Yuneng Jiang ff4a50c768 test(proxy): separate the member_add permission gate from the provisioning gate ... Adding a team member by a user_id with no user row is now proxy-admin-only, so the /team/member_add authz matrix, which targeted a never-seeded user_id, started 403ing every non-proxy-admin caller. Seed the member as a real user row so the matrix reads _validate_team_member_add_permissions alone; leaving it unseeded and relaxing the expectations to 403 would have left all 18 rows green with that gate deleted outright. Cover the new gate at the HTTP boundary, where only the helper was pinned before: a team admin and an org admin both clear the permission check on the same team and are still refused an unprovisioned user_id, with no user row left behind. Pin the escape hatch that refusal names too, so closing the email-invite path for non-proxy-admins cannot pass silently. Promote the user seeder the member-info pins had kept private to conftest, and reclaim invited users by their scratch-prefixed email, since an invite allocates the user_id server-side.		2026-08-01 14:39:47 -07:00
..
management	test(proxy): separate the member_add permission gate from the provisioning gate	2026-08-01 14:39:47 -07:00
__init__.py	feat(tests): behavior-pinning harness + Key Tier-1 matrix (#28321)	2026-05-20 19:27:44 -07:00