Add unit and integration tests for Cedar group-based authorization#4964
Merged
Add unit and integration tests for Cedar group-based authorization#4964
Conversation
The dual-claim extraction, dot-notation traversal, and merge-order fix from 88937fce lacked direct unit tests for helper functions and had no integration tests exercising group-based Cedar policies through the middleware stack. This closes both gaps. Tier 1 — unit tests for parseCedarEntityID, sanitizeURIForCedar, extractClientIDFromClaims, preprocessClaims, preprocessArguments, mergeContexts, and IsAuthorized entity merge priority. Adds edge cases to existing TestResolveNestedClaim (ambiguity) and TestAuthorizeWithJWTClaims_DualClaim (same claim, missing JWT key, non-array graceful handling, both dot-notation). Tier 2 — integration tests for group-based list filtering (Entra dual, Entra groups, Okta URI, Keycloak nested, prompts, resources), non-list operations (tool call, prompt get, resource read), transitive THVGroup→THVRole hierarchy through middleware, and upstream provider group extraction. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Large PR Detected
This PR exceeds 1000 lines of changes and requires justification before it can be reviewed.
How to unblock this PR:
Add a section to your PR description with the following format:
## Large PR Justification
[Explain why this PR must be large, such as:]
- Generated code that cannot be split
- Large refactoring that must be atomic
- Multiple related changes that would break if separated
- Migration or data transformationAlternative:
Consider splitting this PR into smaller, focused changes (< 1000 lines each) for easier review and reduced risk.
See our Contributing Guidelines for more details.
This review will be automatically dismissed once you add the justification section.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #4964 +/- ##
=======================================
Coverage 69.49% 69.50%
=======================================
Files 551 551
Lines 55817 55817
=======================================
+ Hits 38790 38793 +3
+ Misses 14037 14033 -4
- Partials 2990 2991 +1 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
rdimitrov
approved these changes
Apr 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The Cedar authorizer gained dual-claim extraction, dot-notation traversal, and entity merge fixes in #4911, #4901, and #4847, but test coverage for group-based authorization paths was thin — only indirect exercise through higher-level flows. This adds direct unit tests for the helper functions and integration tests that verify the full middleware pipeline with group-based Cedar policies shaped like real IDP tokens.
extractGroupscovering dual-claim merge, dot-notation nested claims, single-value-to-slice coercion, deduplication, and nil-safetyresolveNestedClaimincluding ambiguous key resolution (literal match wins over traversal)realm_access.roles)THVGroup → THVRolefromentities_json)Type of change
Test plan
task test)task lint-fix)Does this introduce a user-facing change?
No
Generated with Claude Code