chore: import upstream snapshot with attribution

2026-07-13 13:12:33 +08:00
commit aacb60a4af
3387 changed files with 981307 additions and 0 deletions
@@ -0,0 +1,55 @@
+from __future__ import annotations
+
+from opensquilla.gateway.auth import OpenScopeResolver
+from opensquilla.gateway.config import AuthConfig, GatewayConfig
+from opensquilla.gateway.scopes import (
+    CLI_DEFAULT_OPERATOR_SCOPES,
+    PROPOSALS_SCOPE,
+    REMOTE_OPERATOR_SCOPES,
+    normalize_operator_scopes,
+)
+
+
+def test_open_auth_loopback_operator_gets_local_owner_scopes_when_debug_false() -> None:
+    principal = OpenScopeResolver().resolve(
+        {},
+        "operator",
+        GatewayConfig(debug=False, host="127.0.0.1"),
+        peer_ip="127.0.0.1",
+    )
+
+    assert principal.scopes == CLI_DEFAULT_OPERATOR_SCOPES
+    assert principal.is_owner is True
+    assert principal.authenticated is False
+
+
+def test_open_auth_exposed_operator_gets_remote_scopes_when_debug_false() -> None:
+    principal = OpenScopeResolver().resolve(
+        {},
+        "operator",
+        GatewayConfig(debug=False, host="0.0.0.0"),
+        peer_ip="127.0.0.1",
+    )
+
+    assert principal.scopes == REMOTE_OPERATOR_SCOPES
+    assert PROPOSALS_SCOPE not in principal.scopes
+    assert principal.is_owner is False
+    assert principal.authenticated is False
+
+
+def test_open_auth_debug_operator_uses_configured_token_scopes() -> None:
+    configured_scopes = ["operator.write"]
+    principal = OpenScopeResolver().resolve(
+        {},
+        "operator",
+        GatewayConfig(
+            debug=True,
+            host="0.0.0.0",
+            auth=AuthConfig(token_scopes=configured_scopes),
+        ),
+        peer_ip="203.0.113.7",
+    )
+
+    assert principal.scopes == normalize_operator_scopes(configured_scopes)
+    assert principal.is_owner is False
+    assert principal.authenticated is False