store-rbac-bootstrap-py 0.1.0__tar.gz

store_rbac_bootstrap_py-0.1.0/PKG-INFO

@@ -0,0 +1,10 @@
+Metadata-Version: 2.4
+Name: store-rbac-bootstrap-py
+Version: 0.1.0
+Summary: Optional skin-layer bootstrap for common-store RBAC: policy bootstrap (set_rbac + role-rule configs) and credential-to-context factories (JWT / API-Key / Session) for the context_provider seams of store-api / store-grpc / store-graphql
+License: MIT
+Keywords: py-store,rbac,bootstrap,context,jwt,skin
+Requires-Python: >=3.10
+Requires-Dist: PyJWT>=2.8
+Provides-Extra: dev
+Requires-Dist: pytest>=8; extra == "dev"

store_rbac_bootstrap_py-0.1.0/pyproject.toml

@@ -0,0 +1,21 @@
+[project]
+name = "store-rbac-bootstrap-py"
+version = "0.1.0"
+description = "Optional skin-layer bootstrap for common-store RBAC: policy bootstrap (set_rbac + role-rule configs) and credential-to-context factories (JWT / API-Key / Session) for the context_provider seams of store-api / store-grpc / store-graphql"
+requires-python = ">=3.10"
+license = { text = "MIT" }
+keywords = ["py-store", "rbac", "bootstrap", "context", "jwt", "skin"]
+dependencies = ["PyJWT>=2.8"]
+
+[project.optional-dependencies]
+dev = ["pytest>=8"]
+
+[build-system]
+requires = ["setuptools>=68"]
+build-backend = "setuptools.build_meta"
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]

store_rbac_bootstrap_py-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

store_rbac_bootstrap_py-0.1.0/src/store_rbac_bootstrap/__init__.py

@@ -0,0 +1,219 @@
+"""store-rbac-bootstrap-py — RBAC 皮肤层插件包（第一期消费面）。
+
+唯一事实源：spec/00-protocol.md。零判决、零语义发明、零宿主依赖。
+"""
+from __future__ import annotations
+
+import inspect
+import json
+import urllib.request
+from pathlib import Path
+from types import SimpleNamespace
+
+import jwt as _jwt  # PyJWT
+
+_ALLOWED_KEYS = ("policy", "exemptRoles", "denyWriteRoles", "unconfiguredPolicy")
+_FACADES = ("set_rbac", "set_exempt_roles", "set_deny_write_roles", "set_unconfigured_policy")
+
+
+async def _call(fn, arg):
+    """门面调用：sync 直接调；返回 awaitable（宿主支持 async 门面时）则 await。"""
+    result = fn(arg)
+    if inspect.isawaitable(result):
+        result = await result
+    return result
+
+
+def file(path):                                    # 策略源 ①：本地文件
+    async def source():
+        return json.loads(Path(path).read_text(encoding="utf-8"))
+    return source
+
+
+def url(u, headers=None):                          # 策略源 ②：远端策略分发服务
+    async def source():
+        req = urllib.request.Request(u, headers=headers or {})
+        with urllib.request.urlopen(req) as resp:
+            if not (200 <= resp.status < 300):
+                raise ValueError(f"策略源请求失败: {resp.status} {u}")
+            return json.loads(resp.read().decode("utf-8"))
+    return source
+
+
+def db(loader):                                    # 策略源 ③：DB / 配置中心
+    async def source():
+        result = loader()
+        return await result if inspect.isawaitable(result) else result
+    return source
+
+
+def _validate(config):
+    """校验先于应用；任一不符即抛 ValueError（此时零门面调用）。"""
+    if not isinstance(config, dict):
+        raise ValueError("引导配置必须是 JSON 对象")
+    unknown = [k for k in config if k not in _ALLOWED_KEYS]
+    if unknown:
+        raise ValueError(f"引导配置含未知键: {', '.join(unknown)}")
+    for key in ("exemptRoles", "denyWriteRoles"):
+        v = config.get(key)
+        if v is not None and (not isinstance(v, list) or any(not isinstance(r, str) for r in v)):
+            raise ValueError(f"引导配置 {key} 必须是字符串数组")
+    p = config.get("unconfiguredPolicy")
+    if p is not None and p not in ("open", "closed"):
+        raise ValueError('引导配置 unconfiguredPolicy 只能是 "open" 或 "closed"')
+
+
+class _Handle:
+    def __init__(self, store, source):
+        self._store = store
+        self._source = source
+
+    async def start(self):
+        config = await self._source()              # 读取失败原样上抛（不吞错）
+        _validate(config)                          # 校验先于应用
+        await _call(self._store.set_exempt_roles, config.get("exemptRoles", []))
+        await _call(self._store.set_deny_write_roles, config.get("denyWriteRoles", []))
+        await _call(self._store.set_unconfigured_policy, config.get("unconfiguredPolicy", "open"))
+        await _call(self._store.set_rbac, config.get("policy", None))   # 策略最后生效
+
+    async def reload(self):
+        await _call(self._store.set_rbac, None)    # 先清除，再重注入
+        await self.start()
+
+
+def create(store, source):
+    if store is None:
+        raise ValueError("policy.create 需要 store 实例")
+    for name in _FACADES:
+        if not callable(getattr(store, name, None)):
+            raise ValueError(f"store 缺少门面方法: {name}")
+    if not callable(source):
+        raise ValueError("policy.create 需要 source（策略源函数）")
+    return _Handle(store, source)
+
+
+policy = SimpleNamespace(file=file, url=url, db=db, create=create)
+
+# ------------------------------------------------------------------ #
+# identity：身份源适配（凭证 → {userId, roles} → 各皮 context_provider 接缝）
+# ------------------------------------------------------------------ #
+
+
+def _headers_to_bag(headers):
+    """普通 Mapping → {lower: 首个字符串值}；非字符串丢弃。"""
+    bag = {}
+    if not headers:
+        return bag
+    for k, v in dict(headers).items():
+        if v is None:
+            continue
+        bag.setdefault(str(k).lower(), v if isinstance(v, str) else str(v))
+    return bag
+
+
+def _metadata_to_bag(invocation_metadata):
+    """gRPC invocation_metadata（(key, value) 序列 或 支持 .get 的对象）→ 同形 bag。"""
+    bag = {}
+    if not invocation_metadata:
+        return bag
+    if hasattr(invocation_metadata, "get") and not isinstance(invocation_metadata, (list, tuple)):
+        # 对象形态：已知键按需取（authorization / x-api-key / cookie）
+        for name in ("authorization", "x-api-key", "cookie"):
+            v = invocation_metadata.get(name)
+            if v:
+                bag[name] = v if isinstance(v, str) else str(v)
+        return bag
+    for item in invocation_metadata:               # (key, value) 序列形态
+        k, v = item[0], item[1]
+        bag.setdefault(str(k).lower(), v if isinstance(v, str) else str(v))
+    return bag
+
+
+def _parse_cookie(cookie_header, name):
+    for part in (cookie_header or "").split(";"):
+        if "=" in part:
+            k, _, v = part.partition("=")
+            if k.strip() == name:
+                return v.strip()
+    return None
+
+
+def jwt(secret, algorithm="HS256", header="authorization",
+        user_id_claim="sub", roles_claim="roles"):
+    if not isinstance(secret, str) or not secret:
+        raise ValueError("identity.jwt 需要非空 secret")
+    if algorithm not in ("HS256", "HS384", "HS512"):
+        raise ValueError(f"identity.jwt 首期仅支持 HS 系算法（收到 {algorithm}）")
+
+    async def decode(bag):
+        raw = bag.get(header.lower())
+        if not raw:
+            return None                            # 无凭证 → None（显式清除）
+        token = raw[7:] if raw.startswith("Bearer ") else raw
+        try:
+            payload = _jwt.decode(token, secret, algorithms=[algorithm])
+        except Exception as exc:                   # 验签失败 / 过期 → 普通错误
+            raise ValueError(f"无效的 JWT 凭证: {exc}") from None
+        user_id = payload.get(user_id_claim)
+        if not isinstance(user_id, str) or not user_id:
+            raise ValueError("JWT 缺非空 userId 声明")
+        roles = payload.get(roles_claim)
+        return {
+            "userId": user_id,
+            "roles": [r for r in roles if isinstance(r, str)] if isinstance(roles, list) else [],
+        }
+
+    return decode
+
+
+def api_key(header="x-api-key", lookup=None):
+    if not callable(lookup):
+        raise ValueError("identity.api_key 需要 lookup 回调")
+
+    async def decode(bag):
+        key = bag.get(header.lower())
+        if not key:
+            return None
+        ctx = lookup(key)
+        if inspect.isawaitable(ctx):
+            ctx = await ctx
+        return None if ctx is None else ctx
+
+    return decode
+
+
+def session(cookie="sid", lookup=None):
+    if not callable(lookup):
+        raise ValueError("identity.session 需要 lookup 回调")
+
+    async def decode(bag):
+        sid = _parse_cookie(bag.get("cookie") or "", cookie)
+        if not sid:
+            return None
+        ctx = lookup(sid)
+        if inspect.isawaitable(ctx):
+            ctx = await ctx
+        return None if ctx is None else ctx
+
+    return decode
+
+
+def adapt(skin, decode):
+    if not callable(decode):
+        raise ValueError("identity.adapt 需要解码器函数")
+    if skin == "store-api":
+        async def provider(request):
+            return await decode(_headers_to_bag(getattr(request, "headers", None)))
+        return provider
+    if skin == "store-grpc":
+        async def provider(invocation_metadata):
+            return await decode(_metadata_to_bag(invocation_metadata))
+        return provider
+    if skin == "store-graphql":
+        async def provider(request):
+            return await decode(_headers_to_bag(getattr(request, "headers", None)))
+        return provider
+    raise ValueError(f"identity.adapt 未知皮名: {skin}")
+
+
+identity = SimpleNamespace(jwt=jwt, api_key=api_key, session=session, adapt=adapt)

store_rbac_bootstrap_py-0.1.0/src/store_rbac_bootstrap_py.egg-info/PKG-INFO

@@ -0,0 +1,10 @@
+Metadata-Version: 2.4
+Name: store-rbac-bootstrap-py
+Version: 0.1.0
+Summary: Optional skin-layer bootstrap for common-store RBAC: policy bootstrap (set_rbac + role-rule configs) and credential-to-context factories (JWT / API-Key / Session) for the context_provider seams of store-api / store-grpc / store-graphql
+License: MIT
+Keywords: py-store,rbac,bootstrap,context,jwt,skin
+Requires-Python: >=3.10
+Requires-Dist: PyJWT>=2.8
+Provides-Extra: dev
+Requires-Dist: pytest>=8; extra == "dev"

store_rbac_bootstrap_py-0.1.0/src/store_rbac_bootstrap_py.egg-info/SOURCES.txt

@@ -0,0 +1,10 @@
+pyproject.toml
+src/store_rbac_bootstrap/__init__.py
+src/store_rbac_bootstrap_py.egg-info/PKG-INFO
+src/store_rbac_bootstrap_py.egg-info/SOURCES.txt
+src/store_rbac_bootstrap_py.egg-info/dependency_links.txt
+src/store_rbac_bootstrap_py.egg-info/requires.txt
+src/store_rbac_bootstrap_py.egg-info/top_level.txt
+tests/test_conformance.py
+tests/test_identity.py
+tests/test_policy.py

store_rbac_bootstrap_py-0.1.0/src/store_rbac_bootstrap_py.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

store_rbac_bootstrap_py-0.1.0/src/store_rbac_bootstrap_py.egg-info/requires.txt

@@ -0,0 +1,4 @@
+PyJWT>=2.8
+
+[dev]
+pytest>=8

store_rbac_bootstrap_py-0.1.0/src/store_rbac_bootstrap_py.egg-info/top_level.txt

@@ -0,0 +1 @@
+store_rbac_bootstrap

store_rbac_bootstrap_py-0.1.0/tests/test_conformance.py

@@ -0,0 +1,119 @@
+"""conformance 用例（加载与 node 同一份 conformance/cases.json；期望值不复制）。"""
+import asyncio
+import json
+from pathlib import Path
+from types import SimpleNamespace
+
+import jwt as pyjwt
+import pytest
+
+from store_rbac_bootstrap import policy, identity
+from mock_store import MockStore
+
+CASES = json.loads((Path(__file__).parents[2] / "conformance" / "cases.json").read_text(encoding="utf-8"))
+SECRET = "conformance-secret"
+
+# 双端门面名映射（camelCase → snake_case），供调用序列断言取 py 分支
+_FACADE_MAP = dict(zip(CASES["facades"]["node"], CASES["facades"]["py"]))
+
+
+def run(coro):
+    return asyncio.run(coro)
+
+
+def source_of(cfg):
+    async def source():
+        return cfg
+    return source
+
+
+def translate(expected_calls):
+    return [(_FACADE_MAP[name], value) for name, value in expected_calls]
+
+
+def test_conformance_config_full():
+    store = MockStore()
+    run(policy.create(store, source_of(CASES["config"]["full"]["input"])).start())
+    assert store.calls == translate(CASES["config"]["full"]["expected_calls"])
+
+
+def test_conformance_config_defaults():
+    store = MockStore()
+    run(policy.create(store, source_of(CASES["config"]["defaults"]["input"])).start())
+    assert store.calls == translate(CASES["config"]["defaults"]["expected_calls"])
+
+
+def test_conformance_invalid_configs_raise_with_zero_calls():
+    entries = [
+        ("unknown_key", CASES["config"]["unknown_key"]),
+        ("bad_unconfigured_policy", CASES["config"]["bad_unconfigured_policy"]),
+        ("bad_exempt_roles", CASES["config"]["bad_exempt_roles"]),
+    ]
+    for name, c in entries:
+        store = MockStore()
+        handle = policy.create(store, source_of(c["input"]))
+        with pytest.raises(ValueError) as ei:
+            run(handle.start())
+        if c.get("error_contains"):
+            assert c["error_contains"] in str(ei.value), f"{name} 消息应含 {c['error_contains']}"
+        assert len(store.calls) == c["expected_call_count"], f"{name} 应零门面调用"
+
+
+def test_conformance_reload_clear_first():
+    store = MockStore()
+    handle = policy.create(store, source_of({}))
+    run(handle.start())
+    before = len(store.calls)
+    run(handle.reload())
+    assert store.calls[before] == tuple(CASES["reload"]["expected_first_call"]["py"])
+
+
+def test_conformance_null_clear():
+    async def null_lookup(_):
+        return None
+
+    decoders = {
+        "jwt": identity.jwt(secret=SECRET),
+        "api_key": identity.api_key(lookup=null_lookup),
+        "session": identity.session(lookup=null_lookup),
+    }
+    for entry in CASES["identity"]["null_clear"]:
+        assert run(decoders[entry["kind"]](entry["bag"])) is None, f"{entry['kind']} 应严格 None"
+
+
+def test_conformance_jwt_payload_and_roles_default():
+    decode = identity.jwt(secret=SECRET)
+    p = CASES["identity"]["jwt_payload"]
+    t1 = pyjwt.encode(p["claims"], SECRET, algorithm="HS256")
+    assert run(decode({"authorization": f"Bearer {t1}"})) == p["expected"]
+    r = CASES["identity"]["jwt_roles_default"]
+    t2 = pyjwt.encode(r["claims"], SECRET, algorithm="HS256")
+    assert run(decode({"authorization": t2})) == r["expected"]
+
+
+def test_conformance_invalid_is_plain_error_not_permission():
+    decode = identity.jwt(secret=SECRET)
+    bad = pyjwt.encode({"sub": "u"}, "other-secret", algorithm="HS256")
+    with pytest.raises(ValueError) as ei:
+        run(decode({"authorization": bad}))
+    assert type(ei.value).__name__ == CASES["identity"]["invalid"]["error_class"]["py"]
+    assert not isinstance(ei.value, PermissionError)
+
+
+def test_conformance_bag_lowercase():
+    headers = CASES["identity"]["bag_lowercase"]["headers"]
+    expected_key = CASES["identity"]["bag_lowercase"]["expected_bag_key"]
+    captured = {}
+
+    async def spy(bag):
+        captured.update(bag)
+        return None
+
+    provider = identity.adapt("store-api", spy)
+    run(provider(SimpleNamespace(headers=headers)))
+    assert expected_key in captured
+
+
+def test_conformance_unknown_skin_raises():
+    with pytest.raises(ValueError):
+        identity.adapt(CASES["identity"]["unknown_skin"]["skin"], lambda bag: None)

store_rbac_bootstrap_py-0.1.0/tests/test_identity.py

@@ -0,0 +1,134 @@
+"""identity 用例（与 02 node/test/identity.test.js 的 T11–T21 逐场景对拍）。"""
+import asyncio
+from types import SimpleNamespace
+
+import jwt as pyjwt
+import pytest
+
+from store_rbac_bootstrap import identity
+
+
+def run(coro):
+    return asyncio.run(coro)
+
+
+def test_T11_jwt_no_credential_returns_none():
+    decode = identity.jwt(secret="s")
+    assert run(decode({})) is None
+    assert run(decode({"cookie": "x=1"})) is None
+
+
+def test_T12_jwt_valid_payload_and_roles_default():
+    decode = identity.jwt(secret="s")
+    token = pyjwt.encode({"sub": "u1", "roles": ["editor"]}, "s", algorithm="HS256")
+    assert run(decode({"authorization": f"Bearer {token}"})) == {"userId": "u1", "roles": ["editor"]}
+    no_roles = pyjwt.encode({"sub": "u2"}, "s", algorithm="HS256")
+    assert run(decode({"authorization": no_roles})) == {"userId": "u2", "roles": []}
+
+
+def test_T13_jwt_invalid_raises_plain_error():
+    decode = identity.jwt(secret="s")
+    wrong = pyjwt.encode({"sub": "u"}, "other", algorithm="HS256")
+    with pytest.raises(ValueError) as ei:
+        run(decode({"authorization": wrong}))
+    assert not isinstance(ei.value, PermissionError)
+    expired = pyjwt.encode({"sub": "u", "exp": 1}, "s", algorithm="HS256")
+    with pytest.raises(ValueError) as ei2:
+        run(decode({"authorization": expired}))
+    assert not isinstance(ei2.value, PermissionError)
+
+
+def test_T14_jwt_construction_errors():
+    with pytest.raises(ValueError, match="secret"):
+        identity.jwt(secret="")
+    with pytest.raises(ValueError, match="HS"):
+        identity.jwt(secret="s", algorithm="RS256")
+
+
+def test_T15_api_key_three_states_and_passthrough():
+    async def lookup(k):
+        return {"userId": "u", "roles": []} if k == "good" else None
+
+    decode = identity.api_key(lookup=lookup)
+    assert run(decode({})) is None
+    assert run(decode({"x-api-key": "good"})) == {"userId": "u", "roles": []}
+    assert run(decode({"x-api-key": "bad"})) is None
+
+    class PermissionError(Exception):
+        pass
+
+    def boom(k):
+        raise PermissionError("no")
+
+    decode2 = identity.api_key(lookup=boom)
+    with pytest.raises(PermissionError):
+        run(decode2({"x-api-key": "k"}))
+
+
+def test_T16_session_cookie_parsing():
+    async def lookup(sid):
+        return {"userId": "u", "roles": []} if sid == "s1" else None
+
+    decode = identity.session(lookup=lookup)
+    assert run(decode({})) is None
+    assert run(decode({"cookie": "sid=s1"})) == {"userId": "u", "roles": []}
+    assert run(decode({"cookie": "other=1; sid=s1; z=2"})) == {"userId": "u", "roles": []}
+    assert run(decode({"cookie": "sid=nope"})) is None
+
+
+def test_T17_adapt_store_api_lowercase_bag():
+    captured = {}
+
+    async def decode(bag):
+        captured.update(bag)
+        return {"userId": "u", "roles": []}
+
+    provider = identity.adapt("store-api", decode)
+    ctx = run(provider(SimpleNamespace(headers={"Authorization": "Bearer t"})))
+    assert captured == {"authorization": "Bearer t"}
+    assert ctx == {"userId": "u", "roles": []}
+
+
+def test_T18_adapt_store_grpc_two_shapes():
+    captured = {}
+
+    async def decode(bag):
+        captured.clear()
+        captured.update(bag)
+        return None
+
+    provider = identity.adapt("store-grpc", decode)
+    run(provider([("authorization", "Bearer t")]))       # (key, value) 序列形态
+    assert captured == {"authorization": "Bearer t"}
+
+    class MD:                                            # .get 对象形态
+        def get(self, name):
+            return {"authorization": "Bearer z"}.get(name)
+
+    run(provider(MD()))
+    assert captured == {"authorization": "Bearer z"}
+
+
+def test_T19_adapt_store_graphql_headers():
+    captured = {}
+
+    async def decode(bag):
+        captured.update(bag)
+        return None
+
+    provider = identity.adapt("store-graphql", decode)
+    run(provider(SimpleNamespace(headers={"Authorization": "Bearer t"})))
+    assert captured == {"authorization": "Bearer t"}
+
+
+def test_T20_adapt_unknown_skin_raises():
+    with pytest.raises(ValueError, match="未知皮名"):
+        identity.adapt("unknown", lambda b: None)
+    with pytest.raises(ValueError, match="解码器"):
+        identity.adapt("store-api", None)
+
+
+def test_T21_adapt_null_clear_semantics():
+    provider = identity.adapt("store-api", identity.jwt(secret="s"))
+    assert run(provider(SimpleNamespace(headers={}))) is None
+    assert run(provider(SimpleNamespace())) is None

store_rbac_bootstrap_py-0.1.0/tests/test_policy.py

@@ -0,0 +1,130 @@
+"""policy 用例（与 02 node/test/policy.test.js 的 T1–T10 逐场景对拍）。"""
+import asyncio
+import json
+
+import pytest
+
+from store_rbac_bootstrap import policy
+from mock_store import MockStore
+
+
+def run(coro):
+    return asyncio.run(coro)
+
+
+def make_source(cfg):
+    async def source():
+        return cfg
+    return source
+
+
+def test_T1_full_config_strict_order():
+    store = MockStore()
+    cfg = {
+        "policy": {"mode": "overlay", "roles": {}, "grants": []},
+        "exemptRoles": ["a"],
+        "denyWriteRoles": ["g"],
+        "unconfiguredPolicy": "closed",
+    }
+    handle = policy.create(store, make_source(cfg))
+    run(handle.start())
+    assert store.calls == [
+        ("set_exempt_roles", ["a"]),
+        ("set_deny_write_roles", ["g"]),
+        ("set_unconfigured_policy", "closed"),
+        ("set_rbac", cfg["policy"]),
+    ]
+
+
+def test_T2_empty_config_defaults():
+    store = MockStore()
+    handle = policy.create(store, make_source({}))
+    run(handle.start())
+    assert store.calls == [
+        ("set_exempt_roles", []),
+        ("set_deny_write_roles", []),
+        ("set_unconfigured_policy", "open"),
+        ("set_rbac", None),
+    ]
+
+
+def test_T3_unknown_top_key_no_facade_call():
+    store = MockStore()
+    handle = policy.create(store, make_source({"foo": 1}))
+    with pytest.raises(ValueError, match="foo"):
+        run(handle.start())
+    assert store.calls == []
+
+
+def test_T4_bad_unconfigured_policy_no_facade_call():
+    store = MockStore()
+    handle = policy.create(store, make_source({"unconfiguredPolicy": "x"}))
+    with pytest.raises(ValueError, match="unconfiguredPolicy"):
+        run(handle.start())
+    assert store.calls == []
+
+
+def test_T5_bad_exempt_roles_no_facade_call():
+    store = MockStore()
+    handle = policy.create(store, make_source({"exemptRoles": "a"}))
+    with pytest.raises(ValueError, match="exemptRoles"):
+        run(handle.start())
+    assert store.calls == []
+
+
+def test_T6_source_error_propagates_no_facade_call():
+    store = MockStore()
+
+    async def boom():
+        raise RuntimeError("boom")
+
+    handle = policy.create(store, boom)
+    with pytest.raises(RuntimeError, match="boom"):
+        run(handle.start())
+    assert store.calls == []
+
+
+def test_T7_policy_file(tmp_path):
+    p = tmp_path / "cfg.json"
+    p.write_text(json.dumps({"exemptRoles": ["x"]}), encoding="utf-8")
+    store = MockStore()
+    handle = policy.create(store, policy.file(str(p)))
+    run(handle.start())
+    assert store.calls == [
+        ("set_exempt_roles", ["x"]),
+        ("set_deny_write_roles", []),
+        ("set_unconfigured_policy", "open"),
+        ("set_rbac", None),
+    ]
+    with pytest.raises(Exception):
+        run(policy.file(str(p) + ".nope")())
+
+
+def test_T8_reload_clear_first():
+    store = MockStore()
+    handle = policy.create(store, make_source({"exemptRoles": ["a"]}))
+    run(handle.start())
+    before = len(store.calls)                    # 4
+    run(handle.reload())
+    assert store.calls[before] == ("set_rbac", None)   # 清除前置
+    assert len(store.calls) == before + 1 + 4
+
+
+def test_T9_missing_facade_raises():
+    class S:                                     # 缺 set_deny_write_roles
+        def set_rbac(self, v):
+            pass
+
+        def set_exempt_roles(self, v):
+            pass
+
+        def set_unconfigured_policy(self, v):
+            pass
+
+    with pytest.raises(ValueError, match="set_deny_write_roles"):
+        policy.create(S(), make_source({}))
+
+
+def test_T10_source_not_callable_raises():
+    with pytest.raises(ValueError, match="source"):
+        policy.create(MockStore(), 123)