Benjamin Admin
7aabfbe5b5
Geteilte Schicht für alle Surfaces (Workspace-Anwälte, Cyber-Risiko-Projekt,
Admin): ein Mandant markiert ein Control als "nicht anwendbar" → in seinen
Use-Case-Ansichten (und künftig Repo-Scans) ausgeblendet.
- Migration 156: compliance.control_suppressions (PK tenant_id+control_uuid),
reversibel (active + reverted_*), auditierbar (actor/reason/created_at).
[migration-approved]
- Service control_suppression: suppress/revert/list_suppressions +
suppressed_control_uuids (geteilter Filter).
- Routes: GET/POST /v1/controls/suppressions + POST .../{uuid}/revert (X-Tenant-ID).
- controls_for_use_case: optionaler X-Tenant-ID + include_suppressed; suppressed
per Default versteckt (nie gelöscht), suppressed_count, suppressed-Flag pro
Control. Agenten/CRA ohne Tenant unberührt.
- Tests: Request-Validierung + import-safety (E2E-Zyklus gegen macmini bewiesen).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
36 lines
1.4 KiB
Python
36 lines
1.4 KiB
Python
"""Tests for per-tenant control suppression. The service is DB-bound (verified
|
|
e2e against the seeded DB); here we pin the request-model validation + import
|
|
safety so CI catches breakage in the routes/service modules."""
|
|
|
|
import pytest
|
|
|
|
from compliance.api.control_suppression_routes import RevertRequest, SuppressRequest
|
|
from compliance.services import control_suppression
|
|
|
|
|
|
def test_suppress_request_requires_control_uuid():
|
|
with pytest.raises(Exception):
|
|
SuppressRequest() # type: ignore[call-arg] # control_uuid missing
|
|
req = SuppressRequest(control_uuid="c-1", reason="für uns nicht anwendbar",
|
|
actor="dsb@kunde.de")
|
|
assert req.control_uuid == "c-1"
|
|
assert req.reason == "für uns nicht anwendbar"
|
|
assert req.actor == "dsb@kunde.de"
|
|
|
|
|
|
def test_revert_request_fields_optional():
|
|
r = RevertRequest()
|
|
assert r.reason is None and r.actor is None
|
|
|
|
|
|
def test_service_exposes_expected_api():
|
|
for fn in ("suppress", "revert", "list_suppressions",
|
|
"suppressed_control_uuids"):
|
|
assert callable(getattr(control_suppression, fn))
|
|
|
|
|
|
def test_suppressed_uuids_empty_without_tenant():
|
|
# no tenant → no filter, no DB access
|
|
assert control_suppression.suppressed_control_uuids(db=None, tenant_id=None) == set()
|
|
assert control_suppression.suppressed_control_uuids(db=None, tenant_id="") == set()
|