_scans.py

@@ -54,3 +54,19 @@ async def test_admin_passes_rbac_on_create_scan(client_factory, admin_user):
         response = await client.post("/v1/scans/", json=SCAN_CREATE_BODY)
 
     assert response.status_code != 403
+
+
+@pytest.mark.asyncio
+async def test_auditor_passes_rbac_on_create_scan(client_factory, auditor_user):
+    async with client_factory(auditor_user) as client:
+        response = await client.post("/v1/scans/", json=SCAN_CREATE_BODY)
+
+    assert response.status_code != 403
+
+
+@pytest.mark.asyncio
+async def test_auditor_passes_rbac_on_delete_scan(client_factory, auditor_user):
+    async with client_factory(auditor_user) as client:
+        response = await client.delete("/v1/scans/1")
+
+    assert response.status_code != 403