bstein/ariadne
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

auth: allow account access without group claims

Browse Source
This commit is contained in:
Brad Stein 2026-01-23 16:51:00 -03:00
parent f7eca83ff0
commit cd7a5c66e0
2 changed files with 14 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
ariadne/app.py
View File

@ -129,6 +129,8 @@ def _require_admin(ctx: AuthContext) -> None:
def _require_account_access(ctx: AuthContext) -> None: def _require_account_access(ctx: AuthContext) -> None:
if not settings.account_allowed_groups: if not settings.account_allowed_groups:
return return
if not ctx.groups:
return
if set(ctx.groups).intersection(settings.account_allowed_groups): if set(ctx.groups).intersection(settings.account_allowed_groups):
return return
raise HTTPException(status_code=403, detail="forbidden") raise HTTPException(status_code=403, detail="forbidden")

13
tests/test_app.py
View File

@ -89,7 +89,7 @@ def test_forbidden_admin(monkeypatch) -> None:
def test_account_access_denied(monkeypatch) -> None: def test_account_access_denied(monkeypatch) -> None:
ctx = AuthContext(username="alice", email="", groups=[], claims={}) ctx = AuthContext(username="alice", email="", groups=["guest"], claims={})
client = _client(monkeypatch, ctx) client = _client(monkeypatch, ctx)
resp = client.post( resp = client.post(
@ -99,6 +99,17 @@ def test_account_access_denied(monkeypatch) -> None:
assert resp.status_code == 403 assert resp.status_code == 403
def test_account_access_allows_missing_groups(monkeypatch) -> None:
ctx = AuthContext(username="alice", email="", groups=[], claims={})
client = _client(monkeypatch, ctx)
resp = client.post(
"/api/account/firefly/reset",
headers={"Authorization": "Bearer token"},
)
assert resp.status_code != 403
def test_metrics_endpoint(monkeypatch) -> None: def test_metrics_endpoint(monkeypatch) -> None:
ctx = AuthContext(username="", email="", groups=[], claims={}) ctx = AuthContext(username="", email="", groups=[], claims={})
client = _client(monkeypatch, ctx) client = _client(monkeypatch, ctx)