openedx-authz 2.1.0__tar.gz → 2.2.0__tar.gz

{openedx_authz-2.1.0 → openedx_authz-2.2.0}/.github/workflows/ci.yml

@@ -21,7 +21,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install uv
-        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
         with:
           enable-cache: true
           python-version: ${{ matrix.python-version }}

{openedx_authz-2.1.0 → openedx_authz-2.2.0}/.github/workflows/release.yml

@@ -87,4 +87,4 @@ jobs:
         path: dist/
 
     - name: Publish to PyPI
-      uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+      uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3

{openedx_authz-2.1.0/src/openedx_authz.egg-info → openedx_authz-2.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: openedx-authz
-Version: 2.1.0
+Version: 2.2.0
 Summary: Open edX AuthZ provides the architecture and foundations of the authorization framework.
 Author-email: Open edX Project <oscm@openedx.org>
 License-Expression: AGPL-3.0-or-later

{openedx_authz-2.1.0 → openedx_authz-2.2.0}/docs/decisions/0030-tutor-implementation-authz-schema-discovery.rst

@@ -102,7 +102,7 @@ Example rendered file with two plugin contributions:
 Schemas discovered through ``OPENEDX_AUTHZ_SCHEMA_FILES`` have no Python package or module. To satisfy the source-tracking requirements of `ADR 0025`_, their source record uses:
 
 * ``distribution`` = ``<tutor-patch>`` — a sentinel value that is an invalid Python package name, guaranteeing no collision with any installed distribution.
-* ``module`` = ``null`` — filesystem sources have no owning Python module, and using the absolute path would be inconsistent with the field's semantics elsewhere in the model.
+* ``module`` = the absolute filesystem path of the schema file (e.g. ``/openedx/config/authz-schema.yml``). Filesystem sources have no owning Python module, but reusing the path here keeps the ``(distribution, module)`` unique constraint enforceable and avoids the ``NULL``-handling complications that a ``null`` value would introduce across the ORM, migrations, and source-identity logic.
 * ``resource_path`` = the absolute filesystem path of the schema file (e.g. ``/openedx/config/authz-schema.yml``).
 * ``distribution_version`` = ``0.0.0`` — a sentinel value, since filesystem sources carry no package version.
 

{openedx_authz-2.1.0 → openedx_authz-2.2.0}/src/openedx_authz/engine/schema/discovery.py

@@ -1,7 +1,7 @@
 """Discover static authz schema resources (the ``discover`` step, ADR 0019).
 
-Providers register **directories** (not individual files); the loader reads
-every ``.yaml`` file inside them. Two contribution sources are merged:
+Providers register **directories** of ``.yaml`` files, or individual absolute
+filesystem paths. Three contribution sources are merged:
 
 1. The ``authz.schema`` entry-point group. Each registered callable returns
    directory paths in the package-anchored format below (e.g.
@@ -9,6 +9,10 @@ every ``.yaml`` file inside them. Two contribution sources are merged:
 2. The ``OPENEDX_AUTHZ_SCHEMA_DIRECTORIES`` Django setting, a list of directory
    path strings in the same format. This lets operators and CI contribute
    directories without shipping a package entry point.
+3. The ``OPENEDX_AUTHZ_SCHEMA_FILES`` Django setting, a list of absolute
+   filesystem paths each naming one schema file (ADR 0030). This is the route
+   used by the Tutor ``openedx-authz-schema`` patch to feed a rendered file
+   into discovery without anchoring it on a Python package.
 
 Directory format: these are **not** filesystem paths (neither relative nor
 absolute). Each is a package-anchored ``importlib.resources`` path: the first
@@ -36,12 +40,15 @@ import logging
 from dataclasses import dataclass
 from enum import StrEnum
 from importlib import metadata, resources
+from pathlib import Path
 
 from django.conf import settings
 from django.core.exceptions import ImproperlyConfigured
 
 ENTRY_POINT_GROUP = "authz.schema"
 SETTINGS_DIRECTORIES_NAME = "OPENEDX_AUTHZ_SCHEMA_DIRECTORIES"
+SETTINGS_FILE_SENTINEL = "<tutor-patch>"
+SETTINGS_FILE_VERSION = "0.0.0"
 SCHEMA_FILE_SUFFIXES = (".yaml", ".yml")
 
 logger = logging.getLogger(__name__)
@@ -101,6 +108,45 @@ class DiscoveredResource:
             ) from exc
 
 
+@dataclass(frozen=True)
+class DiscoveredFileResource(DiscoveredResource):
+    """A schema file discovered via an absolute filesystem path (ADR 0030).
+
+    Unlike :class:`DiscoveredResource`, which resolves through
+    ``importlib.resources``, this variant reads directly from the filesystem.
+    Fields are populated with sentinel values: ``package`` is
+    :data:`SETTINGS_FILE_SENTINEL` and both ``module`` and ``resource_path``
+    hold the absolute path.
+    """
+
+    @classmethod
+    def from_path(cls, file_path: str) -> DiscoveredFileResource:
+        """Build a resource from an absolute filesystem path.
+
+        Sentinel values are used for ``package`` and ``module`` because the
+        file is not anchored on any Python package.
+        """
+        return cls(
+            package=SETTINGS_FILE_SENTINEL,
+            resource_path=file_path,
+            module=file_path,
+            origin=Origin.SETTINGS,
+        )
+
+    def read_bytes(self) -> bytes:
+        """Read the file directly from the filesystem via :class:`pathlib.Path`.
+
+        Raises:
+            SchemaDiscoveryError: If the file cannot be read.
+        """
+        try:
+            return Path(self.resource_path).read_bytes()
+        except OSError as exc:
+            raise SchemaDiscoveryError(
+                f"Could not read schema file {self.resource_path!r}: {exc}"
+            ) from exc
+
+
 class SchemaDiscoveryError(Exception):
     """Raised when a provider fails or a declared directory cannot be read."""
 
@@ -139,6 +185,7 @@ class SchemaDiscovery:
         found: list[DiscoveredResource] = []
         found.extend(self._discover_entry_points())
         found.extend(self._discover_settings_directories())
+        found.extend(self._discover_settings_files())
         for directory in self._passed_in_directories:
             found.extend(self._iter_directory(directory, origin=Origin.PASSED_IN))
 
@@ -184,6 +231,48 @@ class SchemaDiscovery:
             discovered.extend(self._iter_directory(directory, origin=Origin.SETTINGS))
         return discovered
 
+    def _discover_settings_files(self) -> list[DiscoveredResource]:
+        """Read ``OPENEDX_AUTHZ_SCHEMA_FILES`` from Django settings (ADR 0030).
+
+        Each item is an absolute filesystem path to a single schema file.
+        Unlike ``_discover_settings_directories``, every listed path must exist
+        and have a supported extension; a missing or misnamed file is treated
+        as a misconfiguration and raises ``SchemaDiscoveryError``.
+
+        Absent, empty, or unconfigured settings yield nothing. As with
+        ``_discover_settings_directories``, ``ImproperlyConfigured`` degrades
+        to no contribution so CI can run outside a Django process.
+        """
+        try:
+            file_paths = getattr(settings, "OPENEDX_AUTHZ_SCHEMA_FILES", None) or []
+        except ImproperlyConfigured:
+            return []
+        if not isinstance(file_paths, list):
+            raise SchemaDiscoveryError(
+                "OPENEDX_AUTHZ_SCHEMA_FILES must be a list of filesystem paths, "
+                f"got {type(file_paths).__name__!r}."
+            )
+        discovered: list[DiscoveredResource] = []
+        for file_path in file_paths:
+            if not file_path.endswith(SCHEMA_FILE_SUFFIXES):
+                raise SchemaDiscoveryError(
+                    f"Schema file {file_path!r} contributed through "
+                    "OPENEDX_AUTHZ_SCHEMA_FILES has an unsupported file extension, "
+                    f"accepted extensions: {SCHEMA_FILE_SUFFIXES}"
+                )
+
+            path = Path(file_path)
+            if not path.is_file():
+                raise SchemaDiscoveryError(
+                    f"Schema file {file_path!r} contributed through "
+                    "OPENEDX_AUTHZ_SCHEMA_FILES is not an actual file"
+                )
+
+            discovered.append(
+                DiscoveredFileResource.from_path(file_path)
+            )
+        return discovered
+
     def _iter_directory(self, directory: str, *, origin: Origin) -> list[DiscoveredResource]:
         """Resolve a directory path and return one resource per ``.yaml`` file.
 

{openedx_authz-2.1.0 → openedx_authz-2.2.0}/src/openedx_authz/engine/schema/parsing.py

@@ -17,9 +17,13 @@ from importlib import metadata
 
 import yaml
 
-from openedx_authz.engine.schema.discovery import DiscoveredResource
+from openedx_authz.engine.schema.discovery import (
+    SETTINGS_FILE_VERSION,
+    DiscoveredFileResource,
+    DiscoveredResource,
+)
 from openedx_authz.engine.schema.exceptions import SchemaLoadError
-from openedx_authz.engine.schema.types import ParsedSchemaDocument, SourceRecord
+from openedx_authz.engine.schema.types import ParsedSchemaDocument, SourceFileRecord, SourceRecord
 
 logger = logging.getLogger(__name__)
 
@@ -42,17 +46,19 @@ class SchemaParser:
         documents = []
         for resource in resources:
             contents = resource.read_bytes()
-            data = self.parse_yaml(contents, resource)
-            schema_version = str(data.get("schema_version", "")) if isinstance(data, dict) else ""
-            source = self.build_source_record(resource, contents, schema_version)
-            documents.append(ParsedSchemaDocument(source=source, data=data))
+            for data in self.parse_yamls(contents, resource):
+                schema_version = str(data.get("schema_version", "")) if isinstance(data, dict) else ""
+                source = self.build_source_record(resource, contents, schema_version)
+                documents.append(ParsedSchemaDocument(source=source, data=data))
         return documents
 
     @staticmethod
-    def parse_yaml(contents: bytes, resource: DiscoveredResource) -> object:
-        """Parse YAML bytes and preserve the resulting root value."""
+    def parse_yamls(contents: bytes, resource: DiscoveredResource) -> list[object]:
+        """Parse YAML bytes as a multi-document stream, skipping empty 
+        documents, and preserve the resulting root value.
+        """
         try:
-            return yaml.safe_load(contents)
+            return [doc for doc in yaml.safe_load_all(contents) if doc is not None]
         except yaml.YAMLError as exc:
             raise SchemaLoadError(f"Invalid YAML in {resource.package}:{resource.resource_path}: {exc}") from exc
 
@@ -66,14 +72,17 @@ class SchemaParser:
         """
         distribution, version = self.resolve_distribution(resource)
         content_digest = hashlib.sha256(contents).hexdigest()
-        return SourceRecord(
-            distribution=distribution,
-            distribution_version=version,
-            module=resource.module,
-            resource_path=resource.resource_path,
-            schema_version=schema_version,
-            content_digest=content_digest,
-        )
+        source_record = {
+            'distribution': distribution,
+            'distribution_version': version,
+            'module': resource.module,
+            'resource_path': resource.resource_path,
+            'schema_version': schema_version,
+            'content_digest': content_digest,
+        }
+        if isinstance(resource, DiscoveredFileResource):
+            return SourceFileRecord(**source_record)
+        return SourceRecord(**source_record)
 
     @classmethod
     def resolve_distribution(cls, resource: DiscoveredResource) -> tuple[str, str]:
@@ -88,6 +97,8 @@ class SchemaParser:
         the one that actually ships this resource's file, and only fall back to
         a deterministic (sorted) choice when no single owner can be identified.
         """
+        if isinstance(resource, DiscoveredFileResource):
+            return resource.package, SETTINGS_FILE_VERSION
         top_level = resource.package.split(".", 1)[0]
         try:
             mapping = metadata.packages_distributions()

{openedx_authz-2.1.0 → openedx_authz-2.2.0}/src/openedx_authz/engine/schema/types/__init__.py

@@ -37,6 +37,7 @@ from openedx_authz.engine.schema.types.definitions import (
 from openedx_authz.engine.schema.types.loading import (
     ParsedSchemaDocument,
     SchemaDocument,
+    SourceFileRecord,
     SourceRecord,
 )
 
@@ -49,6 +50,7 @@ __all__ = [
     # loading
     "SourceRecord",
     "ParsedSchemaDocument",
+    "SourceFileRecord",
     "SchemaDocument",
     # compilation
     "RelationshipSource",

{openedx_authz-2.1.0 → openedx_authz-2.2.0}/src/openedx_authz/engine/schema/types/loading.py

@@ -60,6 +60,22 @@ class SourceRecord:
         return f"{self.distribution}:{module_path}/{filename}"
 
 
+@dataclass(frozen=True)
+class SourceFileRecord(SourceRecord):
+    """Source record for a filesystem-path schema resource (ADR 0030).
+
+    Overrides :attr:`source_id` to use the absolute path directly, since the
+    parent's ``module.replace(".", "/")`` convention assumes dotted Python
+    module paths and would corrupt a filesystem path containing a file
+    extension.
+    """
+
+    @property
+    def source_id(self) -> str:
+        """Return ``"<distribution>:<absolute_path>"``."""
+        return f"{self.distribution}:{self.resource_path}"
+
+
 @dataclass(frozen=True)
 class ParsedSchemaDocument:
     """One parsed YAML value and the provenance of the resource that supplied it."""

{openedx_authz-2.1.0 → openedx_authz-2.2.0}/src/openedx_authz/tests/schema/test_discovery.py

@@ -5,6 +5,7 @@ contract of :class:`SchemaDiscovery`:
 
 * ``TestDirectoryExpansion`` — a contributed directory expands to its YAML files.
 * ``TestSettingsDirectories`` — the operator/Tutor settings contribution route.
+* ``TestSettingsFiles`` — the filesystem-path contribution route (ADR 0030).
 * ``TestDiscoverySourcePrecedence`` — how sources merge and de-duplicate.
 * ``TestDiscoveryErrors`` — every failure surfaces as ``SchemaDiscoveryError``.
 * ``TestSchemaFileSelection`` — only YAML *files* are picked up.
@@ -15,6 +16,8 @@ import pytest
 from django.test import override_settings
 
 from openedx_authz.engine.schema.discovery import (
+    SETTINGS_FILE_SENTINEL,
+    DiscoveredFileResource,
     DiscoveredResource,
     Origin,
     SchemaDiscovery,
@@ -159,6 +162,136 @@ class TestSettingsDirectories:
         assert not SchemaDiscovery()._discover_settings_directories()
 
 
+class TestSettingsFiles:
+    """The filesystem-path contribution route (ADR 0030).
+
+    Tutor renders patch content into a YAML file and lists its absolute path
+    in ``OPENEDX_AUTHZ_SCHEMA_FILES``. These tests exercise
+    ``_discover_settings_files`` and ``DiscoveredFileResource`` in isolation.
+    """
+
+    @override_settings(OPENEDX_AUTHZ_SCHEMA_FILES=["/tmp/nonexistent/authz-schema.yaml"])
+    def test_nonexistent_file_raises(self):
+        """An explicitly listed file that does not exist is a misconfiguration."""
+        with pytest.raises(SchemaDiscoveryError, match="is not an actual file"):
+            SchemaDiscovery().discover()
+
+    @override_settings(OPENEDX_AUTHZ_SCHEMA_FILES=["/tmp/authz-schema.txt"])
+    def test_unsupported_extension_raises(self):
+        """A file with an unsupported extension is rejected even if it exists."""
+        with pytest.raises(SchemaDiscoveryError, match="unsupported file extension"):
+            SchemaDiscovery().discover()
+
+    def test_settings_file_is_discovered(self, tmp_path):
+        """A valid YAML file listed in the setting is discovered and readable."""
+        schema_file = tmp_path / "authz-schema.yaml"
+        schema_file.write_text("schema_version: '1.0'\npriority: 100\n", encoding="utf-8")
+
+        with self._override_files([str(schema_file)]):
+            resources = SchemaDiscovery().discover()
+
+        file_resources = [r for r in resources if isinstance(r, DiscoveredFileResource)]
+        assert len(file_resources) == 1
+        assert file_resources[0].resource_path == str(schema_file)
+        assert file_resources[0].package == SETTINGS_FILE_SENTINEL
+        assert file_resources[0].origin == Origin.SETTINGS
+
+    def test_contents_are_readable(self, tmp_path):
+        """A discovered file resource returns the file's bytes."""
+        schema_file = tmp_path / "roles.yml"
+        schema_file.write_text("schema_version: '1.0'\n", encoding="utf-8")
+
+        with self._override_files([str(schema_file)]):
+            resources = SchemaDiscovery().discover()
+
+        file_resources = [r for r in resources if isinstance(r, DiscoveredFileResource)]
+        assert b"schema_version" in file_resources[0].read_bytes()
+
+    def test_multiple_files_are_discovered(self, tmp_path):
+        """Multiple listed files are all discovered."""
+        file_a = tmp_path / "a.yaml"
+        file_b = tmp_path / "b.yml"
+        file_a.write_text("schema_version: '1.0'\n", encoding="utf-8")
+        file_b.write_text("schema_version: '1.0'\n", encoding="utf-8")
+
+        with self._override_files([str(file_a), str(file_b)]):
+            resources = SchemaDiscovery().discover()
+
+        file_resources = [r for r in resources if isinstance(r, DiscoveredFileResource)]
+        assert len(file_resources) == 2
+
+    def test_yml_and_yaml_extensions_are_accepted(self, tmp_path):
+        """Both ``.yml`` and ``.yaml`` suffixes are valid."""
+        for name in ("a.yml", "b.yaml"):
+            (tmp_path / name).write_text("schema_version: '1.0'\n", encoding="utf-8")
+
+        with self._override_files([str(tmp_path / "a.yml"), str(tmp_path / "b.yaml")]):
+            resources = SchemaDiscovery().discover()
+
+        file_resources = [r for r in resources if isinstance(r, DiscoveredFileResource)]
+        assert len(file_resources) == 2
+
+    def test_absent_setting_contributes_nothing(self):
+        """The default state: no deployment has declared the setting at all."""
+        # pylint: disable=protected-access
+        assert not SchemaDiscovery()._discover_settings_files()
+
+    @override_settings(OPENEDX_AUTHZ_SCHEMA_FILES=[])
+    def test_empty_setting_contributes_nothing(self):
+        """An empty list is a no-op, not an error."""
+        # pylint: disable=protected-access
+        assert not SchemaDiscovery()._discover_settings_files()
+
+    @override_settings(OPENEDX_AUTHZ_SCHEMA_FILES=None)
+    def test_none_setting_contributes_nothing(self):
+        """An explicit ``None`` degrades to no contribution."""
+        # pylint: disable=protected-access
+        assert not SchemaDiscovery()._discover_settings_files()
+
+    @override_settings(OPENEDX_AUTHZ_SCHEMA_FILES="/etc/authz/schema.yaml")
+    def test_non_list_setting_raises(self):
+        """A bare string instead of a list is rejected as a misconfiguration."""
+        with pytest.raises(SchemaDiscoveryError, match="must be a list"):
+            SchemaDiscovery().discover()
+
+    def test_unconfigured_django_contributes_nothing(self, monkeypatch):
+        """``ImproperlyConfigured`` degrades to no contribution."""
+        # pylint: disable=import-outside-toplevel
+        from django.conf import LazySettings
+        from django.core.exceptions import ImproperlyConfigured
+
+        def _unconfigured(_self, name):
+            raise ImproperlyConfigured(f"Requested setting {name}, but settings are not configured")
+
+        monkeypatch.setattr(LazySettings, "__getattr__", _unconfigured)
+
+        # pylint: disable=protected-access
+        assert not SchemaDiscovery()._discover_settings_files()
+
+    def test_file_resource_is_marked_with_settings_origin(self, tmp_path):
+        """``origin`` identifies the settings route."""
+        schema_file = tmp_path / "authz.yaml"
+        schema_file.write_text("schema_version: '1.0'\n", encoding="utf-8")
+
+        with self._override_files([str(schema_file)]):
+            # pylint: disable=protected-access
+            resources = SchemaDiscovery()._discover_settings_files()
+
+        assert {r.origin for r in resources} == {Origin.SETTINGS}
+
+    def test_unreadable_file_resource_raises(self, tmp_path):
+        """Reading a file that was removed after discovery raises ``SchemaDiscoveryError``."""
+        resource = DiscoveredFileResource.from_path(str(tmp_path / "gone.yaml"))
+
+        with pytest.raises(SchemaDiscoveryError, match="Could not read schema file"):
+            resource.read_bytes()
+
+    @staticmethod
+    def _override_files(paths):
+        """Convenience wrapper for ``override_settings(OPENEDX_AUTHZ_SCHEMA_FILES=...)``."""
+        return override_settings(OPENEDX_AUTHZ_SCHEMA_FILES=paths)
+
+
 class TestDiscoverySourcePrecedence:
     """Discovery merges sources in a fixed order and de-duplicates first-wins."""
 

{openedx_authz-2.1.0 → openedx_authz-2.2.0}/src/openedx_authz/tests/schema/test_loading.py

@@ -5,10 +5,18 @@ from importlib import metadata
 
 import pytest
 
-from openedx_authz.engine.schema.discovery import DiscoveredResource, Origin, SchemaDiscovery
+from openedx_authz.engine.schema.discovery import (
+    SETTINGS_FILE_SENTINEL,
+    SETTINGS_FILE_VERSION,
+    DiscoveredFileResource,
+    DiscoveredResource,
+    Origin,
+    SchemaDiscovery,
+)
 from openedx_authz.engine.schema.exceptions import SchemaLoadError
 from openedx_authz.engine.schema.loading import SchemaLoader
 from openedx_authz.engine.schema.parsing import UNKNOWN_DISTRIBUTION, SchemaParser
+from openedx_authz.engine.schema.types import SourceFileRecord
 
 from .factories import InMemoryResource
 
@@ -106,10 +114,15 @@ class TestDocumentLoading:
         assert docs[0].categories == []
         assert docs[0].roles == []
 
-    def test_completely_empty_file_cannot_be_loaded_as_a_typed_document(self):
-        """An empty root must pass structural validation before typed loading."""
-        with pytest.raises(SchemaLoadError, match="must be a mapping"):
-            _load(b"")
+    def test_completely_empty_file_yields_no_documents(self):
+        """An empty file parses to no YAML documents and yields an empty list.
+
+        With ``safe_load_all``, an empty stream produces no documents (ADR 0030:
+        empty documents are skipped silently). Validation is not reached.
+        """
+        docs = _load(b"")
+
+        assert not docs
 
     def test_invalid_yaml_raises_load_error(self):
         """Malformed YAML surfaces as ``SchemaLoadError``."""
@@ -619,3 +632,152 @@ class TestDistributionAmbiguityLogging:
         assert result1 == result2 == "dist1"
         # Only one log record because the warn_key is identical
         assert len(caplog.records) == 1
+
+
+class TestMultiDocumentStreams:
+    """Multi-document YAML loading (ADR 0030).
+
+    A single schema file may contain multiple ``---``-separated YAML documents,
+    each a complete, independent contribution with its own ``schema_version``
+    and ``priority``. This is how Tutor concatenates several plugin
+    contributions into one rendered file.
+    """
+
+    MULTI_DOC = b"""
+schema_version: '1.0'
+priority: 200
+
+role_extensions:
+  - role_id: course_editor
+    add_permissions: [courses.export_course]
+---
+schema_version: '1.0'
+priority: 100
+
+role_extensions:
+  - role_id: course_editor
+    remove_permissions: [courses.manage_tags]
+"""
+
+    def test_multi_document_stream_yields_multiple_documents(self):
+        """Two ``---``-separated documents yield two :class:`SchemaDocument` objects."""
+        docs = _load(self.MULTI_DOC)
+
+        assert len(docs) == 2
+        assert docs[0].priority == 200
+        assert docs[1].priority == 100
+
+    def test_each_document_has_its_own_schema_version(self):
+        """Each document carries its own ``schema_version``."""
+        docs = _load(self.MULTI_DOC)
+
+        assert docs[0].source.schema_version == "1.0"
+        assert docs[1].source.schema_version == "1.0"
+
+    def test_each_document_has_independent_extensions(self):
+        """Extensions from separate documents stay separate."""
+        docs = _load(self.MULTI_DOC)
+
+        assert docs[0].role_extensions[0].add_permissions == ("courses.export_course",)
+        assert docs[1].role_extensions[0].remove_permissions == ("courses.manage_tags",)
+
+    def test_trailing_separator_is_ignored(self):
+        """A trailing ``---`` produces a ``None`` document that is skipped."""
+        contents = b"schema_version: '1.0'\npriority: 1\n---\n"
+
+        docs = _load(contents)
+
+        assert len(docs) == 1
+        assert docs[0].priority == 1
+
+    def test_empty_document_between_separators_is_skipped(self):
+        """An empty ``---`` block between contributions is silently dropped."""
+        contents = (
+            b"schema_version: '1.0'\npriority: 1\n"
+            b"---\n"
+            b"---\n"
+            b"schema_version: '1.0'\npriority: 2\n"
+        )
+
+        docs = _load(contents)
+
+        assert len(docs) == 2
+        assert docs[0].priority == 1
+        assert docs[1].priority == 2
+
+    def test_comment_only_document_is_skipped(self):
+        """A document consisting solely of comments parses as ``None`` and is skipped."""
+        contents = b"# Just a comment\n---\nschema_version: '1.0'\npriority: 1\n"
+
+        docs = _load(contents)
+
+        assert len(docs) == 1
+        assert docs[0].priority == 1
+
+    def test_non_mapping_document_in_stream_raises(self):
+        """A non-mapping document embedded in a stream raises ``SchemaLoadError``."""
+        contents = b"schema_version: '1.0'\npriority: 1\n---\n- just\n- a\n- list\n"
+
+        with pytest.raises(SchemaLoadError, match="schema document must be a mapping"):
+            _load(contents)
+
+    def test_all_documents_share_the_same_content_digest(self):
+        """The content digest is per-resource (file), not per-document.
+
+        Multiple documents from the same file share the same digest since it is
+        computed from the raw file bytes.
+        """
+        docs = _load(self.MULTI_DOC)
+
+        assert docs[0].source.content_digest == docs[1].source.content_digest
+
+
+class TestFileSourceIdentity:
+    """Source identity for filesystem-path resources (ADR 0030).
+
+    Filesystem resources use sentinel values for distribution and version,
+    and ``SourceFileRecord`` overrides ``source_id`` to avoid garbling the
+    absolute path.
+    """
+
+    @staticmethod
+    def _load_file(tmp_path, contents: bytes = b"schema_version: '1.0'\npriority: 1\n"):
+        """Write a temp schema file, discover it, and load it."""
+        schema_file = tmp_path / "authz-schema.yaml"
+        schema_file.write_bytes(contents)
+        resource = DiscoveredFileResource.from_path(str(schema_file))
+        parsed_documents = SchemaParser().parse([resource])
+        return SchemaLoader().load(parsed_documents)
+
+    def test_distribution_is_the_sentinel(self, tmp_path):
+        """Filesystem resources use the ``<tutor-patch>`` sentinel as distribution."""
+        docs = self._load_file(tmp_path)
+
+        assert docs[0].source.distribution == SETTINGS_FILE_SENTINEL
+
+    def test_distribution_version_is_the_sentinel(self, tmp_path):
+        """Filesystem resources use ``0.0.0`` as their version sentinel."""
+        docs = self._load_file(tmp_path)
+
+        assert docs[0].source.distribution_version == SETTINGS_FILE_VERSION
+
+    def test_source_id_uses_the_absolute_path(self, tmp_path):
+        """``source_id`` is ``"<tutor-patch>:<absolute_path>"`` — no dot corruption."""
+        docs = self._load_file(tmp_path)
+        expected_path = str(tmp_path / "authz-schema.yaml")
+
+        assert docs[0].source.source_id == f"{SETTINGS_FILE_SENTINEL}:{expected_path}"
+
+    def test_source_record_is_a_source_file_record(self, tmp_path):
+        """The loader produces a ``SourceFileRecord`` for filesystem resources."""
+        docs = self._load_file(tmp_path)
+
+        assert isinstance(docs[0].source, SourceFileRecord)
+
+    def test_module_and_resource_path_are_the_absolute_path(self, tmp_path):
+        """Both ``module`` and ``resource_path`` record the absolute filesystem path."""
+        docs = self._load_file(tmp_path)
+        expected_path = str(tmp_path / "authz-schema.yaml")
+
+        assert docs[0].source.module == expected_path
+        assert docs[0].source.resource_path == expected_path

{openedx_authz-2.1.0 → openedx_authz-2.2.0}/src/openedx_authz/tests/schema/test_parsing.py

@@ -15,7 +15,6 @@ from openedx_authz.tests.schema.factories import InMemoryResource
     ("contents", "expected"),
     [
         (b"schema_version: '1.0'\npriority: 10\n", {"schema_version": "1.0", "priority": 10}),
-        (b"", None),
         (b"value", "value"),
         (b"- first\n- second\n", ["first", "second"]),
     ],

{openedx_authz-2.1.0 → openedx_authz-2.2.0/src/openedx_authz.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: openedx-authz
-Version: 2.1.0
+Version: 2.2.0
 Summary: Open edX AuthZ provides the architecture and foundations of the authorization framework.
 Author-email: Open edX Project <oscm@openedx.org>
 License-Expression: AGPL-3.0-or-later