chore: import upstream snapshot with attribution

tests/multi_user/test_capability_access.py

@@ -0,0 +1,78 @@
+"""Tests for capability-based access: has_capability_access.
+
+As of the multi-user release only the LLM capability is grantable per user, so
+gating is LLM-only; embedding/search are shared admin infrastructure. The same
+helper backs the turn-runtime gate and the frontend lock, so they always agree.
+"""
+
+from deeptutor.multi_user import model_access
+from deeptutor.multi_user.context import reset_current_user, set_current_user
+from deeptutor.multi_user.models import CurrentUser, UserScope
+
+
+def make_user(tmp_path, role="user"):
+    uid = "u_admin" if role == "admin" else "u_alice"
+    return CurrentUser(
+        id=uid,
+        username="admin" if role == "admin" else "alice",
+        role=role,
+        scope=UserScope(
+            kind="admin" if role == "admin" else "user",
+            user_id=uid,
+            root=tmp_path / uid,
+        ),
+    )
+
+
+def _fake_access(llm=None):
+    """Build a redacted_model_access return value with the given llm bucket."""
+    return lambda _user_id=None: {"llm": list(llm or [])}
+
+
+def test_admin_always_has_access(tmp_path, monkeypatch):
+    # Admins are never gated and must not even consult the grant view.
+    def _boom(_user_id=None):
+        raise AssertionError("redacted_model_access should not be called for admins")
+
+    monkeypatch.setattr(model_access, "redacted_model_access", _boom)
+    token = set_current_user(make_user(tmp_path, role="admin"))
+    try:
+        assert model_access.has_capability_access("llm") is True
+    finally:
+        reset_current_user(token)
+
+
+def test_user_with_available_model_has_access(tmp_path, monkeypatch):
+    monkeypatch.setattr(
+        model_access,
+        "redacted_model_access",
+        _fake_access(llm=[{"profile_id": "p", "model_id": "m", "available": True}]),
+    )
+    token = set_current_user(make_user(tmp_path, role="user"))
+    try:
+        assert model_access.has_capability_access("llm") is True
+    finally:
+        reset_current_user(token)
+
+
+def test_user_with_unavailable_model_has_no_access(tmp_path, monkeypatch):
+    # A granted profile that no longer resolves in the catalog is available=False.
+    monkeypatch.setattr(
+        model_access,
+        "redacted_model_access",
+        _fake_access(llm=[{"profile_id": "p", "available": False}]),
+    )
+    token = set_current_user(make_user(tmp_path, role="user"))
+    try:
+        assert model_access.has_capability_access("llm") is False
+    finally:
+        reset_current_user(token)
+
+
+def test_user_with_empty_grant_has_no_access(tmp_path, monkeypatch):
+    monkeypatch.setattr(model_access, "redacted_model_access", _fake_access())
+    token = set_current_user(make_user(tmp_path, role="user"))
+    try:
+        assert model_access.has_capability_access("llm") is False
+    finally:
+        reset_current_user(token)