@@ -69,6 +69,10 @@ describe("method scope resolution", () => {
6969["nativeHook.invoke", ["operator.admin"]],
7070["wizard.start", ["operator.admin"]],
7171["update.run", ["operator.admin"]],
72+["exec.approvals.get", ["operator.admin"]],
73+["exec.approvals.set", ["operator.admin"]],
74+["exec.approvals.node.get", ["operator.admin"]],
75+["exec.approvals.node.set", ["operator.admin"]],
7276])("resolves least-privilege scopes for %s", (method, expected) => {
7377expect(resolveLeastPrivilegeOperatorScopesForMethod(method)).toEqual(expected);
7478});
@@ -293,6 +297,21 @@ describe("operator scope authorization", () => {
293297},
294298);
295299300+it.each([
301+"exec.approvals.get",
302+"exec.approvals.set",
303+"exec.approvals.node.get",
304+"exec.approvals.node.set",
305+])("requires admin scope for exec approval policy method %s", (method) => {
306+expect(authorizeOperatorScopesForMethod(method, ["operator.approvals"])).toEqual({
307+allowed: false,
308+missingScope: "operator.admin",
309+});
310+expect(authorizeOperatorScopesForMethod(method, ["operator.admin"])).toEqual({
311+allowed: true,
312+});
313+});
314+296315it.each([
297316"plugin.approval.list",
298317"plugin.approval.request",
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。