From 1d715640633c061018b43b7921691e2ba00e3017 Mon Sep 17 00:00:00 2001 From: Yuneng Jiang Date: Thu, 17 Sep 2026 10:37:07 -0700 Subject: [PATCH] fix(e2e): settle the team allow-list through /team/info The team access-group fixture polled a 403 until its message enumerated the team's allow-list, because registering a team-scoped deployment appends that deployment to the list and the fixture has to wait for the reset to land. #41310 replaced that message with a fixed client-facing one, so the poll never matched and both tests errored at setup The allow-list is now read back from /team/info until it holds exactly the access group --- .../access_control/access_control_client.py | 17 ++++++++------ .../test_model_access_group_e2e.py | 22 ++++++++----------- 2 files changed, 19 insertions(+), 20 deletions(-) diff --git a/tests/e2e/access_control/access_control_client.py b/tests/e2e/access_control/access_control_client.py index 634a96bb0bd..5f459c09767 100644 --- a/tests/e2e/access_control/access_control_client.py +++ b/tests/e2e/access_control/access_control_client.py @@ -122,16 +122,19 @@ class AccessControlClient: ) return unwrap(result) if is_ok(result) else None + def team_models(self, team_id: str) -> list[str] | None: + result = self.proxy.transport.get( + "/team/info", + headers=self.proxy.transport.master, + params=TeamInfoParams(team_id=team_id), + response_type=TeamInfoResponse, + ) + return unwrap(result).team_info.models if is_ok(result) else None + def _await_team(self, team_id: str) -> None: deadline = time.monotonic() + self.proxy.poll_timeout while time.monotonic() < deadline: - result = self.proxy.transport.get( - "/team/info", - headers=self.proxy.transport.master, - params=TeamInfoParams(team_id=team_id), - response_type=TeamInfoResponse, - ) - if is_ok(result): + if self.team_models(team_id) is not None: return time.sleep(self.proxy.poll_interval) raise AssertionError(f"/team/info never resolved team {team_id!r} created by /team/new") diff --git a/tests/e2e/access_control/test_model_access_group_e2e.py b/tests/e2e/access_control/test_model_access_group_e2e.py index 5cc062ea096..146895383b7 100644 --- a/tests/e2e/access_control/test_model_access_group_e2e.py +++ b/tests/e2e/access_control/test_model_access_group_e2e.py @@ -111,22 +111,18 @@ def _await_group_members(client: AccessControlClient, access_group: str, expecte ) -def _await_team_allowlist(client: AccessControlClient, grant_key: str, access_group: str) -> None: - """Registering a team-scoped deployment appends its public name to the team's - allow-list, and a wildcard sitting there directly would grant the model under test - on its own. Poll a denial until the message enumerates the allow-list the test - means to exercise: the group, and nothing else.""" - allowlist: Final = f"models=['{access_group}']" +def _await_team_allowlist(client: AccessControlClient, team_id: str, access_group: str) -> None: deadline = time.monotonic() + client.proxy.poll_timeout - body = "" + listed: list[str] | None = None while time.monotonic() < deadline: - body = client.chat_status( - grant_key, UNCOVERED_OPENAI_MODEL, f"{PROMPT} {unique_marker()}", MAX_COMPLETION_TOKENS - ).body - if allowlist in body: + listed = client.team_models(team_id) + if listed == [access_group]: return time.sleep(client.proxy.poll_interval) - pytest.fail(f"the team's allow-list never settled to {allowlist}; last denial read {body[:300]}") + pytest.fail( + f"/team/info never settled the team's allow-list to [{access_group!r}] after the team-scoped " + f"deployment was registered; last read {listed}" + ) @pytest.fixture(scope="module") @@ -174,7 +170,7 @@ def team_grant(client: AccessControlClient) -> Iterator[TeamGrant]: ) client.set_team_models(team_id, team_alias, [access_group]) try: - _await_team_allowlist(client, key, access_group) + _await_team_allowlist(client, team_id, access_group) yield TeamGrant(access_group=access_group, team_id=team_id, key=key) finally: client.proxy.delete_model(model_id)