|
| 1 | +# Copyright (c) 2026 Beijing Volcano Engine Technology Co., Ltd. and/or its affiliates. |
| 2 | +# |
| 3 | +# Licensed under the Apache License, Version 2.0 (the "License"); |
| 4 | +# you may not use this file except in compliance with the License. |
| 5 | +# You may obtain a copy of the License at |
| 6 | +# |
| 7 | +# http://www.apache.org/licenses/LICENSE-2.0 |
| 8 | +# |
| 9 | +# Unless required by applicable law or agreed to in writing, software |
| 10 | +# distributed under the License is distributed on an "AS IS" BASIS, |
| 11 | +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 12 | +# See the License for the specific language governing permissions and |
| 13 | +# limitations under the License. |
| 14 | + |
| 15 | +import importlib |
| 16 | +from unittest.mock import MagicMock |
| 17 | + |
| 18 | +import pytest |
| 19 | + |
| 20 | +from veadk.cli.agentkit_runtime_iam import ( |
| 21 | + AGENTKIT_RUNTIME_FULL_ACCESS_POLICY, |
| 22 | + ensure_quick_runtime_full_access, |
| 23 | + is_agentkit_default_runtime_role, |
| 24 | +) |
| 25 | + |
| 26 | + |
| 27 | +def _install_iam_service(monkeypatch: pytest.MonkeyPatch, service: MagicMock) -> None: |
| 28 | + iam_module = importlib.import_module("volcengine.iam.IamService") |
| 29 | + monkeypatch.setattr(iam_module, "IamService", lambda: service) |
| 30 | + |
| 31 | + |
| 32 | +def test_recognizes_current_and_legacy_agentkit_default_roles() -> None: |
| 33 | + assert is_agentkit_default_runtime_role( |
| 34 | + "AgentKit_Runtime_Default_ServiceRole_abcd123" |
| 35 | + ) |
| 36 | + assert is_agentkit_default_runtime_role( |
| 37 | + "trn:iam::123:role/AgentKit-Runtime-Default-ServiceRole-abcd123" |
| 38 | + ) |
| 39 | + assert not is_agentkit_default_runtime_role("CustomerRuntimeRole") |
| 40 | + |
| 41 | + |
| 42 | +def test_attaches_full_access_to_generated_runtime_role( |
| 43 | + monkeypatch: pytest.MonkeyPatch, |
| 44 | +) -> None: |
| 45 | + service = MagicMock() |
| 46 | + service.list_attached_role_policies.return_value = { |
| 47 | + "Result": {"AttachedPolicyMetadata": [{"PolicyName": "AgentKitRuntimeAccess"}]} |
| 48 | + } |
| 49 | + service.attach_role_policy.return_value = {"Result": {}} |
| 50 | + _install_iam_service(monkeypatch, service) |
| 51 | + |
| 52 | + assert ensure_quick_runtime_full_access( |
| 53 | + "AgentKit_Runtime_Default_ServiceRole_abcd123", |
| 54 | + access_key="ak", |
| 55 | + secret_key="sk", |
| 56 | + ) |
| 57 | + service.attach_role_policy.assert_called_once_with( |
| 58 | + { |
| 59 | + "RoleName": "AgentKit_Runtime_Default_ServiceRole_abcd123", |
| 60 | + "PolicyName": AGENTKIT_RUNTIME_FULL_ACCESS_POLICY, |
| 61 | + "PolicyType": "System", |
| 62 | + } |
| 63 | + ) |
| 64 | + |
| 65 | + |
| 66 | +def test_keeps_existing_full_access_and_customer_roles_unchanged( |
| 67 | + monkeypatch: pytest.MonkeyPatch, |
| 68 | +) -> None: |
| 69 | + service = MagicMock() |
| 70 | + service.list_attached_role_policies.return_value = { |
| 71 | + "Result": { |
| 72 | + "AttachedPolicyMetadata": [ |
| 73 | + {"PolicyName": AGENTKIT_RUNTIME_FULL_ACCESS_POLICY} |
| 74 | + ] |
| 75 | + } |
| 76 | + } |
| 77 | + _install_iam_service(monkeypatch, service) |
| 78 | + |
| 79 | + assert ensure_quick_runtime_full_access( |
| 80 | + "AgentKit_Runtime_Default_ServiceRole_abcd123", |
| 81 | + access_key="ak", |
| 82 | + secret_key="sk", |
| 83 | + ) |
| 84 | + assert not ensure_quick_runtime_full_access( |
| 85 | + "CustomerRuntimeRole", |
| 86 | + access_key="ak", |
| 87 | + secret_key="sk", |
| 88 | + ) |
| 89 | + service.attach_role_policy.assert_not_called() |
| 90 | + service.list_attached_role_policies.assert_called_once() |
0 commit comments