.NET API
ToolAuthorizationContract
Tracon.Testing.Contracts.Xunit.dllBehavior tests for the consumer’s own IToolAuthorizationHandler.
public abstract class ToolAuthorizationContract : IAsyncLifetime, IAsyncDisposable- Inheritance
- object ← ToolAuthorizationContract
- Implements
- IAsyncLifetime, IAsyncDisposable
- Inherited Members
- object.GetType(), object.MemberwiseClone(), object.ToString(), object.Equals(object?), object.Equals(object?, object?), object.ReferenceEquals(object?, object?), object.GetHashCode()
Remarks
Section titled “Remarks”Unlike argument validation, a call’s authorization outcome has no
schema-derived ground truth — whether a given tenant, tool, or permission
combination is allowed is entirely the consumer’s own business policy.
This contract asks for that ground truth directly: ToolAuthorizationContract.DeniedRequest
is a call the derived class declares its own ToolAuthorizationContract.Handler denies,
the same way CustomToolContract.ExpectedResultText supplies the
ground truth for a custom tool’s own result.
IToolAuthorizationHandler promises fail-closed behavior: if the handler throws, the call must still end up denied. Tracon tests its own fail-closed wrapper against synthetic handlers; this contract tests whether the consumer’s handler actually reaches a denial for ToolAuthorizationContract.DeniedRequest — whether it returns ToolAuthorizationResult.Deny directly, or throws and lets the fail-closed wrapper deny it.
Constructors
Section titled “Constructors”ToolAuthorizationContract()
Section titled “ ToolAuthorizationContract()”protected ToolAuthorizationContract()Properties
Section titled “Properties”AllowedRequest
Section titled “ AllowedRequest”A call this handler’s own policy allows — the counterpart to ToolAuthorizationContract.DeniedRequest. Needed so a handler that ignores its input and returns the same decision for every call (allow-all or deny-all) cannot pass this contract by accident.
protected abstract ToolAuthorizationRequest AllowedRequest { get; }Property Value
Section titled “Property Value”DeniedRequest
Section titled “ DeniedRequest”A call this handler’s own policy denies — for example, a caller missing the tool’s required permission. There is no schema-driven way to derive an “invalid” authorization request the way ToolArgumentValidationContract derives one from JSON Schema; authorization is the consumer’s own business policy, so the consumer states it.
protected abstract ToolAuthorizationRequest DeniedRequest { get; }Property Value
Section titled “Property Value”Handler
Section titled “ Handler”The authorization policy under test.
protected IToolAuthorizationHandler Handler { get; }Property Value
Section titled “Property Value”Methods
Section titled “Methods”CreateHandlerAsync()
Section titled “ CreateHandlerAsync()”Creates the handler under test.
protected abstract ValueTask<IToolAuthorizationHandler> CreateHandlerAsync()Returns
Section titled “Returns”ValueTask<IToolAuthorizationHandler>
Denied_call_never_runs_the_tool_body()
Section titled “ Denied_call_never_runs_the_tool_body()”[Fact]public Task Denied_call_never_runs_the_tool_body()Returns
Section titled “Returns”DisposeAsync()
Section titled “ DisposeAsync()”public ValueTask DisposeAsync()Returns
Section titled “Returns”Handler_receives_the_calling_tenant()
Section titled “ Handler_receives_the_calling_tenant()”[Fact]public Task Handler_receives_the_calling_tenant()Returns
Section titled “Returns”InitializeAsync()
Section titled “ InitializeAsync()”Called immediately after the class has been created, before it is used.
public ValueTask InitializeAsync()Returns
Section titled “Returns”Throwing_handler_denies_the_call()
Section titled “ Throwing_handler_denies_the_call()”[Fact]public Task Throwing_handler_denies_the_call()