open-swe/tests/webhooks/test_verdict_authorization.py

from __future__ import annotations

from unittest.mock import AsyncMock

import pytest

from agent.webhooks import common


def _pr(*, author: str = "alice", fork: bool = False) -> dict[str, object]:
    return {
        "user": {"login": author},
        "head": {"repo": {"full_name": "external/repo" if fork else "acme/repo"}},
        "base": {"repo": {"full_name": "acme/repo"}},
    }


@pytest.mark.parametrize(
    (
        "team_enabled",
        "repo_enabled",
        "pr_metadata",
        "active_member",
        "expected",
    ),
    [
        (False, True, _pr(), True, True),
        (False, False, _pr(), True, False),
        (False, True, _pr(fork=True), True, False),
        (False, True, _pr(), False, False),
        (False, True, _pr(author="open-swe[bot]"), False, True),
        (True, False, _pr(), True, True),
        (True, False, _pr(fork=True), True, False),
    ],
    ids=[
        "repo-enabled-trusted-nonfork",
        "disabled",
        "fork",
        "untrusted",
        "internal-bot",
        "team-enabled",
        "team-enabled-fork",
    ],
)
@pytest.mark.asyncio
async def test_resolve_verdict_authorization_truth_table(
    monkeypatch: pytest.MonkeyPatch,
    team_enabled: bool,
    repo_enabled: bool,
    pr_metadata: dict[str, object],
    active_member: bool,
    expected: bool,
) -> None:
    monkeypatch.setattr(
        common,
        "get_team_auto_verdict_enabled",
        AsyncMock(return_value=team_enabled),
    )
    monkeypatch.setattr(
        common,
        "is_auto_verdict_repo_enabled",
        AsyncMock(return_value=repo_enabled),
    )
    monkeypatch.setattr(
        common,
        "is_user_active_org_member",
        AsyncMock(return_value=active_member),
    )

    authorized = await common._resolve_verdict_authorization(
        {"owner": "acme", "name": "repo"}, pr_metadata
    )

    assert authorized is expected


def test_build_reviewer_configurable_only_sets_true_verdict_flags() -> None:
    base = {
        "source": "github",
        "github_login": "alice",
        "github_user_id": 1,
        "repo_config": {"owner": "acme", "name": "repo"},
        "pr_number": 7,
        "pr_url": "https://github.com/acme/repo/pull/7",
        "base_sha": "base",
        "head_sha": "head",
        "branch_name": "feature",
    }

    disabled = common._build_reviewer_configurable(**base)
    authorized = common._build_reviewer_configurable(**base, verdict_authorized=True)

    assert "verdict_authorized" not in disabled
    assert "verdict_requested" not in disabled
    assert authorized["verdict_authorized"] is True
    assert "verdict_requested" not in authorized