Lack of unit test for policy.enforce

There are actually some tests in the module you mention.
Those tests however have not been designed to verify the policy engine, but rather to verify that the policy engine works in a way that makes sense for the API and the plugin.

You'll find some unit tests that validate how the API and the plugin behave in determinated circumstances for both regulard and admin users.

Test aiming at validating the correct functioning of the policy engine are in test_policy. We have a QuantumPolicyTestCase class; you're more than welcome to add tests to increase coverage and/or cover corner cases.

As you can see those classes do not work on policy.json, but define a set of rules and feed them to the policy brain. Hence you can write test cases for validating how the policy engine behaves in different cases. For instance you could add a test case for the "all operations are admin only" case.

setting this to incomplete until someone fills in more info on what tests are needed.

Hi Salvatore, Dan

I know there are test_policy which checks policy framework. However I coun't find
 policy testing for each API call.
So as Salvatore said, something like "all operations are admin only" should be added.

I'd actually really like to encourage more testing of the policy stuff in general, as any error in that layer is likely a security vulnerability.

[Expired for quantum because there has been no activity for 60 days.]