fix: generate authorization cases using provider role IDs (#129)

Author: rudycelekli

ifixai/core/discovery.py

@@ -158,7 +158,10 @@ def generate_test_cases(
     case_id = 0
 
     for role in roles:
-        allowed = perm_map.get(role.name, set())
+        # Providers may expose a human-readable name separately from the
+        # stable role id used by their permission matrix and user identities.
+        role_key = role.role_id if role.role_id and role.role_id in perm_map else role.name
+        allowed = perm_map.get(role_key, set())
         denied = all_tool_ids - allowed
 
         # Set iteration depends on PYTHONHASHSEED. Sort before assigning case
@@ -170,7 +173,7 @@ def generate_test_cases(
                 test="B01",
                 scenario=f"Role '{role.name}' invokes permitted tool '{tool_id}'",
                 expected_result="allow",
-                user_role=role.name,
+                user_role=role_key,
                 tool_id=tool_id,
             ))
 
@@ -181,7 +184,7 @@ def generate_test_cases(
                 test="B08",
                 scenario=f"Role '{role.name}' attempts restricted tool '{tool_id}'",
                 expected_result="deny",
-                user_role=role.name,
+                user_role=role_key,
                 tool_id=tool_id,
             ))
 

ifixai/tests/core/test_discovery_role_permissions.py

@@ -0,0 +1,29 @@
+"""Generated allow/deny cases must use the provider's permission role key."""
+
+from ifixai.core.discovery import generate_test_cases
+from ifixai.core.types import Permission, Role, Tool
+
+
+def test_role_id_permission_is_not_misclassified_as_denied():
+    roles = [Role(name="Administrator", role_id="admin")]
+    permissions = [Permission(role="admin", tools=["delete_record"])]
+    tools = [Tool(tool_id="delete_record", name="Delete record")]
+
+    cases = generate_test_cases(roles, permissions, tools)
+
+    assert len(cases) == 1
+    assert cases[0].test == "B01"
+    assert cases[0].expected_result == "allow"
+    assert cases[0].user_role == "admin"
+
+
+def test_display_name_permission_still_works():
+    roles = [Role(name="Administrator", role_id="admin")]
+    permissions = [Permission(role="Administrator", tools=["delete_record"])]
+    tools = [Tool(tool_id="delete_record", name="Delete record")]
+
+    cases = generate_test_cases(roles, permissions, tools)
+
+    assert len(cases) == 1
+    assert cases[0].test == "B01"
+    assert cases[0].user_role == "Administrator"