mchades commented on code in PR #11622: URL: https://github.com/apache/gravitino/pull/11622#discussion_r3419471218
########## mcp-server/tests/integration/test_authz_e2e.py: ########## @@ -0,0 +1,177 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +"""End-to-end authorization integration test through the live MCP HTTP server. + +Validates the three demo acceptance moments against a real Gravitino with +authorization enabled: + + 1. Two principals run the same discovery call and get correctly different, + authorization-scoped results. + 2. A read-only principal attempts a write through MCP and is denied by + Gravitino authorization. + 3. Both the reads and the denied write appear as audit records attributed to + the correct principal. + +These tests only run when GRAVITINO_URI / MCP_URL / MCP_METALAKE are set (see +conftest.py); otherwise the suite is skipped. +""" + +import asyncio +import json +import os +import time + +import pytest +from fastmcp import Client +from fastmcp.client.transports import StreamableHttpTransport + +from tests.integration.gravitino_setup import basic_auth_header + +ADMIN = "admin" +BOB = "bob" +CATALOG_ALLOWED = "cat_allowed" +CATALOG_DENIED = "cat_denied" + + +def _client_for(principal: str, mcp_url: str) -> Client: + """Build an MCP client that authenticates as ``principal`` (simple auth).""" + transport = StreamableHttpTransport( + url=mcp_url, + headers={"Authorization": basic_auth_header(principal)}, + ) + return Client(transport) + + +async def _list_catalog_names(principal: str, mcp_url: str) -> set: + async with _client_for(principal, mcp_url) as client: + result = await client.call_tool("get_list_of_catalogs") + payload = json.loads(result.content[0].text) + return {entry["name"] for entry in payload} + + +def test_moment1_authorization_scoped_discovery( Review Comment: is the `moment1` in the method name is necessary? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
