create-workframe 0.1.12 → 0.1.13

package/workframe-api/test_local_bootstrap.py

@@ -0,0 +1,67 @@
+"""Local bootstrap must require a real owner email — no synthetic placeholders."""
+
+from __future__ import annotations
+
+import os
+import sys
+from pathlib import Path
+from unittest.mock import patch
+
+API_DIR = Path(__file__).resolve().parent
+if str(API_DIR) not in sys.path:
+    sys.path.insert(0, str(API_DIR))
+
+os.environ.setdefault("WORKFRAME_API_DATA_DIR", str(API_DIR / ".tmp-test-data"))
+os.environ.setdefault("HERMES_DATA", str(API_DIR / ".tmp-test-hermes"))
+os.environ.setdefault("DEV_LOCAL_UNSAFE", "true")
+os.environ["DEPLOYMENT_MODE"] = "single_user_local"
+
+import server  # noqa: E402
+
+
+class _CaptureHandler(server.Handler):
+    captured: tuple[int, dict] | None = None
+
+    def _json(self, status: int, payload: dict, **kwargs) -> None:  # type: ignore[override]
+        type(self).captured = (status, payload)
+
+
+def test_local_bootstrap_rejects_missing_email() -> None:
+    handler = _CaptureHandler.__new__(_CaptureHandler)
+    with patch.object(server, "DEPLOYMENT_MODE", "single_user_local"), patch.object(
+        server, "_install_window_open", return_value=True,
+    ):
+        handler._route_post_auth_local_bootstrap({})
+    assert _CaptureHandler.captured is not None
+    status, body = _CaptureHandler.captured
+    assert status == 400
+    assert body.get("error") == "email_required"
+
+
+def test_local_bootstrap_uses_submitted_email() -> None:
+    handler = _CaptureHandler.__new__(_CaptureHandler)
+    with patch.object(server, "DEPLOYMENT_MODE", "single_user_local"), patch.object(
+        server, "_install_window_open", return_value=True,
+    ), patch.object(
+        server._zk,
+        "create_session_for_email",
+        return_value={"user_id": "u-test", "session_id": "s-test", "refresh_token": "r-test"},
+    ) as create_session, patch.object(handler, "_ensure_user"), patch.object(
+        handler, "_first_owner_bootstrap",
+    ), patch.object(server, "_session_profile_payload", return_value={"ok": True}), patch.object(
+        server, "_session_cookie_secure", return_value=False,
+    ), patch.object(
+        server._zk, "session_cookie_value", return_value="cookie=test",
+    ):
+        handler._route_post_auth_local_bootstrap(
+            {"email": "Owner@Example.com", "display_name": "Owner"},
+        )
+    create_session.assert_called_once_with("owner@example.com")
+    assert _CaptureHandler.captured is not None
+    assert _CaptureHandler.captured[0] == 200
+
+
+if __name__ == "__main__":
+    test_local_bootstrap_rejects_missing_email()
+    test_local_bootstrap_uses_submitted_email()
+    print("ok")

package/workframe-api/test_mention_helpers.py

@@ -0,0 +1,35 @@
+"""WF-032 mention_helpers self-check."""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+import mention_helpers  # noqa: E402
+
+
+def test_mention_handle() -> None:
+    assert mention_helpers.mention_handle("Alice Smith") == "alicesmith"
+    assert mention_helpers.mention_handle("", "alice@example.com") == "alice"
+
+
+def test_parse_room_mentions() -> None:
+    agents = [{"id": "a1", "slug": "dev", "display_name": "Dev Agent"}]
+    result = mention_helpers.parse_room_mentions("@dev please review", agents, [])
+    assert len(result["agents"]) == 1
+    assert result["agents"][0]["slug"] == "dev"
+    assert result["users"] == []
+
+
+def test_parse_mentions() -> None:
+    rows = mention_helpers.parse_mentions("hello @architect and @dev")
+    assert [r["slug"] for r in rows] == ["architect", "dev"]
+
+
+if __name__ == "__main__":
+    test_mention_handle()
+    test_parse_room_mentions()
+    test_parse_mentions()
+    print("test_mention_helpers: ok")

package/workframe-api/test_mention_invoke.py

@@ -0,0 +1,26 @@
+"""WF-032 mention_invoke self-check."""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+import mention_invoke  # noqa: E402
+
+
+def test_invoke_mention_missing_agent() -> None:
+    """No-op when agent row lacks slug/id."""
+    mention_invoke._invoke_room_agent_mention(
+        "room-1",
+        "ws-1",
+        {"slug": "", "id": ""},
+        "",
+        "msg-1",
+    )
+
+
+if __name__ == "__main__":
+    test_invoke_mention_missing_agent()
+    print("test_mention_invoke: ok")

package/workframe-api/test_model_surface_consistency.py

@@ -19,6 +19,7 @@ spec = importlib.util.spec_from_file_location("wf_server_model_surface", ROOT /
 server = importlib.util.module_from_spec(spec)
 sys.modules["wf_server_model_surface"] = server
 spec.loader.exec_module(server)
+sys.modules["server"] = server  # ponytail: extracted modules resolve _srv() to this instance
 
 PROF = "surface-test-agent"
 prof_dir = server._profile_dir(PROF)

package/workframe-api/test_oauth_pending.py

@@ -0,0 +1,41 @@
+"""WF-032 oauth_pending store/take self-check."""
+
+from __future__ import annotations
+
+import os
+import sys
+import tempfile
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+import oauth_pending  # noqa: E402
+import server  # noqa: E402
+
+
+def test_store_take_round_trip() -> None:
+    with tempfile.TemporaryDirectory() as tmp:
+        os.environ["WORKFRAME_API_DATA_DIR"] = tmp
+        server.DATA_DIR = Path(tmp)
+        server.AUTH_DB_PATH = Path(tmp) / "auth.db"
+        server._ensure_workframe_db_schema()
+        oauth_pending.store_pending("state-1", "user-1", "github", "verifier-abc", "ws-1")
+        row = oauth_pending.take_pending("state-1")
+        assert row is not None
+        assert row["user_id"] == "user-1"
+        assert row["provider"] == "github"
+        assert row["code_verifier"] == "verifier-abc"
+        assert oauth_pending.take_pending("state-1") is None
+
+
+def test_pkce_pair() -> None:
+    verifier, challenge = oauth_pending.pkce_pair()
+    assert len(verifier) > 20
+    assert len(challenge) > 20
+    assert verifier != challenge
+
+
+if __name__ == "__main__":
+    test_pkce_pair()
+    test_store_take_round_trip()
+    print("test_oauth_pending: ok")

package/workframe-api/test_provider_bindings.py

@@ -0,0 +1,52 @@
+"""WF-032 provider_bindings pure helpers self-check."""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+import provider_bindings  # noqa: E402
+
+
+def test_hermes_oauth_auth_keys() -> None:
+    keys = provider_bindings._hermes_oauth_auth_keys("openai-codex")
+    assert "openai-codex" in keys
+    assert "codex" in keys
+    assert "openai_codex" in keys
+
+
+def test_auth_json_has_oauth_material() -> None:
+    pool_only = {
+        "version": 1,
+        "providers": {},
+        "credential_pool": {"openai-codex": [{"id": "x", "auth_type": "oauth"}]},
+    }
+    assert provider_bindings._auth_json_has_oauth_material(pool_only)
+
+
+def test_merge_oauth_auth_into_profile() -> None:
+    pool_only = {
+        "version": 1,
+        "providers": {},
+        "credential_pool": {"openai-codex": [{"id": "x", "auth_type": "oauth"}]},
+    }
+    merged: dict = {"version": 1, "providers": {}, "credential_pool": {}}
+    assert provider_bindings._merge_oauth_auth_into_profile(merged, pool_only, "openai-codex")
+    assert merged["credential_pool"].get("openai-codex")
+
+
+def test_parse_device_oauth_log() -> None:
+    text = "Open this URL\n  https://auth.openai.com/device\nEnter this code\n  ABCD-1234"
+    parsed = provider_bindings._parse_device_oauth_log(text)
+    assert parsed["verification_uri"] and "openai.com" in parsed["verification_uri"]
+    assert parsed["user_code"] == "ABCD-1234"
+
+
+if __name__ == "__main__":
+    test_hermes_oauth_auth_keys()
+    test_auth_json_has_oauth_material()
+    test_merge_oauth_auth_into_profile()
+    test_parse_device_oauth_log()
+    print("test_provider_bindings: ok")

package/workframe-api/test_provider_catalog.py

@@ -0,0 +1,28 @@
+"""WF-032 provider_catalog self-check."""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+import provider_catalog  # noqa: E402
+
+
+def test_catalog_lookup() -> None:
+    gh = provider_catalog.catalog_provider("github")
+    assert gh is not None
+    assert gh.get("connect_mode") == "oauth"
+    assert provider_catalog.catalog_provider_for_llm("openai-codex") is not None
+
+
+def test_user_only() -> None:
+    assert provider_catalog.provider_user_only("github")
+    assert not provider_catalog.provider_user_only("openrouter")
+
+
+if __name__ == "__main__":
+    test_catalog_lookup()
+    test_user_only()
+    print("test_provider_catalog: ok")

package/workframe-api/test_route_registry.py

@@ -12,17 +12,46 @@ sys.path.insert(0, str(ROOT))
 
 import route_registry  # noqa: E402
 
-# Auth level coverage
+
+def _handler_source_text() -> str:
+    """server.Handler bodies plus extracted handler_modules mixins (WF-032)."""
+    parts = [(ROOT / "server.py").read_text(encoding="utf-8")]
+    mods = ROOT / "handler_modules"
+    if mods.is_dir():
+        for path in sorted(mods.glob("*.py")):
+            if path.name == "__init__.py":
+                continue
+            parts.append(path.read_text(encoding="utf-8"))
+    return "\n".join(parts)
+
+
+def _sample_path_from_label(label: str, pattern: re.Pattern[str] | None = None) -> str:
+    sample = (
+        label.replace("{id}", "sample-id")
+        .replace("{slug}", "sample-slug")
+        .replace("{token}", "sample-token")
+        .replace("{provider}", "github")
+        .replace("{cid}", "cred-1")
+        .replace("{path}", "docs/readme.md")
+        .replace("{kind}", "og")
+    )
+    if pattern is not None and not pattern.fullmatch(sample):
+        raise AssertionError(f"sample path does not match pattern: {sample} {label}")
+    return sample
+
+
+# Auth level coverage (4-value enum)
 assert route_registry.resolve_auth_level("GET", "/api/health") == route_registry.AuthLevel.PUBLIC
 assert route_registry.resolve_auth_level("GET", "/api/meta") == route_registry.AuthLevel.PUBLIC
-assert route_registry.resolve_auth_level("GET", "/api/snapshot") == route_registry.AuthLevel.SINGLE_USER_GET
-assert route_registry.resolve_auth_level("POST", "/api/auth/start") == route_registry.AuthLevel.AUTH_FLOW
+assert route_registry.resolve_auth_level("GET", "/api/snapshot") == route_registry.AuthLevel.SESSION
+assert route_registry.resolve_auth_level("POST", "/api/auth/start") == route_registry.AuthLevel.PUBLIC
 assert route_registry.resolve_auth_level("GET", "/api/me") == route_registry.AuthLevel.SESSION
-assert route_registry.resolve_auth_level("GET", "/api/activity/detail") == route_registry.AuthLevel.SESSION
+assert route_registry.resolve_auth_level("GET", "/api/admin/vault/status") == route_registry.AuthLevel.ROLE_OWNER_ADMIN
+assert route_registry.resolve_auth_level("GET", "/api/workspace/default/rooms") == route_registry.AuthLevel.SESSION
 
-# Unknown /api paths require session (deny when anonymous)
-assert route_registry.resolve_auth_level("GET", "/api/not-a-real-handler") == route_registry.AuthLevel.SESSION
-assert not route_registry.authorize_request(
+# Unknown /api paths are unregistered → None (404 at dispatch, not auth-gated)
+assert route_registry.resolve_auth_level("GET", "/api/not-a-real-handler") is None
+assert route_registry.authorize_request(
     "GET",
     "/api/not-a-real-handler",
     "",
@@ -33,39 +62,80 @@ assert not route_registry.authorize_request(
     attach_user=lambda _u: None,
 )
 
-# ROUTES table: auth tier matches resolve_auth_level
-auth_mismatch: list[str] = []
-for route in route_registry.ROUTES:
-    resolved = route_registry.resolve_auth_level(route.method, route.path)
-    if resolved != route.auth:
-        auth_mismatch.append(f"{route.method} {route.path}: table={route.auth} resolved={resolved}")
-assert not auth_mismatch, f"route auth mismatch: {auth_mismatch}"
+# Registered session route without session → 401
+assert not route_registry.authorize_request(
+    "GET",
+    "/api/me",
+    "",
+    deployment_mode="trusted_team",
+    dev_local_unsafe=False,
+    install_window_open=False,
+    validate_session=lambda _s: None,
+    attach_user=lambda _u: None,
+)
 
-# ROUTES handlers exist on server.Handler
-server_src = (ROOT / "server.py").read_text(encoding="utf-8")
+# ROUTES table: dispatched routes have handlers on server.Handler (+ handler_modules)
+handler_src = _handler_source_text()
 missing_handlers: list[str] = []
 for route in route_registry.ROUTES:
-    if f"def {route.handler}(" not in server_src:
+    if not route.handler:
+        continue
+    if f"def {route.handler}(" not in handler_src:
         missing_handlers.append(f"{route.method} {route.path} -> {route.handler}")
 assert not missing_handlers, f"missing handler methods: {missing_handlers}"
 
-# Remaining if-chain GET paths still map to a known auth tier
+# Every pattern-backed route has a handler and auth via label-derived sample path
+missing_pattern_handlers: list[str] = []
+missing_pattern_auth: list[str] = []
+for rp in route_registry.ROUTE_PATTERNS:
+    if not rp.handler:
+        missing_pattern_handlers.append(f"{rp.method} {rp.label}")
+        continue
+    if f"def {rp.handler}(" not in handler_src:
+        missing_pattern_handlers.append(f"{rp.method} {rp.label} -> {rp.handler}")
+    sample = _sample_path_from_label(rp.label, rp.pattern)
+    if route_registry.lookup_auth(rp.method, sample) is None:
+        missing_pattern_auth.append(f"{rp.method} {sample}")
+assert not missing_pattern_handlers, f"missing pattern handlers: {missing_pattern_handlers}"
+assert not missing_pattern_auth, f"missing pattern auth: {missing_pattern_auth}"
+
+# Pattern handlers must not re-dispatch with legacy startswith guards
+pattern_method_blocks = re.findall(
+    r"(def (_route_pattern_\w+)\([^)]*\)[^:]*:.*?)(?=\n    def |\Z)",
+    handler_src,
+    flags=re.DOTALL,
+)
+legacy_guards: list[str] = []
+for block, name in pattern_method_blocks:
+    if 'path.startswith("/api/' in block or "path.startswith('/api/" in block:
+        legacy_guards.append(name)
+assert not legacy_guards, f"legacy startswith guards in pattern handlers: {legacy_guards}"
+
+# Every if-chain literal /api path must be registered with explicit auth
+server_src = (ROOT / "server.py").read_text(encoding="utf-8")
 handler_paths = set(re.findall(r'if path == "(/api/[^"]+)"', server_src))
 handler_paths |= set(re.findall(r"if path == \'(/api/[^\']+)\'", server_src))
-unmapped: list[str] = []
+unregistered: list[str] = []
 for p in sorted(handler_paths):
-    level = route_registry.resolve_auth_level("GET", p)
-    if level not in (
-        route_registry.AuthLevel.PUBLIC,
-        route_registry.AuthLevel.SINGLE_USER_GET,
-        route_registry.AuthLevel.SESSION,
-        route_registry.AuthLevel.INSTALL,
-        route_registry.AuthLevel.AUTH_FLOW,
-    ):
-        unmapped.append(p)
-assert not unmapped, f"unmapped auth levels: {unmapped}"
-
-# trusted_team: data GETs need session (not anonymous), not a hard deny
+    if route_registry.lookup_auth("GET", p) is None and route_registry.lookup_auth("POST", p) is None:
+        unregistered.append(p)
+assert not unregistered, f"unregistered auth for if-chain paths: {unregistered}"
+
+# Pattern-backed routes from startswith / fullmatch in do_GET/do_POST
+_pattern_probes = [
+    ("GET", "/api/public/branding/og"),
+    ("GET", "/api/workspace/ws-1/rooms"),
+    ("GET", "/api/rooms/room-1/messages"),
+    ("POST", "/api/rooms/room-1/messages/send"),
+    ("PATCH", "/api/workspace/ws-1"),
+    ("DELETE", "/api/memory/mem-1"),
+]
+for method, path in _pattern_probes:
+    assert route_registry.lookup_auth(method, path) is not None, f"missing pattern auth: {method} {path}"
+
+# sessionless_ok data GETs
+snap = route_registry.lookup_auth("GET", "/api/snapshot")
+assert snap is not None and snap.sessionless_ok
 assert not route_registry.authorize_request(
     "GET",
     "/api/agents",
@@ -87,10 +157,39 @@ assert route_registry.authorize_request(
     attach_user=lambda _u: None,
 )
 
-data_read_get = [r for r in route_registry.ROUTES if r.method == "GET"]
-assert len(data_read_get) == 36
-registry_post = [r for r in route_registry.ROUTES if r.method == "POST"]
-assert len(registry_post) == 25
+# owner/admin gate
+assert not route_registry.authorize_request(
+    "GET",
+    "/api/admin/vault/status",
+    "sid-ok",
+    deployment_mode="trusted_team",
+    dev_local_unsafe=False,
+    install_window_open=False,
+    validate_session=lambda s: {"user_id": "u1"} if s == "sid-ok" else None,
+    attach_user=lambda _u: None,
+    get_workspace_role=lambda: "member",
+)
+assert route_registry.authorize_request(
+    "GET",
+    "/api/admin/vault/status",
+    "sid-ok",
+    deployment_mode="trusted_team",
+    dev_local_unsafe=False,
+    install_window_open=False,
+    validate_session=lambda s: {"user_id": "u1"} if s == "sid-ok" else None,
+    attach_user=lambda _u: None,
+    get_workspace_role=lambda: "owner",
+)
+
+dispatched_get = [r for r in route_registry.ROUTES if r.method == "GET" and r.handler]
+dispatched_post = [r for r in route_registry.ROUTES if r.method == "POST" and r.handler]
+dispatched_patch = [r for r in route_registry.ROUTES if r.method == "PATCH" and r.handler]
+pattern_dispatched = [rp for rp in route_registry.ROUTE_PATTERNS if rp.handler]
+assert len(dispatched_get) >= 50, f"unexpected GET dispatch count: {len(dispatched_get)}"
+assert len(dispatched_post) >= 40, f"unexpected POST dispatch count: {len(dispatched_post)}"
+assert len(dispatched_patch) >= 4, f"unexpected PATCH dispatch count: {len(dispatched_patch)}"
+assert len(pattern_dispatched) >= 60, f"unexpected pattern dispatch count: {len(pattern_dispatched)}"
+assert len(dispatched_get) + len(dispatched_post) + len(dispatched_patch) + len(pattern_dispatched) >= 160
 
 class _PostStub:
     def __init__(self) -> None:
@@ -106,4 +205,41 @@ assert route_registry.dispatch_post(_stub, "/api/auth/start", {"email": "a@b.c"}
 assert _stub.called and _stub.body == {"email": "a@b.c"}
 assert not route_registry.dispatch_post(_stub, "/api/not-registered", {})
 
+class _GetStub:
+    def __init__(self) -> None:
+        self.called = False
+        self.pattern_called = False
+
+    def _route_get_admin_vault_status(self, qs: dict) -> None:
+        self.called = True
+
+    def _route_pattern_get_workspace_events(self, path: str, qs: dict) -> None:
+        self.pattern_called = True
+
+_get_stub = _GetStub()
+assert route_registry.dispatch_get(_get_stub, "/api/admin/vault/status", {})
+assert _get_stub.called
+assert route_registry.dispatch_get(_get_stub, "/api/admin/vault/status", {})  # idempotent call ok
+
+assert route_registry.dispatch_pattern(
+    "GET", _get_stub, "/api/workspace/ws-1/events", qs={},
+) is True
+assert _get_stub.pattern_called
+
+class _PatchStub:
+    def __init__(self) -> None:
+        self.called = False
+
+    def _route_patch_me(self, body: dict) -> None:
+        self.called = True
+
+_patch_stub = _PatchStub()
+assert route_registry.dispatch_patch(_patch_stub, "/api/me", {"display_name": "x"})
+assert _patch_stub.called
+
+# No legacy frozenset allowlists
+assert not hasattr(route_registry, "GET_ALWAYS_PUBLIC_ROUTES")
+assert not hasattr(route_registry, "GET_SINGLE_USER_PUBLIC_ROUTES")
+assert not hasattr(route_registry, "GET_PUBLIC_ROUTES")
+
 print("route registry self-check ok")

package/workframe-api/test_run_authority.py

@@ -0,0 +1,112 @@
+"""WF-009 RunAuthorityGate self-check."""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+from domain.entities import ActorType, FundingSource, RunSurface  # noqa: E402
+from run_authority import (  # noqa: E402
+    DENY_DELEGATION,
+    DENY_NO_CREDENTIAL_BYOK,
+    DENY_NO_CREDENTIAL_COMPANY,
+    DENY_PROVIDER_USER_ONLY,
+    RunAuthorityContext,
+    RunAuthorityRequest,
+    evaluate_run_authority,
+)
+
+
+def _req() -> RunAuthorityRequest:
+    return RunAuthorityRequest(
+        surface=RunSurface.CHAT,
+        actor_type=ActorType.USER,
+        actor_id="user-1",
+        triggering_user_id="user-1",
+        profile_slug="u-user-1-native",
+        workspace_id="ws-1",
+        provider="openrouter",
+    )
+
+
+def test_byok_user_cred() -> None:
+    decision = evaluate_run_authority(
+        _req(),
+        RunAuthorityContext(user_has_credential=True),
+        run_id="run-1",
+    )
+    assert decision.allowed
+    assert decision.payer_user_id == "user-1"
+    assert decision.funding_source == FundingSource.BYOK
+
+
+def test_byok_no_cred_denied() -> None:
+    decision = evaluate_run_authority(_req(), RunAuthorityContext())
+    assert not decision.allowed
+    assert decision.deny_reason == DENY_NO_CREDENTIAL_BYOK
+
+
+def test_company_workspace_cred() -> None:
+    decision = evaluate_run_authority(
+        _req(),
+        RunAuthorityContext(workspace_credential_mode="workspace", workspace_has_credential=True),
+    )
+    assert decision.allowed
+    assert decision.funding_source == FundingSource.COMPANY
+    assert decision.credential_scope == "workspace"
+
+
+def test_company_user_cred_wins() -> None:
+    decision = evaluate_run_authority(
+        _req(),
+        RunAuthorityContext(
+            workspace_credential_mode="workspace",
+            user_has_credential=True,
+            workspace_has_credential=True,
+        ),
+    )
+    assert decision.allowed
+    assert decision.funding_source == FundingSource.BYOK
+
+
+def test_user_only_no_fallback() -> None:
+    decision = evaluate_run_authority(
+        _req(),
+        RunAuthorityContext(provider_user_only=True, workspace_has_credential=True),
+    )
+    assert not decision.allowed
+    assert decision.deny_reason == DENY_PROVIDER_USER_ONLY
+
+
+def test_delegation_grantor() -> None:
+    decision = evaluate_run_authority(
+        _req(),
+        RunAuthorityContext(grantor_has_credential={"owner-1": True}),
+    )
+    assert decision.allowed
+    assert decision.payer_user_id == "owner-1"
+
+
+def test_delegation_no_grantor_cred() -> None:
+    decision = evaluate_run_authority(
+        _req(),
+        RunAuthorityContext(
+            workspace_credential_mode="workspace",
+            grantor_has_credential={"owner-1": False},
+        ),
+    )
+    assert not decision.allowed
+    assert decision.deny_reason == DENY_NO_CREDENTIAL_COMPANY
+
+
+if __name__ == "__main__":
+    test_byok_user_cred()
+    test_byok_no_cred_denied()
+    test_company_workspace_cred()
+    test_company_user_cred_wins()
+    test_user_only_no_fallback()
+    test_delegation_grantor()
+    test_delegation_no_grantor_cred()
+    print("test_run_authority: ok")