feat: RBAC for RTC write modes (Gerenciador ADMIN only, denials audited), central backpressure for heavy jobs (HEAVY_JOB_CONCURRENCY_LIMIT), concurrency simulation evidence

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-09-25 09:46:21 -03:00
parent 7063c8c161
commit af5d9b4436
10 changed files with 274 additions and 13 deletions
@@ -97,3 +97,54 @@ def test_agent_can_reread_only_its_own_current_authorization_and_it_follows_the_
        s.commit()
    body = client.get("/v1/agents/me/authorizations", headers=H).json()
    assert body["rtc_write_mode"] == "ENABLED" and set(body) == {"rtc_write_mode", "rtc_approved_codes", "rtc_rollbacks"}
+
+
+def _become(client, role):
+    """Turn the logged-in test operator into a Gerenciador SSO collaborator with the given perfil (identity source of truth is the SSO)."""
+    from central.app.models import AdminUser
+    with client._session_factory() as s:
+        admin = s.scalars(select(AdminUser)).first()
+        admin.auth_source, admin.password_hash, admin.external_subject, admin.external_role = "GTI_GERENCIADOR", None, "sso-subject-1", role
+        s.commit()
+
+
+def _post(client, path, **data):
+    return client.post(path, data={"csrf_token": client.cookies.get("gti_csrf"), **data}, follow_redirects=False)
+
+
+def test_write_modes_are_restricted_to_gerenciador_admins_and_every_denial_is_audited():
+    client, agent_id, _ = _panel_client()
+    _become(client, "PADRAO")
+    for mode, extra in (("ENABLED", {"confirm": "PREENCHER"}), ("APPROVAL_REQUIRED", {})):
+        assert _post(client, f"/agents/{agent_id}/rtc-mode", mode=mode, **extra).status_code == 403
+    assert _post(client, f"/agents/{agent_id}/rtc-candidates", action="approve", all="1").status_code == 403
+    assert _post(client, f"/agents/{agent_id}/rtc-candidates", action="apply_approved").status_code == 403
+    assert _post(client, f"/agents/{agent_id}/rtc-rollback", audit_id="1", confirm="REVERTER").status_code == 403
+    with client._session_factory() as s:
+        assert s.scalars(select(Installation)).one().rtc_write_mode == "DISABLED"
+        assert len([e for e in s.scalars(select(AuditEvent)) if e.action == "RTC_DENIED"]) == 5
+    # read-only modes stay available to a normal collaborator, and the page tells them why the rest is disabled
+    assert _post(client, f"/agents/{agent_id}/rtc-mode", mode="DRY_RUN").status_code == 303
+    page = client.get(f"/agents/{agent_id}/rtc").text
+    assert "Somente leitura para o seu perfil" in page and "disabled" in page
+
+
+def test_a_normal_collaborator_cannot_switch_off_a_privileged_mode_either():
+    client, agent_id, _ = _panel_client()
+    with client._session_factory() as s:
+        s.scalars(select(Installation)).one().rtc_write_mode = "ENABLED"
+        s.commit()
+    _become(client, "PADRAO")
+    assert _post(client, f"/agents/{agent_id}/rtc-mode", mode="DISABLED").status_code == 403
+    with client._session_factory() as s:
+        assert s.scalars(select(Installation)).one().rtc_write_mode == "ENABLED"
+
+
+def test_gerenciador_admin_can_change_modes_and_the_operator_is_recorded():
+    client, agent_id, _ = _panel_client()
+    _become(client, "ADMIN")
+    assert _post(client, f"/agents/{agent_id}/rtc-mode", mode="ENABLED", confirm="PREENCHER").status_code == 303
+    with client._session_factory() as s:
+        assert s.scalars(select(Installation)).one().rtc_write_mode == "ENABLED"
+        event = [e for e in s.scalars(select(AuditEvent)) if e.action == "RTC_WRITE_MODE"][-1]
+        assert event.context["to"] == "ENABLED" and event.context["role"] == "ADMIN" and event.context["operator"]