From bd119dc92ccb3997a048b41ed86f5ee863a696b8 Mon Sep 17 00:00:00 2001 From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Date: Fri, 11 Sep 2026 00:56:38 +0000 Subject: [PATCH] test(proxy): team admin may update member keys in own team Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> --- tests/proxy_behavior/management/test_key_update.py | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/tests/proxy_behavior/management/test_key_update.py b/tests/proxy_behavior/management/test_key_update.py index 7b7f6f5558b..2d8fe6b315f 100644 --- a/tests/proxy_behavior/management/test_key_update.py +++ b/tests/proxy_behavior/management/test_key_update.py @@ -12,8 +12,10 @@ pytestmark = pytest.mark.asyncio(loop_scope="session") # (id, actor, target_shape, expected_status). Pinned against current gating: # proxy_admin bypasses; org_admin is blocked by an early role gate (401); -# every other (INTERNAL_USER-roled) actor hits user_id-mismatch 403, no-team- -# admin 403, or team_member_permission 401 depending on target / membership. +# a team admin may update a key in their own team even when another member +# owns it (200); every other (INTERNAL_USER-roled) actor hits user_id-mismatch +# 403, no-team-admin 403, or team_member_permission 401 depending on target / +# membership. _SCENARIOS = [ ("self/proxy_admin", Actor.PROXY_ADMIN, "self", 200), ("self/org_admin", Actor.ORG_ADMIN, "self", 401), @@ -25,7 +27,7 @@ _SCENARIOS = [ ("self/service_account", Actor.SERVICE_ACCOUNT, "self", 403), ("owner_target/proxy_admin", Actor.PROXY_ADMIN, "owner", 200), ("owner_target/org_admin", Actor.ORG_ADMIN, "owner", 401), - ("owner_target/team_admin", Actor.TEAM_ADMIN, "owner", 403), + ("owner_target/team_admin", Actor.TEAM_ADMIN, "owner", 200), ("owner_target/internal_user", Actor.INTERNAL_USER, "owner", 403), ("owner_target/unrelated_same_org", Actor.UNRELATED_SAME_ORG, "owner", 403), ("owner_target/cross_org_user", Actor.CROSS_ORG_USER, "owner", 403),