Skip to content

test: add comprehensive RBAC regression test suite (373 tests)#2912

Merged
crivetimihai merged 4 commits intomainfrom
rbac-regression
Feb 13, 2026
Merged

test: add comprehensive RBAC regression test suite (373 tests)#2912
crivetimihai merged 4 commits intomainfrom
rbac-regression

Conversation

@crivetimihai
Copy link
Copy Markdown
Member

@crivetimihai crivetimihai commented Feb 13, 2026

Summary

  • Add 373 new RBAC regression tests across 7 test files and 1 modified utility file
  • Systematically verify all 5 built-in roles (platform_admin, team_admin, developer, viewer, platform_viewer) against every permission
  • Cover previously untested areas: token scoping truth table, admin bypass enforcement, fail-closed behavior, cross-team isolation, personal team exclusion (fix: exclude personal team roles from check_any_team RBAC aggregation #2900 regression), endpoint decorator coverage, and management endpoint RBAC

New Test Files

File Tests Coverage Area
test_rbac_permission_matrix.py 235 Role × permission grant/deny for all 5 roles
test_rbac_endpoint_coverage.py 69 Decorator usage verification across all routers
test_token_scoping.py 20 normalize_token_teams() truth table
test_rbac_cross_team_isolation.py 18 Team isolation + personal team exclusion
test_rbac_admin_bypass.py 11 allow_admin_bypass=True/False behavior
test_rbac_fail_closed.py 10 Error/expired/deactivated role denial
test_rbac_management_endpoints.py 10 HTTP-level integration tests

Test plan

  • All 373 new tests pass
  • All 11,442 existing unit tests pass (zero regressions)
  • Code formatted with autoflake, isort, black

Closes #2387

@crivetimihai
test: add comprehensive RBAC regression test suite (373 tests)
63b49e1 
Closes #2387

Add systematic RBAC test coverage across 7 new test files:
- Permission matrix: 235 parametrized tests for all 5 roles × permissions
- Token scoping: 20 tests for normalize_token_teams() truth table
- Admin bypass: 11 tests for allow_admin_bypass=True/False enforcement
- Fail-closed: 10 tests for error/expired/deactivated role denial
- Cross-team isolation: 18 tests including #2900 personal team regression
- Endpoint coverage: 69 tests verifying decorator usage across all routers
- Management endpoints: 10 HTTP-level integration tests for RBAC admin

Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>
@crivetimihai
test: add Playwright E2E tests for RBAC on tools, resources, prompts,…
fce81e0 
… and teams

Extends test_rbac_permissions.py with 15 new E2E tests covering:
- Tool CRUD: developer create (team + all-teams view), viewer denied
- Resource CRUD: developer create, viewer denied
- Prompt CRUD: developer create, viewer denied
- Team management: viewer denied manage members, team_admin granted
- REST API: developer/viewer create tool/resource/prompt via API

Closes #2387

Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>
@crivetimihai crivetimihai self-assigned this Feb 13, 2026
@crivetimihai crivetimihai added testing Testing (unit, e2e, manual, automated, etc) test-automation Automated testing playwright Automated UI testing with playwright labels Feb 13, 2026
@crivetimihai crivetimihai added this to the Release 1.0.0-RC1 milestone Feb 13, 2026
@crivetimihai
fix: resolve Playwright RBAC test failures for prompts, teams, and API
011c727 
- Prompt form: skip template fill (textarea has default content)
- Team management: test POST add-member (viewer denied) + verify
  team_admin passes RBAC (ownership check is business logic, not RBAC)
- REST API viewer deny: assert not in (200, 201) since FastAPI may
  return 422 (schema validation) before RBAC check runs

Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>
@crivetimihai
fix: use Apache-2.0 license identifier consistently across all test f…
dc6ce0a 
…iles

Replace SPDX-License-Identifier: MIT with Apache-2.0 to match the
rest of the project.

Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>
@crivetimihai crivetimihai merged commit 655c18e into main Feb 13, 2026
37 checks passed
@crivetimihai crivetimihai deleted the rbac-regression branch February 13, 2026 11:18
suciu-daniel pushed a commit that referenced this pull request Feb 16, 2026
@crivetimihai @suciu-daniel
test: add comprehensive RBAC regression test suite (373 tests) (#2912)
4fbf2c8 
* test: add comprehensive RBAC regression test suite (373 tests)

Closes #2387

Add systematic RBAC test coverage across 7 new test files:
- Permission matrix: 235 parametrized tests for all 5 roles × permissions
- Token scoping: 20 tests for normalize_token_teams() truth table
- Admin bypass: 11 tests for allow_admin_bypass=True/False enforcement
- Fail-closed: 10 tests for error/expired/deactivated role denial
- Cross-team isolation: 18 tests including #2900 personal team regression
- Endpoint coverage: 69 tests verifying decorator usage across all routers
- Management endpoints: 10 HTTP-level integration tests for RBAC admin

Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>

* test: add Playwright E2E tests for RBAC on tools, resources, prompts, and teams

Extends test_rbac_permissions.py with 15 new E2E tests covering:
- Tool CRUD: developer create (team + all-teams view), viewer denied
- Resource CRUD: developer create, viewer denied
- Prompt CRUD: developer create, viewer denied
- Team management: viewer denied manage members, team_admin granted
- REST API: developer/viewer create tool/resource/prompt via API

Closes #2387

Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>

* fix: resolve Playwright RBAC test failures for prompts, teams, and API

- Prompt form: skip template fill (textarea has default content)
- Team management: test POST add-member (viewer denied) + verify
  team_admin passes RBAC (ownership check is business logic, not RBAC)
- REST API viewer deny: assert not in (200, 201) since FastAPI may
  return 422 (schema validation) before RBAC check runs

Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>

* fix: use Apache-2.0 license identifier consistently across all test files

Replace SPDX-License-Identifier: MIT with Apache-2.0 to match the
rest of the project.

Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>

---------

Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>
vishu-bh pushed a commit that referenced this pull request Feb 18, 2026
@crivetimihai @vishu-bh
test: add comprehensive RBAC regression test suite (373 tests) (#2912)
05f08cf 
* test: add comprehensive RBAC regression test suite (373 tests)

Closes #2387

Add systematic RBAC test coverage across 7 new test files:
- Permission matrix: 235 parametrized tests for all 5 roles × permissions
- Token scoping: 20 tests for normalize_token_teams() truth table
- Admin bypass: 11 tests for allow_admin_bypass=True/False enforcement
- Fail-closed: 10 tests for error/expired/deactivated role denial
- Cross-team isolation: 18 tests including #2900 personal team regression
- Endpoint coverage: 69 tests verifying decorator usage across all routers
- Management endpoints: 10 HTTP-level integration tests for RBAC admin

Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>

* test: add Playwright E2E tests for RBAC on tools, resources, prompts, and teams

Extends test_rbac_permissions.py with 15 new E2E tests covering:
- Tool CRUD: developer create (team + all-teams view), viewer denied
- Resource CRUD: developer create, viewer denied
- Prompt CRUD: developer create, viewer denied
- Team management: viewer denied manage members, team_admin granted
- REST API: developer/viewer create tool/resource/prompt via API

Closes #2387

Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>

* fix: resolve Playwright RBAC test failures for prompts, teams, and API

- Prompt form: skip template fill (textarea has default content)
- Team management: test POST add-member (viewer denied) + verify
  team_admin passes RBAC (ownership check is business logic, not RBAC)
- REST API viewer deny: assert not in (200, 201) since FastAPI may
  return 422 (schema validation) before RBAC check runs

Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>

* fix: use Apache-2.0 license identifier consistently across all test files

Replace SPDX-License-Identifier: MIT with Apache-2.0 to match the
rest of the project.

Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>

---------

Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>
Signed-off-by: Vishu Bhatnagar <vishu.bhatnagar@ibm.com>
kcostell06 pushed a commit to kcostell06/mcp-context-forge that referenced this pull request Feb 24, 2026
@crivetimihai
test: add comprehensive RBAC regression test suite (373 tests) (IBM#2912
2767a54 
)

* test: add comprehensive RBAC regression test suite (373 tests)

Closes IBM#2387

Add systematic RBAC test coverage across 7 new test files:
- Permission matrix: 235 parametrized tests for all 5 roles × permissions
- Token scoping: 20 tests for normalize_token_teams() truth table
- Admin bypass: 11 tests for allow_admin_bypass=True/False enforcement
- Fail-closed: 10 tests for error/expired/deactivated role denial
- Cross-team isolation: 18 tests including IBM#2900 personal team regression
- Endpoint coverage: 69 tests verifying decorator usage across all routers
- Management endpoints: 10 HTTP-level integration tests for RBAC admin

Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>

* test: add Playwright E2E tests for RBAC on tools, resources, prompts, and teams

Extends test_rbac_permissions.py with 15 new E2E tests covering:
- Tool CRUD: developer create (team + all-teams view), viewer denied
- Resource CRUD: developer create, viewer denied
- Prompt CRUD: developer create, viewer denied
- Team management: viewer denied manage members, team_admin granted
- REST API: developer/viewer create tool/resource/prompt via API

Closes IBM#2387

Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>

* fix: resolve Playwright RBAC test failures for prompts, teams, and API

- Prompt form: skip template fill (textarea has default content)
- Team management: test POST add-member (viewer denied) + verify
  team_admin passes RBAC (ownership check is business logic, not RBAC)
- REST API viewer deny: assert not in (200, 201) since FastAPI may
  return 422 (schema validation) before RBAC check runs

Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>

* fix: use Apache-2.0 license identifier consistently across all test files

Replace SPDX-License-Identifier: MIT with Apache-2.0 to match the
rest of the project.

Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>

---------

Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@kevalmahajan kevalmahajan Awaiting requested review from kevalmahajan kevalmahajan is a code owner

@madhav165 madhav165 Awaiting requested review from madhav165 madhav165 is a code owner

Assignees

@crivetimihai crivetimihai

Labels

playwright Automated UI testing with playwright test-automation Automated testing testing Testing (unit, e2e, manual, automated, etc)

Projects

None yet

Milestone

Release 1.0.0-RC1

Development

Successfully merging this pull request may close these issues.

[EPIC][TESTING][SECURITY]: RBAC automated regression suite (visibility, teams, token scope)

1 participant

@crivetimihai