From 9466f30cc384c45ce80c603600e24fb1d33b05d8 Mon Sep 17 00:00:00 2001 From: Christopher Sellers <1@christophersellers.com> Date: Fri, 23 Oct 2026 07:26:24 -0700 Subject: [PATCH] fix(tenant): update route manifest expectations for two new tenant-scoped routes --- tests/security/test_route_security_manifest.py | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/tests/security/test_route_security_manifest.py b/tests/security/test_route_security_manifest.py index c043947b1..c7fea970a 100644 --- a/tests/security/test_route_security_manifest.py +++ b/tests/security/test_route_security_manifest.py @@ -68,7 +68,9 @@ def test_checked_in_manifest_matches_live_route_and_dependency_graph(manifest): # +1 public: admin:POST:/api/v1/tools/check-access, the lead-capture # tool-access token check the Next.js gate calls (#3318). # +1 global-sysadmin: admin:PATCH:/admin/organizations/{org_id} (rename). - "enabled_operation_count": 252, + # +2 tenant-scoped (SEL-421, #3492): admin:GET:/v1/supplier/facilities/{facility_id}/removal-check + # and admin:DELETE:/v1/supplier/facilities/{facility_id}, owner-only, tenant-filtered. + "enabled_operation_count": 254, # 178/161 includes graph:GET:/api/v1/provisions/by-request: it is added # to the graph v1_router AFTER router.include_router(v1_router), so the # eager route copies of fastapi < 0.137 (under which the previous @@ -92,7 +94,7 @@ def test_checked_in_manifest_matches_live_route_and_dependency_graph(manifest): "enabled_by_classification": { "global-sysadmin": 16, "public": 30, - "tenant-scoped": 199, + "tenant-scoped": 201, "workload-only": 7, }, } @@ -185,8 +187,8 @@ def test_dual_session_routes_record_cookie_tenancy_and_csrf_adapter(manifest): dual = [item for item in manifest["enabled_operations"] if item["test_adapter"] == "tenant_dual_session_csrf"] mutations = [item for item in dual if item["method"] in {"POST", "PUT", "PATCH", "DELETE"}] - assert len(dual) == 49 - assert len(mutations) == 22 + assert len(dual) == 51 + assert len(mutations) == 23 assert all(item["authentication"] == "bearer-token-or-opaque-session-cookie" for item in dual) assert all(item["storage_boundary"] == "admin-postgres:jwt-tenant-or-session-membership-tenant" for item in dual)