Skip to content

fix(seed): add login identity for other-tenant persona #2206

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
aleksdotbar merged 2 commits into from
Aug 5, 2026
+2 −7
Merged

fix(seed): add login identity for other-tenant persona #2206

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
959bd1c
fix(seed): add login identity for other-tenant persona
aleksdotbar Aug 5, 2026
3732446
fix(stand): drop retired identity operation from coverage
aleksdotbar Aug 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions deploy/seed/identity.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -389,6 +389,7 @@ def run() -> None:
# subject. An edge would put them in somebody's subtree, and a role
# would make the refusal ambiguous — is it the tenant or the grant?
n_persons += seed_persons(cur, TENANT_OTHER, other_roster)
n_login_id += seed_login_ids(cur, TENANT_OTHER, other_roster)
n_names += seed_person_names(cur, TENANT_OTHER, other_roster)
n_acct += seed_account_person_map(cur, TENANT_OTHER, other_roster)

Expand Down
8 changes: 1 addition & 7 deletions tests/stand/api/operations.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,18 +31,13 @@
# authentication, so the gateway never reaches a handler and these are never
# resolved — they only have to be well-formed enough to route.
SOME_ID: Final[str] = "01900000-0000-7000-8000-000000000000"
#: Still used by identity's `/internal/persons/by-email/{email}`, which is a
#: LOOKUP by email rather than a person-keyed route and so was untouched by the
#: identity cutover (#2098).
SOME_EMAIL: Final[str] = "nobody@example.com"

#: Stand-in -> the parameter it stands in for. These values are synthetic and
#: chosen for this purpose, so a path segment equal to one of them IS the
#: parameter — which is what lets the template be derived rather than declared
#: twice per row.
_PARAMETERS: Final[dict[str, str]] = {
SOME_ID: "{id}",
SOME_EMAIL: "{email}",
}


Expand Down Expand Up @@ -104,7 +99,7 @@ def _i(method: str, suffix: str) -> Operation:
_a("POST", "/v1/metric-drilldown/export"),
)

#: identity-resolution — 18 operations. `/health` and `/healthz` are the host
#: identity-resolution — 17 operations. `/health` and `/healthz` are the host
#: router's, not the product API, and are deliberately absent: the real probes
#: address the pod directly rather than passing the gateway.
IDENTITY_OPERATIONS: Final[tuple[Operation, ...]] = (
Expand All @@ -127,7 +122,6 @@ def _i(method: str, suffix: str) -> Operation:
# `.authenticated()`, not admin-gated — and the substring test below does not
# catch it, which is correct: `/visible-persons` is not `/visibility`.
_i("POST", "/v1/visible-persons"),
_i("GET", f"/internal/persons/by-email/{SOME_EMAIL}"),
)

ALL_OPERATIONS: Final[tuple[Operation, ...]] = ANALYTICS_OPERATIONS + IDENTITY_OPERATIONS
Expand Down
Loading