diff --git a/tests/proxy_behavior/management/test_key_update.py b/tests/proxy_behavior/management/test_key_update.py index 7b7f6f5558b..2d8fe6b315f 100644 --- a/tests/proxy_behavior/management/test_key_update.py +++ b/tests/proxy_behavior/management/test_key_update.py @@ -12,8 +12,10 @@ pytestmark = pytest.mark.asyncio(loop_scope="session") # (id, actor, target_shape, expected_status). Pinned against current gating: # proxy_admin bypasses; org_admin is blocked by an early role gate (401); -# every other (INTERNAL_USER-roled) actor hits user_id-mismatch 403, no-team- -# admin 403, or team_member_permission 401 depending on target / membership. +# a team admin may update a key in their own team even when another member +# owns it (200); every other (INTERNAL_USER-roled) actor hits user_id-mismatch +# 403, no-team-admin 403, or team_member_permission 401 depending on target / +# membership. _SCENARIOS = [ ("self/proxy_admin", Actor.PROXY_ADMIN, "self", 200), ("self/org_admin", Actor.ORG_ADMIN, "self", 401), @@ -25,7 +27,7 @@ _SCENARIOS = [ ("self/service_account", Actor.SERVICE_ACCOUNT, "self", 403), ("owner_target/proxy_admin", Actor.PROXY_ADMIN, "owner", 200), ("owner_target/org_admin", Actor.ORG_ADMIN, "owner", 401), - ("owner_target/team_admin", Actor.TEAM_ADMIN, "owner", 403), + ("owner_target/team_admin", Actor.TEAM_ADMIN, "owner", 200), ("owner_target/internal_user", Actor.INTERNAL_USER, "owner", 403), ("owner_target/unrelated_same_org", Actor.UNRELATED_SAME_ORG, "owner", 403), ("owner_target/cross_org_user", Actor.CROSS_ORG_USER, "owner", 403),