fred-runtime 3.3.1__tar.gz → 3.3.2__tar.gz

{fred_runtime-3.3.1 → fred_runtime-3.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fred-runtime
-Version: 3.3.1
+Version: 3.3.2
 Summary: Runtime adapters and infrastructure wiring for Fred v2 agents.
 Author-email: Thales <noreply@thalesgroup.com>
 License: Apache-2.0

{fred_runtime-3.3.1 → fred_runtime-3.3.2}/fred_runtime/app/agent_app.py

@@ -56,6 +56,7 @@ from fastapi import APIRouter, Depends, FastAPI, HTTPException, Request, status
 from fastapi.middleware.cors import CORSMiddleware
 from fastapi.responses import StreamingResponse
 from fred_core.common.config_loader import get_config
+from fred_core.common.team_id import is_personal_team_id, personal_team_id
 from fred_core.history.history_schema import ChatMessage
 from fred_core.kpi import KPIMiddleware
 from fred_core.kpi.kpi_writer_structures import KPIActor
@@ -1127,6 +1128,12 @@ async def _authorize_execution_or_raise(
     - security disabled (no authenticated user) → skip (dev/local).
     - ReBAC engine absent or disabled (Noop) → skip (identity-only dev posture);
       the C3 profile guarantees an enabled engine in classified deployments.
+    - a personal space (`personal-<uid>`) is intrinsic ownership, not a stored
+      OpenFGA tuple: a human caller acting on their own canonical
+      `personal_team_id(authenticated_user.uid)` is authorized without an OpenFGA
+      call; any other `personal-*` id (another user's space, or the bare
+      `"personal"` alias) is explicitly denied — never routed to OpenFGA (AUTHZ-05
+      item 8b watch item).
     - otherwise require the caller to hold `CAN_READ` on the requested team — the
       same relation the control-plane required before it would mint a grant. The
       team is caller-supplied but safe: OpenFGA only authorizes teams the user
@@ -1202,6 +1209,36 @@ async def _authorize_execution_or_raise(
             agent_instance_id=request.agent_instance_id,
         )
         return
+    if team_id == "personal" or is_personal_team_id(team_id):
+        # Personal spaces are intrinsic ownership (AUTHZ-05 item 8b): the id is
+        # derived from the JWT subject via `personal_team_id`, is never persisted
+        # as an OpenFGA tuple, and must never be resolved by OpenFGA. Only an
+        # exact match against the caller's own canonical id is authorized; any
+        # other personal-* id (another user's space) or the bare "personal"
+        # alias (ambiguous once ReBAC is active) is denied here, before OpenFGA
+        # ever sees it.
+        if team_id == personal_team_id(authenticated_user.uid):
+            _emit_audit_event(
+                container,
+                "info",
+                "personal_space_owner_authorized",
+                user_id=authenticated_user.uid,
+                team_id=team_id,
+                agent_instance_id=request.agent_instance_id,
+            )
+            return
+        _emit_audit_event(
+            container,
+            "warning",
+            "personal_space_denied",
+            user_id=authenticated_user.uid,
+            team_id=team_id,
+            agent_instance_id=request.agent_instance_id,
+        )
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail=f"user {authenticated_user.uid!r} is not authorized for team {team_id!r}",
+        )
     try:
         await rebac.check_user_team_permission_or_raise(
             authenticated_user, TeamPermission.CAN_READ, team_id
@@ -2054,7 +2091,6 @@ async def _iterate_runtime_event_payloads(
         checkpoint_id=resolved_checkpoint_id,
         user_id=ctx.get("user_id"),
         team_id=resolved_team_id,
-        user_groups=ctx.get("user_groups"),
         language=ctx.get("language"),
         access_token=access_token,
         refresh_token=ctx.get("refresh_token"),
@@ -2258,11 +2294,19 @@ def _build_agent_router(
         - developers need to validate KPI emission from the CLI without
           Grafana or Prometheus; this exposes the pod-local ring buffer
         - max 200 entries retained in memory (oldest evicted automatically)
+
+        AUTHZ-05 review finding: item 8a's org-level CAN_READ_METRICS removal
+        does not apply here — unlike the tier-2 capability it replaced
+        (near-universal, protected nothing specific), this buffer holds
+        cross-user/cross-team data (session_id, exchange_id, user_id, team_id,
+        token counts) for every caller that has hit this pod, not just the
+        caller's own. Gated the same way as the sibling `get_audit_events`
+        below, on `CAN_MANAGE_PLATFORM`, not deleted outright.
         """
         rebac = get_runtime_context().config.rebac_engine
         if caller is not None and rebac is not None and rebac.enabled:
             await rebac.check_user_permission_or_raise(
-                caller, OrganizationPermission.CAN_READ_METRICS, ORGANIZATION_ID
+                caller, OrganizationPermission.CAN_MANAGE_PLATFORM, ORGANIZATION_ID
             )
         with container._kpi_turns_lock:
             events = list(container.kpi_turns_buffer)
@@ -2991,8 +3035,10 @@ def _build_agent_router(
           stream closes. Do not rely on it as an end-of-turn signal here.
 
         Security:
-        - For managed execution (agent_instance_id), an execution_grant issued by
-          control-plane is required. The runtime validates it structurally.
+        - There is no ExecutionGrant. Identity is the caller's Keycloak JWT; for
+          managed execution (agent_instance_id) the runtime authorizes each request
+          itself with a per-request ReBAC (OpenFGA) check on runtime_context.team_id.
+          The control plane issues no signed grant or capability token.
         - RBAC via Keycloak and REBAC via OpenFGA protect this endpoint.
 
         Architectural note:

{fred_runtime-3.3.1 → fred_runtime-3.3.2}/fred_runtime/common/mcp_runtime.py

@@ -18,8 +18,9 @@ from __future__ import annotations
 
 import asyncio
 import logging
+import time
 from collections.abc import Awaitable, Iterable
-from typing import Any, Callable, List, Optional, cast
+from typing import Any, Callable, List, Optional, Tuple, cast
 
 from fred_sdk.contracts.context import RuntimeContext as AgentRuntimeContext
 from fred_sdk.contracts.models import (
@@ -45,6 +46,105 @@ logger = logging.getLogger(__name__)
 MCP_CONNECT_MAX_ATTEMPTS = 3
 MCP_CONNECT_RETRY_BASE_DELAY_SECS = 0.5
 
+# --- Cross-request connect/tool-list cache (perf) -----------------------------
+# BENCH-<pending id>: `_run_lifecycle` used to reconnect + re-list tools against
+# every configured MCP server on EVERY agent turn (measured: ~2-3s wall time for
+# a 7-server agent, with a near-instant mock LLM). `MultiServerMCPClient` itself
+# holds no persistent resources (see `_close_mcp_client_quietly` below), so the
+# per-turn cost was purely the repeated connect+list_tools round trips, not
+# anything a "closed" connection would have saved by staying open.
+#
+# This cache reuses the (client, tools) pair across turns for the SAME agent +
+# server set + access token, so repeat turns in a session (or across sessions
+# for the same user/dev token) skip the round trips entirely.
+#
+# Auth freshness on a cache hit: `langchain_mcp_adapters` reads `tool_interceptors`
+# (and per-server `headers`) live off the client instance at call time, not from a
+# snapshot frozen at discovery time (verified against langchain_mcp_adapters==0.3.0
+# — see `execute_tool`/`_build_interceptor_chain` in its `tools.py`). So on a cache
+# hit we mutate `client.tool_interceptors` IN PLACE (never reassign the list) to the
+# CURRENT request's own interceptors before handing the client back — every request
+# still gets its own live `ExpiredTokenRetryInterceptor` (bound to ITS OWN, live
+# `agent_instance`/token-refresh callback), even though the underlying connection +
+# discovered tool schemas are shared. Headers don't need the same treatment: the
+# cache key already includes the exact access_token string, so a cache hit implies
+# an identical token/header value already.
+#
+# Residual, accepted race: two truly concurrent requests for the SAME identity
+# (same cache key) could have request A's in-flight tool call pick up request B's
+# interceptor instance instead of its own. Both point at the same live user, so
+# this is never a cross-user leak — at worst a harmless same-identity mix-up.
+# Closing it fully would need a lock held for an entire turn's tool-calling phase,
+# which would serialize concurrent turns for the same user; not worth it.
+MCP_CLIENT_CACHE_TTL_SECS = 300.0
+_mcp_client_cache: dict[
+    Tuple[str, Tuple[str, ...], str], Tuple[MultiServerMCPClient, List[BaseTool], float]
+] = {}
+_mcp_client_cache_lock = asyncio.Lock()
+
+
+def _mcp_cache_key(
+    agent_id: str, servers: List[MCPServerConfiguration], access_token: str | None
+) -> Tuple[str, Tuple[str, ...], str]:
+    return (agent_id, tuple(sorted(s.id for s in servers)), access_token or "")
+
+
+def _prune_expired_mcp_cache_locked(now: float) -> None:
+    """
+    Drop every expired entry from `_mcp_client_cache`.
+
+    Why this exists:
+    - a cache hit only checks the ONE key being looked up; without this, any
+      OTHER key that expires (e.g. a rotated user token, an agent that stops
+      being used) stays resident in process memory forever — a real memory
+      leak over a long-running pod's life, and it keeps stale `Authorization`
+      headers (the cache key embeds the raw access_token) around indefinitely.
+
+    How to use it:
+    - call under `_mcp_client_cache_lock`, before a lookup or insert.
+    """
+    expired = [k for k, v in _mcp_client_cache.items() if v[2] <= now]
+    for k in expired:
+        del _mcp_client_cache[k]
+
+
+async def _get_or_connect_mcp_client(
+    *,
+    agent_id: str,
+    mcp_servers: List[MCPServerConfiguration],
+    runtime_context: AgentRuntimeContext,
+    tool_interceptors: list,
+) -> Tuple[MultiServerMCPClient, List[BaseTool]]:
+    key = _mcp_cache_key(agent_id, mcp_servers, runtime_context.access_token)
+    now = time.monotonic()
+
+    async with _mcp_client_cache_lock:
+        _prune_expired_mcp_cache_locked(now)
+        cached = _mcp_client_cache.get(key)
+        if cached is not None and cached[2] > now:
+            cached_client = cached[0]
+            # In-place mutation only — reassigning `.tool_interceptors` would not
+            # be seen by tool closures already vended from a prior get_tools()
+            # call (they hold a reference to the original list object).
+            cached_client.tool_interceptors[:] = tool_interceptors
+            logger.info(
+                "[MCP] agent=%s cache hit: reusing connected client (%d tools), "
+                "current request's interceptors swapped in.",
+                agent_id,
+                len(cached[1]),
+            )
+            return cached_client, cached[1]
+
+    client, tools = await get_connected_mcp_client_for_agent(
+        agent_id=agent_id,
+        mcp_servers=mcp_servers,
+        runtime_context=runtime_context,
+        tool_interceptors=tool_interceptors,
+    )
+    async with _mcp_client_cache_lock:
+        _mcp_client_cache[key] = (client, tools, now + MCP_CLIENT_CACHE_TTL_SECS)
+    return client, tools
+
 
 async def _close_mcp_client_quietly(client: Optional[MultiServerMCPClient]) -> None:
     if not client:
@@ -245,29 +345,23 @@ class MCPRuntime:
             if refresh_cb:
                 interceptors.append(ExpiredTokenRetryInterceptor(refresh_cb))
 
-            new_client = await get_connected_mcp_client_for_agent(
+            new_client, tools = await _get_or_connect_mcp_client(
                 agent_id=self._agent_id,
                 mcp_servers=self.remote_servers,
                 runtime_context=runtime_context,
                 tool_interceptors=interceptors,
             )
             self.mcp_client = new_client
+            # `tools` were already fetched (per server) while connecting/validating
+            # above — reuse them instead of paying for a second get_tools() round
+            # trip against every server on every single turn.
             self.toolkit = McpToolkit(client=new_client, agent=self.agent_instance)
-            try:
-                # Pre-fetch tools once (async) and cache in toolkit for sync callers
-                tools = await new_client.get_tools()
-                self.toolkit.tools = tools
-                logger.info(
-                    "[MCP] agent=%s init: Prefetched and cached %d tools.",
-                    self._agent_id,
-                    len(tools),
-                )
-            except Exception:
-                logger.warning(
-                    "[MCP] agent=%s init: Failed to prefetch tools; toolkit will attempt best-effort discovery later.",
-                    self._agent_id,
-                    exc_info=True,
-                )
+            self.toolkit.tools = tools
+            logger.info(
+                "[MCP] agent=%s init: Connected and cached %d tools.",
+                self._agent_id,
+                len(tools),
+            )
             logger.info(
                 "[MCP] agent=%s init: Successfully built and connected client.",
                 self._agent_id,

{fred_runtime-3.3.1 → fred_runtime-3.3.2}/fred_runtime/common/mcp_utils.py

@@ -25,7 +25,8 @@ Contract
 --------
 - Requires an `access_token_provider` (a callable) to fetch the user's token
   before connecting to any MCP server.
-- Returns a connected `MultiServerMCPClient`.
+- Returns a connected `MultiServerMCPClient` plus the tools already fetched
+  while validating each server (see `get_connected_mcp_client_for_agent`).
 - Raises `ExceptionGroup` if **any** server fails to connect.
 
 """
@@ -35,10 +36,11 @@ from __future__ import annotations
 import logging
 import time
 from datetime import timedelta
-from typing import Dict, List
+from typing import Dict, List, Tuple
 
 from fred_sdk.contracts.context import RuntimeContext
 from fred_sdk.contracts.models import MCPServerConfiguration
+from langchain_core.tools import BaseTool
 from langchain_mcp_adapters.client import MultiServerMCPClient
 from langchain_mcp_adapters.sessions import Connection, StreamableHttpConnection
 
@@ -184,10 +186,14 @@ async def get_connected_mcp_client_for_agent(
     *,
     tool_interceptors: list | None = None,
     # -----------------------------------------------
-) -> MultiServerMCPClient:
+) -> Tuple[MultiServerMCPClient, List[BaseTool]]:
     """
     Creates and connects the MultiServerMCPClient using the token provided by
     `access_token_provider`. Supports `streamable_http` and `stdio` transports.
+
+    Also returns the tools fetched per server during connection validation, so
+    callers don't have to pay for a second `get_tools()` round trip against
+    every server just to populate their toolkit (see mcp_runtime.py).
     """
 
     for s in mcp_servers:
@@ -262,10 +268,13 @@ async def get_connected_mcp_client_for_agent(
         connections, tool_interceptors=tool_interceptors or []
     )
 
-    # Validate connections by attempting to load tools per server
+    # Validate connections by attempting to load tools per server. This is also
+    # the ONLY tool-fetch round trip we make per server — the fetched tools are
+    # returned to the caller so `MCPRuntime._run_lifecycle` doesn't need to call
+    # `client.get_tools()` again across all servers right after this returns.
     exceptions: list[Exception] = []
     failure_messages: list[str] = []
-    total_tools = 0
+    fetched_tools: list[BaseTool] = []
     for server in mcp_servers:
         conn_entry = connections.get(server.id) or {}
         transport = conn_entry.get("transport", "unknown")
@@ -294,7 +303,7 @@ async def get_connected_mcp_client_for_agent(
                 len(tools),
                 dur_ms,
             )
-            total_tools += len(tools)
+            fetched_tools.extend(tools)
         except Exception as e:
             dur_ms = (time.perf_counter() - start) * 1000
             logger.warning(
@@ -328,6 +337,6 @@ async def get_connected_mcp_client_for_agent(
     logger.debug(
         "[MCP][%s] summary: all servers validated, total tools=%d",
         agent_id,
-        total_tools,
+        len(fetched_tools),
     )
-    return client
+    return client, fetched_tools

{fred_runtime-3.3.1 → fred_runtime-3.3.2}/fred_runtime/graph/graph_runtime.py

@@ -1906,7 +1906,6 @@ def _graph_phase_timer(
     return metrics.timer(
         "app.phase_latency_ms",
         dims=dims,
-        groups=binding.runtime_context.user_groups,
     )
 
 

{fred_runtime-3.3.1 → fred_runtime-3.3.2}/fred_runtime/integrations/v2_runtime/adapters.py

@@ -1903,11 +1903,10 @@ class KPIWriterMetricsAdapter(MetricsProvider):
         name: str,
         *,
         dims: dict[str, str | None] | None = None,
-        groups: list[str] | None = None,
     ) -> Generator[dict[str, str | None], None, None]:
         with self._kpi.timer(
             name,
             dims=dims,
-            actor=KPIActor(type="system", groups=groups),
+            actor=KPIActor(type="system"),
         ) as recorded_dims:
             yield recorded_dims

{fred_runtime-3.3.1 → fred_runtime-3.3.2}/fred_runtime/react/react_runtime.py

@@ -322,7 +322,6 @@ class _TransportBackedReActExecutor(Executor[ReActInput, ReActOutput]):
                     "agent_instance_id": baggage.get("agent_instance_id"),
                     "template_agent_id": baggage.get("template_agent_id"),
                 },
-                groups=self._binding.runtime_context.user_groups,
             )
         else:
             phase_timer_ctx = nullcontext()

{fred_runtime-3.3.1 → fred_runtime-3.3.2}/fred_runtime.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fred-runtime
-Version: 3.3.1
+Version: 3.3.2
 Summary: Runtime adapters and infrastructure wiring for Fred v2 agents.
 Author-email: Thales <noreply@thalesgroup.com>
 License: Apache-2.0

{fred_runtime-3.3.1 → fred_runtime-3.3.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "fred-runtime"
-version = "3.3.1"
+version = "3.3.2"
 description = "Runtime adapters and infrastructure wiring for Fred v2 agents."
 readme = "README.md"
 requires-python = ">=3.12,<3.13"

{fred_runtime-3.3.1 → fred_runtime-3.3.2}/tests/test_agent_app.py

@@ -29,8 +29,10 @@ from typing import cast
 
 import pytest
 from conftest import StaticChatModelFactory, ToolFriendlyFakeChatModel
+from fastapi.routing import APIRoute
 from fastapi.testclient import TestClient
 from fred_core.common.config_loader import get_config
+from fred_core.common.team_id import personal_team_id
 from fred_core.kpi.kpi_writer import KPIWriter
 from fred_core.kpi.log_kpi_store import KpiLogStore
 from fred_core.kpi.prometheus_kpi_store import PrometheusKPIStore
@@ -1693,7 +1695,7 @@ def _wire_engine(
     )
 
 
-_ALICE = KeycloakUser(uid="alice", username="alice", roles=[], email=None, groups=[])
+_ALICE = KeycloakUser(uid="alice", username="alice", roles=[], email=None)
 
 
 @pytest.mark.asyncio
@@ -1824,7 +1826,6 @@ _WORKER = KeycloakUser(
     username="service-account-fred-evaluation-worker",
     roles=["service_agent"],
     email=None,
-    groups=[],
 )
 
 
@@ -1869,6 +1870,72 @@ async def test_authorize_service_agent_still_requires_team(
     assert engine.calls == []
 
 
+_BOB = KeycloakUser(uid="bob", username="bob", roles=[], email=None)
+
+
+@pytest.mark.asyncio
+async def test_authorize_allows_personal_space_owner_without_openfga(
+    monkeypatch, minimal_config
+) -> None:
+    """A human caller acting on their own canonical personal_team_id is authorized
+    as intrinsic ownership — no OpenFGA call (AUTHZ-05 item 8b watch item)."""
+    engine = _FakeRebacEngine(enabled=True, deny=True)  # would deny if consulted
+    _wire_engine(monkeypatch, engine)
+    container = PodApplicationContext(minimal_config)
+
+    await agent_app_module._authorize_execution_or_raise(
+        _managed_request(team_id=personal_team_id(_ALICE.uid)), _ALICE, container
+    )
+
+    assert engine.calls == []
+    with container._audit_events_lock:
+        events = list(container.audit_events_buffer)
+    assert events[-1]["audit_event"] == "personal_space_owner_authorized"
+    assert events[-1].get("team_id") == personal_team_id(_ALICE.uid)
+
+
+@pytest.mark.asyncio
+async def test_authorize_denies_other_users_personal_space(
+    monkeypatch, minimal_config
+) -> None:
+    """Alice requesting Bob's personal space is denied outright — a permissive
+    (or residual) OpenFGA tuple must never be able to rescue this."""
+    engine = _FakeRebacEngine(enabled=True, deny=False)  # would allow if consulted
+    _wire_engine(monkeypatch, engine)
+    container = PodApplicationContext(minimal_config)
+
+    with pytest.raises(agent_app_module.HTTPException) as exc:
+        await agent_app_module._authorize_execution_or_raise(
+            _managed_request(team_id=personal_team_id(_BOB.uid)), _ALICE, container
+        )
+
+    assert exc.value.status_code == 403
+    assert engine.calls == []
+    with container._audit_events_lock:
+        events = list(container.audit_events_buffer)
+    assert events[-1]["audit_event"] == "personal_space_denied"
+    assert events[-1].get("user_id") == "alice"
+
+
+@pytest.mark.asyncio
+async def test_authorize_denies_ambiguous_personal_alias(
+    monkeypatch, minimal_config
+) -> None:
+    """The bare "personal" alias is ambiguous once ReBAC is active — reject it
+    rather than resolving it as if it meant the caller's own space."""
+    engine = _FakeRebacEngine(enabled=True, deny=False)
+    _wire_engine(monkeypatch, engine)
+    container = PodApplicationContext(minimal_config)
+
+    with pytest.raises(agent_app_module.HTTPException) as exc:
+        await agent_app_module._authorize_execution_or_raise(
+            _managed_request(team_id="personal"), _ALICE, container
+        )
+
+    assert exc.value.status_code == 403
+    assert engine.calls == []
+
+
 # ---------------------------------------------------------------------------
 # RUNTIME-07 rev. 2 (F-B / F-C) — JWT identity + private-per-owner sessions
 # ---------------------------------------------------------------------------
@@ -1964,7 +2031,9 @@ async def test_session_ownership_skipped_when_security_disabled(
 
 
 class _FakePlatformRebacEngine:
-    """RebacEngine stand-in exposing has_user_permission for the C1 admin branch."""
+    """RebacEngine stand-in exposing has_user_permission for the C1 admin branch,
+    plus check_user_permission_or_raise for the /kpi-turns and /audit-events
+    ring-buffer endpoints' CAN_MANAGE_PLATFORM gate."""
 
     def __init__(self, *, enabled: bool, grant: bool) -> None:
         self._enabled = enabled
@@ -1981,6 +2050,13 @@ class _FakePlatformRebacEngine:
         self.calls.append((user.uid, permission, resource_id))
         return self._grant
 
+    async def check_user_permission_or_raise(
+        self, user: KeycloakUser, permission: object, resource_id: str, **_kw: object
+    ) -> None:
+        self.calls.append((user.uid, permission, resource_id))
+        if not self._grant:
+            raise AuthorizationError(user.uid, str(permission), Resource.RESOURCES)
+
 
 @pytest.mark.asyncio
 async def test_caller_can_manage_platform_true_when_enabled_and_granted(
@@ -2027,6 +2103,59 @@ async def test_caller_can_manage_platform_false_when_no_caller(monkeypatch) -> N
     assert engine.calls == []
 
 
+def _get_kpi_turns_endpoint():
+    """Grab the `/kpi-turns` route's raw endpoint function, bypassing FastAPI's
+    dependency-injection layer so it can be called directly with explicit args."""
+    router = agent_app_module._build_agent_router(registry={}, security_enabled=True)
+    return next(
+        route.endpoint
+        for route in router.routes
+        if isinstance(route, APIRoute) and route.endpoint.__name__ == "get_kpi_turns"
+    )
+
+
+@pytest.mark.asyncio
+async def test_get_kpi_turns_requires_can_manage_platform_when_enforcing(
+    monkeypatch, minimal_config
+) -> None:
+    """AUTHZ-05 review finding: item 8a's blanket removal of the org-level
+    CAN_READ_METRICS check does not apply to this ring buffer — it exposes
+    cross-user/cross-team session_id/user_id/team_id/token data for every
+    caller that has hit this pod, unlike the tier-2 capabilities item 8a
+    correctly deleted elsewhere. Gated on CAN_MANAGE_PLATFORM, same as the
+    sibling `get_audit_events`, when ReBAC is actually enforcing."""
+    endpoint = _get_kpi_turns_endpoint()
+    container = PodApplicationContext(minimal_config)
+
+    denying_engine = _FakePlatformRebacEngine(enabled=True, grant=False)
+    _wire_engine(monkeypatch, denying_engine)
+    with pytest.raises(AuthorizationError):
+        await endpoint(limit=10, container=container, caller=_ALICE)
+    assert denying_engine.calls == [
+        ("alice", OrganizationPermission.CAN_MANAGE_PLATFORM, ORGANIZATION_ID)
+    ]
+
+    granting_engine = _FakePlatformRebacEngine(enabled=True, grant=True)
+    _wire_engine(monkeypatch, granting_engine)
+    assert await endpoint(limit=10, container=container, caller=_ALICE) == []
+
+
+@pytest.mark.asyncio
+async def test_get_kpi_turns_unchanged_in_dev_mode(monkeypatch, minimal_config) -> None:
+    """Dev/no-security mode (no caller, or ReBAC disabled) stays exactly as
+    before this fix: the diagnostic buffer remains reachable without a grant."""
+    endpoint = _get_kpi_turns_endpoint()
+    container = PodApplicationContext(minimal_config)
+
+    _wire_engine(monkeypatch, None)
+    assert await endpoint(limit=10, container=container, caller=None) == []
+
+    disabled_engine = _FakePlatformRebacEngine(enabled=False, grant=False)
+    _wire_engine(monkeypatch, disabled_engine)
+    assert await endpoint(limit=10, container=container, caller=_ALICE) == []
+    assert disabled_engine.calls == []  # a disabled engine is never consulted
+
+
 @pytest.mark.asyncio
 async def test_identity_is_stamped_from_jwt_and_body_tokens_neutralized(
     monkeypatch, minimal_config

{fred_runtime-3.3.1 → fred_runtime-3.3.2}/tests/test_react_thinking.py

@@ -332,7 +332,7 @@ class _FakePortable:
 
 
 class _FakeRuntimeContext:
-    user_groups: tuple[str, ...] = ()
+    pass
 
 
 class _FakeBinding: