Skip to content
Tracon

ToolAuthorizationContract

Namespace Tracon.Testing.Contracts.Tools · Assembly Tracon.Testing.Contracts.Xunit.dll

Behavior tests for the consumer’s own IToolAuthorizationHandler.

public abstract class ToolAuthorizationContract : IAsyncLifetime, IAsyncDisposable

objectToolAuthorizationContract

IAsyncLifetime, IAsyncDisposable

object.GetType(), object.MemberwiseClone(), object.ToString(), object.Equals(object?), object.Equals(object?, object?), object.ReferenceEquals(object?, object?), object.GetHashCode()

Unlike argument validation, a call’s authorization outcome has no schema-derived ground truth — whether a given tenant, tool, or permission combination is allowed is entirely the consumer’s own business policy. This contract asks for that ground truth directly: ToolAuthorizationContract.DeniedRequest is a call the derived class declares its own ToolAuthorizationContract.Handler denies, the same way CustomToolContract.ExpectedResultText supplies the ground truth for a custom tool’s own result.

IToolAuthorizationHandler promises fail-closed behavior: if the handler throws, the call must still end up denied. Tracon tests that promise’s own wrapper (AuthorizingAIFunction) against synthetic handlers; this contract tests whether the consumer’s handler actually reaches a denial for ToolAuthorizationContract.DeniedRequest — whether it returns ToolAuthorizationResult.Deny directly, or throws and lets the fail-closed wrapper deny it.

protected ToolAuthorizationContract()

A call this handler’s own policy allows — the counterpart to ToolAuthorizationContract.DeniedRequest. Needed so a handler that ignores its input and returns the same decision for every call (allow-all or deny-all) cannot pass this contract by accident.

protected abstract ToolAuthorizationRequest AllowedRequest { get; }

ToolAuthorizationRequest

A call this handler’s own policy denies — for example, a caller missing the tool’s required permission. There is no schema-driven way to derive an “invalid” authorization request the way ToolArgumentValidationContract derives one from JSON Schema; authorization is the consumer’s own business policy, so the consumer states it.

protected abstract ToolAuthorizationRequest DeniedRequest { get; }

ToolAuthorizationRequest

The authorization policy under test.

protected IToolAuthorizationHandler Handler { get; }

IToolAuthorizationHandler

Creates the handler under test.

protected abstract ValueTask<IToolAuthorizationHandler> CreateHandlerAsync()

ValueTask<IToolAuthorizationHandler>

[Fact("/Users/farukatasoy/Desktop/projects/Tracon/src/Tracon.Testing.Contracts.Xunit/Contracts/Tools/ToolAuthorizationContract.cs", 62)]
public Task Denied_call_never_runs_the_tool_body()

Task

public ValueTask DisposeAsync()

ValueTask

[Fact("/Users/farukatasoy/Desktop/projects/Tracon/src/Tracon.Testing.Contracts.Xunit/Contracts/Tools/ToolAuthorizationContract.cs", 99)]
public Task Handler_receives_the_calling_tenant()

Task

Called immediately after the class has been created, before it is used.

public ValueTask InitializeAsync()

ValueTask

[Fact("/Users/farukatasoy/Desktop/projects/Tracon/src/Tracon.Testing.Contracts.Xunit/Contracts/Tools/ToolAuthorizationContract.cs", 76)]
public Task Throwing_handler_denies_the_call()

Task