alro65
13a2867ef6
End-to-end implementation per docs/sprint-2.5-plan.md. New requirement added by user mid-sprint: 4-role RBAC (Super Admin / Engineer / Owner / User) with dual-auth for Engineer flashing firmware, plus a "mini Arduino IDE" inside the Studio. Tests: pytest 231/231 green (129 Sprint 2 + 102 Sprint 2.5 new). RBAC core (arautopilot/core/): - rbac.py: 4 roles, 12 capabilities, immutable capability matrix, has() / capabilities_of() / require() / requires_dual_auth() helpers. Engineer flashing firmware needs SA approval; everything else is single-factor. - user.py: User model with PBKDF2-HMAC-SHA256 PIN hashing (200k iters, 16-byte salt, self-describing hash format for future migrations). 4-8 digit numeric PINs enforced. - user_store.py: JSON-backed user database. seed_demo_users() for first-run UX. - audit.py: append-only JSONL audit log. AuditEvent with timestamp, user_id, role, action, target, outcome, reason, secondary_user_id for dual-auth, optional extra payload. Crypto signing of lines deferred to Sprint 8. Studio GUI (arautopilot/studio/): - app.py: real entry point (replaces Sprint 0 stub). --seed-demo populates demo users without launching GUI; --data-dir overrides the ~/.ar-autopilot/studio/ default. - session.py: Session + SessionHolder. check() always audits the decision; verify_super_admin_pin() + log_dual_auth_grant() for dual-auth flows. - login_window.py: modal login dialog with user picker + PIN field. Audits login attempts (success and bad-PIN denials). - main_window.py: top-level window with sidebar (user + role + caps) and tab area (Overview, Flash Console, Project placeholder, Telemetry placeholder). - flash_console.py: the "mini Arduino IDE". Lists serial ports via pyserial; picks firmware variant (esp32-dev / esp32-debug); compiles via 'pio run'; flashes via 'pio run -t upload --upload-port <port>'; streams pio output to a dark-themed read-only console; supports cancel. For Engineer flashes, asks the Super Admin for their PIN inline before invoking pio. Records dual-auth grant + pio exit code in the audit log. Dependencies: - New [project.optional-dependencies] group 'studio': PySide6>=6.6, pyserial>=3.5, platformio>=6.1. Kept optional so the core can be installed in lean / CI environments. Tests (arautopilot/tests/): - test_rbac.py: 32 tests for capability matrix, dual-auth policy, no-privilege-escalation invariants, partial overlap between roles. - test_user.py: 11 tests for PIN hashing, verification, salting, serialisation, field validators. - test_audit.py: 9 tests for JSONL append, immutability, round-trip, corrupt-line detection, dual-auth event shape, blank-line tolerance. - test_user_store.py: 10 tests for CRUD, persistence, role filtering, demo seed idempotency. - test_session.py: 9 tests for capability checks + audit side effects, SA PIN verification, dual-auth recording, SessionHolder lifecycle. - test_studio_smoke.py: 5 headless tests verifying Studio modules import without a display server, --seed-demo works, helpers safe to call without hardware. NOT in Sprint 2.5 (intentional): - Crypto signing of audit log lines (hash-chain) -- Sprint 8 - HWID binding of the user store -- Sprint 8 - Project configurator + .appack compiler -- Sprint 4 - Flutter bridge display -- Sprint 4 - Telemetry dashboard tab -- Sprint 4 - Serial monitor as a separate tab -- future enhancement Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
155 lines
4.6 KiB
Python
155 lines
4.6 KiB
Python
"""Tests for the 4-role RBAC system."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import pytest
|
|
|
|
from arautopilot.core.rbac import (
|
|
Capability,
|
|
PermissionError,
|
|
Role,
|
|
capabilities_of,
|
|
has,
|
|
require,
|
|
requires_dual_auth,
|
|
)
|
|
|
|
|
|
# ----------------------------------------------------------------------------
|
|
# Capability matrix
|
|
# ----------------------------------------------------------------------------
|
|
|
|
|
|
def test_super_admin_has_every_capability() -> None:
|
|
super_admin_caps = capabilities_of(Role.SUPER_ADMIN)
|
|
assert super_admin_caps == frozenset(Capability)
|
|
|
|
|
|
@pytest.mark.parametrize("cap", [
|
|
Capability.FLASH_FIRMWARE,
|
|
Capability.BUILD_FIRMWARE,
|
|
Capability.EDIT_FIRMWARE_SOURCE,
|
|
Capability.EDIT_COMMISSIONING,
|
|
Capability.EDIT_OPERATIONAL,
|
|
Capability.ENGAGE_PILOT,
|
|
Capability.READ_TELEMETRY,
|
|
Capability.ACK_ALARMS,
|
|
Capability.VIEW_AUDIT_LOG_FULL,
|
|
Capability.VIEW_AUDIT_LOG_VESSEL,
|
|
])
|
|
def test_engineer_can(cap: Capability) -> None:
|
|
assert has(Role.ENGINEER, cap)
|
|
|
|
|
|
@pytest.mark.parametrize("cap", [
|
|
Capability.EDIT_PYTHON_PROJECT,
|
|
Capability.EDIT_BASE_GAINS,
|
|
Capability.MANAGE_USERS,
|
|
])
|
|
def test_engineer_cannot(cap: Capability) -> None:
|
|
assert not has(Role.ENGINEER, cap)
|
|
|
|
|
|
@pytest.mark.parametrize("cap", [
|
|
Capability.EDIT_OPERATIONAL,
|
|
Capability.MANAGE_USERS,
|
|
Capability.ENGAGE_PILOT,
|
|
Capability.READ_TELEMETRY,
|
|
Capability.ACK_ALARMS,
|
|
Capability.VIEW_AUDIT_LOG_VESSEL,
|
|
])
|
|
def test_owner_can(cap: Capability) -> None:
|
|
assert has(Role.OWNER, cap)
|
|
|
|
|
|
@pytest.mark.parametrize("cap", [
|
|
Capability.EDIT_PYTHON_PROJECT,
|
|
Capability.EDIT_FIRMWARE_SOURCE,
|
|
Capability.FLASH_FIRMWARE,
|
|
Capability.BUILD_FIRMWARE,
|
|
Capability.EDIT_BASE_GAINS,
|
|
Capability.EDIT_COMMISSIONING,
|
|
Capability.VIEW_AUDIT_LOG_FULL,
|
|
])
|
|
def test_owner_cannot(cap: Capability) -> None:
|
|
assert not has(Role.OWNER, cap)
|
|
|
|
|
|
@pytest.mark.parametrize("cap", [
|
|
Capability.ENGAGE_PILOT,
|
|
Capability.READ_TELEMETRY,
|
|
Capability.ACK_ALARMS,
|
|
])
|
|
def test_user_can(cap: Capability) -> None:
|
|
assert has(Role.USER, cap)
|
|
|
|
|
|
@pytest.mark.parametrize("cap", [
|
|
Capability.EDIT_PYTHON_PROJECT,
|
|
Capability.EDIT_FIRMWARE_SOURCE,
|
|
Capability.FLASH_FIRMWARE,
|
|
Capability.BUILD_FIRMWARE,
|
|
Capability.EDIT_BASE_GAINS,
|
|
Capability.EDIT_COMMISSIONING,
|
|
Capability.EDIT_OPERATIONAL,
|
|
Capability.MANAGE_USERS,
|
|
Capability.VIEW_AUDIT_LOG_FULL,
|
|
Capability.VIEW_AUDIT_LOG_VESSEL,
|
|
])
|
|
def test_user_cannot(cap: Capability) -> None:
|
|
assert not has(Role.USER, cap)
|
|
|
|
|
|
# ----------------------------------------------------------------------------
|
|
# Dual-auth policy
|
|
# ----------------------------------------------------------------------------
|
|
|
|
|
|
def test_engineer_flashing_requires_dual_auth() -> None:
|
|
assert requires_dual_auth(Role.ENGINEER, Capability.FLASH_FIRMWARE)
|
|
|
|
|
|
def test_super_admin_flashing_is_single_factor() -> None:
|
|
assert not requires_dual_auth(Role.SUPER_ADMIN, Capability.FLASH_FIRMWARE)
|
|
|
|
|
|
@pytest.mark.parametrize("role", [Role.SUPER_ADMIN, Role.ENGINEER, Role.OWNER, Role.USER])
|
|
@pytest.mark.parametrize("cap", [
|
|
Capability.ENGAGE_PILOT,
|
|
Capability.READ_TELEMETRY,
|
|
Capability.EDIT_OPERATIONAL,
|
|
])
|
|
def test_non_flash_actions_never_need_dual_auth(role: Role, cap: Capability) -> None:
|
|
assert not requires_dual_auth(role, cap)
|
|
|
|
|
|
# ----------------------------------------------------------------------------
|
|
# require() helper
|
|
# ----------------------------------------------------------------------------
|
|
|
|
|
|
def test_require_passes_when_granted() -> None:
|
|
require(Role.USER, Capability.ENGAGE_PILOT) # no raise
|
|
|
|
|
|
def test_require_raises_on_denial() -> None:
|
|
with pytest.raises(PermissionError):
|
|
require(Role.USER, Capability.EDIT_BASE_GAINS)
|
|
|
|
|
|
def test_no_privilege_escalation_via_unknown_capability() -> None:
|
|
# Make sure that Owner / User can never grow capabilities by some
|
|
# accidental code path -- we just snapshot the matrix here.
|
|
assert capabilities_of(Role.USER) < capabilities_of(Role.OWNER)
|
|
assert capabilities_of(Role.OWNER) < capabilities_of(Role.SUPER_ADMIN)
|
|
assert capabilities_of(Role.ENGINEER) < capabilities_of(Role.SUPER_ADMIN)
|
|
|
|
|
|
def test_engineer_and_owner_capabilities_overlap_but_neither_subsumes_other() -> None:
|
|
eng = capabilities_of(Role.ENGINEER)
|
|
own = capabilities_of(Role.OWNER)
|
|
# Engineer can flash; Owner can manage users -- neither set is a subset
|
|
# of the other.
|
|
assert Capability.FLASH_FIRMWARE in eng and Capability.FLASH_FIRMWARE not in own
|
|
assert Capability.MANAGE_USERS in own and Capability.MANAGE_USERS not in eng
|