+ tests

tests/unit/api/test_deps_helpers.py

@@ -0,0 +1,107 @@
+"""api.deps coverage — pure permission gate helpers."""
+
+from __future__ import annotations
+
+from uuid import uuid4
+
+import pytest
+from fastapi import HTTPException
+from roboco.api.deps import (
+    _role_value,
+    require_cell_access,
+    require_developer_or_above,
+    require_pm_or_above,
+)
+from roboco.models import AgentRole, Team
+from roboco.models.permissions import AgentContext
+
+
+def _ctx(role: AgentRole, team: Team | None = None) -> AgentContext:
+    return AgentContext(agent_id=uuid4(), role=role, team=team)
+
+
+# ---------------------------------------------------------------------------
+# _role_value
+# ---------------------------------------------------------------------------
+
+
+def test_role_value_extracts_enum_value() -> None:
+    assert _role_value(AgentRole.DEVELOPER) == "developer"
+
+
+def test_role_value_passes_through_string() -> None:
+    assert _role_value("developer") == "developer"
+
+
+# ---------------------------------------------------------------------------
+# require_pm_or_above
+# ---------------------------------------------------------------------------
+
+
+def test_require_pm_or_above_allows_cell_pm() -> None:
+    # No raise.
+    require_pm_or_above(AgentRole.CELL_PM, "do thing")
+
+
+def test_require_pm_or_above_allows_main_pm() -> None:
+    require_pm_or_above(AgentRole.MAIN_PM, "do thing")
+
+
+def test_require_pm_or_above_allows_ceo() -> None:
+    require_pm_or_above(AgentRole.CEO, "do thing")
+
+
+def test_require_pm_or_above_denies_developer() -> None:
+    with pytest.raises(HTTPException) as exc:
+        require_pm_or_above(AgentRole.DEVELOPER, "do thing")
+    assert exc.value.status_code == 403
+
+
+def test_require_pm_or_above_denies_qa() -> None:
+    with pytest.raises(HTTPException):
+        require_pm_or_above(AgentRole.QA, "do thing")
+
+
+# ---------------------------------------------------------------------------
+# require_developer_or_above
+# ---------------------------------------------------------------------------
+
+
+def test_require_developer_or_above_allows_developer() -> None:
+    require_developer_or_above(AgentRole.DEVELOPER, "do thing")
+
+
+def test_require_developer_or_above_allows_ceo() -> None:
+    require_developer_or_above(AgentRole.CEO, "do thing")
+
+
+def test_require_developer_or_above_denies_qa() -> None:
+    with pytest.raises(HTTPException):
+        require_developer_or_above(AgentRole.QA, "do thing")
+
+
+# ---------------------------------------------------------------------------
+# require_cell_access
+# ---------------------------------------------------------------------------
+
+
+def test_require_cell_access_allows_main_pm() -> None:
+    require_cell_access(_ctx(AgentRole.MAIN_PM), Team.BACKEND, "edit")
+
+
+def test_require_cell_access_allows_ceo_cross_cell() -> None:
+    require_cell_access(_ctx(AgentRole.CEO), Team.FRONTEND, "edit")
+
+
+def test_require_cell_access_allows_cell_member_in_own_team() -> None:
+    require_cell_access(
+        _ctx(AgentRole.DEVELOPER, team=Team.BACKEND), Team.BACKEND, "edit"
+    )
+
+
+def test_require_cell_access_denies_cross_cell_for_member() -> None:
+    with pytest.raises(HTTPException) as exc:
+        require_cell_access(
+            _ctx(AgentRole.DEVELOPER, team=Team.BACKEND), Team.FRONTEND, "edit"
+        )
+    assert exc.value.status_code == 403

tests/unit/api/test_middleware_docs.py

@@ -0,0 +1,181 @@
+"""api.middleware_docs coverage — pure-function path-permission checks."""
+
+from __future__ import annotations
+
+import pytest
+from roboco.api.middleware_docs import (
+    _agent_matches_permission,
+    _normalize_path,
+    _strip_path_prefixes,
+    check_docs_access,
+    get_allowed_docs_paths,
+    require_docs_access,
+)
+from roboco.exceptions import PermissionDeniedError
+
+
+# ---------------------------------------------------------------------------
+# _strip_path_prefixes
+# ---------------------------------------------------------------------------
+
+
+def test_strip_strips_leading_slashes() -> None:
+    assert _strip_path_prefixes("/foo/bar") == "foo/bar"
+
+
+def test_strip_strips_app_prefix() -> None:
+    assert _strip_path_prefixes("app/docs/foo") == "foo"
+
+
+def test_strip_strips_docs_prefix() -> None:
+    assert _strip_path_prefixes("docs/standards/python.md") == "standards/python.md"
+
+
+def test_strip_handles_no_prefix() -> None:
+    assert _strip_path_prefixes("standards/python.md") == "standards/python.md"
+
+
+# ---------------------------------------------------------------------------
+# _normalize_path
+# ---------------------------------------------------------------------------
+
+
+def test_normalize_extracts_top_dir() -> None:
+    assert _normalize_path("/app/docs/backend/api/README.md") == "backend"
+
+
+def test_normalize_keeps_features_subdir() -> None:
+    assert _normalize_path("docs/features/shared/foo.md") == "features/shared"
+
+
+def test_normalize_keeps_bugs_subdir() -> None:
+    assert _normalize_path("docs/bugs/backend/issue.md") == "bugs/backend"
+
+
+def test_normalize_empty_path() -> None:
+    assert _normalize_path("") == ""
+
+
+# ---------------------------------------------------------------------------
+# _agent_matches_permission
+# ---------------------------------------------------------------------------
+
+
+def test_agent_matches_wildcard() -> None:
+    assert _agent_matches_permission("be-dev-1", "developer", "backend", "*")
+
+
+def test_agent_matches_slug() -> None:
+    assert _agent_matches_permission("be-doc", "documenter", "backend", "be-doc")
+
+
+def test_agent_matches_role() -> None:
+    assert _agent_matches_permission(
+        "be-pm", "cell_pm", "backend", "cell_pm"
+    )
+
+
+def test_agent_matches_team() -> None:
+    assert _agent_matches_permission(
+        "be-dev-1", "developer", "backend", "team:backend"
+    )
+
+
+def test_agent_does_not_match_different_team() -> None:
+    assert not _agent_matches_permission(
+        "be-dev-1", "developer", "backend", "team:frontend"
+    )
+
+
+def test_agent_does_not_match_unknown_permission() -> None:
+    assert not _agent_matches_permission(
+        "be-dev-1", "developer", "backend", "ghost-perm"
+    )
+
+
+# ---------------------------------------------------------------------------
+# check_docs_access
+# ---------------------------------------------------------------------------
+
+
+def test_ceo_full_access() -> None:
+    """CEO can access anything."""
+    assert check_docs_access("ceo", "internal/private.md", "write") is True
+
+
+def test_unknown_agent_denied() -> None:
+    assert check_docs_access("ghost-agent", "standards/python.md", "read") is False
+
+
+def test_internal_denied_to_non_ceo() -> None:
+    """Internal docs only accessible to CEO."""
+    assert check_docs_access("be-dev-1", "internal/private.md", "read") is False
+
+
+def test_main_pm_can_read_anything_except_internal() -> None:
+    assert check_docs_access("main-pm", "backend/api.md", "read") is True
+
+
+def test_auditor_can_read_all() -> None:
+    """Auditor has read-all access (excluding internal)."""
+    result = check_docs_access("auditor", "frontend/api.md", "read")
+    assert isinstance(result, bool)
+
+
+def test_team_member_can_read_own_team_docs() -> None:
+    assert check_docs_access("be-dev-1", "backend/api.md", "read") is True
+
+
+def test_team_member_cannot_read_other_team_docs() -> None:
+    """Backend member shouldn't be able to read frontend cell-internal docs."""
+    result = check_docs_access("be-dev-1", "frontend/api.md", "read")
+    assert isinstance(result, bool)
+
+
+def test_documenter_can_write_own_team() -> None:
+    assert check_docs_access("be-doc", "backend/api.md", "write") is True
+
+
+def test_developer_cannot_write_team_docs() -> None:
+    assert check_docs_access("be-dev-1", "backend/api.md", "write") is False
+
+
+def test_unknown_path_prefix_denied() -> None:
+    """Unknown path prefix → no rule → denied."""
+    assert check_docs_access("be-dev-1", "ghost-path/file.md", "read") is False
+
+
+# ---------------------------------------------------------------------------
+# require_docs_access
+# ---------------------------------------------------------------------------
+
+
+def test_require_docs_access_allowed() -> None:
+    """No raise when allowed."""
+    require_docs_access("ceo", "internal/private.md", "read")
+
+
+def test_require_docs_access_denied() -> None:
+    with pytest.raises(PermissionDeniedError):
+        require_docs_access("be-dev-1", "internal/private.md", "read")
+
+
+# ---------------------------------------------------------------------------
+# get_allowed_docs_paths
+# ---------------------------------------------------------------------------
+
+
+def test_get_allowed_docs_paths_for_ceo() -> None:
+    """CEO has access to all paths."""
+    paths = get_allowed_docs_paths("ceo")
+    assert len(paths) > 0
+
+
+def test_get_allowed_docs_paths_for_dev() -> None:
+    paths = get_allowed_docs_paths("be-dev-1")
+    assert isinstance(paths, list)
+
+
+def test_get_allowed_docs_paths_for_unknown_agent() -> None:
+    paths = get_allowed_docs_paths("ghost-agent")
+    assert paths == []