/workspace/source/test/e2e/tests/test_namespace_scoping.py:214: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:247: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:287: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:324: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:382: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:456: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_tenant_discovery.py:136: Skipping when Gateway uses ClusterIP + OpenShift Route (unsupported configuration). This mixes incompatible routing paradigms. Gateway has no external hostname in spec.listeners, so /v1/tenants returns an error. Supported configuration: LoadBalancer service with hostname in spec.listeners./workspace/source/test/e2e/tests/test_tenant_discovery.py:212: Skipping when Gateway uses ClusterIP + OpenShift Route (unsupported configuration). This mixes incompatible routing paradigms. Gateway has no external hostname in spec.listeners, so /v1/tenants returns an error. Supported configuration: LoadBalancer service with hostname in spec.listeners./workspace/source/test/e2e/tests/test_external_oidc.py:252: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:263: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:277: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:290: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:303: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:335: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:379: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:395: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:405: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:428: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:436: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:441: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:454: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:501: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:537: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:602: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:633: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:659: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:690: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:750: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:786: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:824: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:872: EXTERNAL_OIDC is not true/workspace/source/test/e2e/tests/test_external_oidc.py:961: EXTERNAL_OIDC not enabled/workspace/source/test/e2e/tests/test_external_oidc.py:1013: EXTERNAL_OIDC not enabled/workspace/source/test/e2e/tests/test_external_oidc.py:1049: EXTERNAL_OIDC not enabled/workspace/source/test/e2e/tests/test_external_oidc.py:1103: EXTERNAL_OIDC not enabled/workspace/source/test/e2e/tests/test_external_oidc.py:1142: EXTERNAL_OIDC not enabled/workspace/source/test/e2e/tests/test_tenant_namespace_discovery.py:189: OIDC_ISSUER_URL not set; per-tenant OIDC E2E requires external OIDC deploy/workspace/source/test/e2e/tests/test_tenant_namespace_discovery.py:355: Dormant-mode test mutates controller flags; set ENABLE_TENANT_DISCOVERY_DORMANT_E2E=true/workspace/source/test/e2e/tests/test_tenant_discovery_isolation.py:133: Skipping when Gateway uses ClusterIP + OpenShift Route (unsupported configuration). This mixes incompatible routing paradigms. Gateway has no external hostname in spec.listeners, so /v1/tenants returns an error. Supported configuration: LoadBalancer service with hostname in spec.listeners./workspace/source/test/e2e/tests/test_tenant_discovery_isolation.py:181: Skipping when Gateway uses ClusterIP + OpenShift Route (unsupported configuration). This mixes incompatible routing paradigms. Gateway has no external hostname in spec.listeners, so /v1/tenants returns an error. Supported configuration: LoadBalancer service with hostname in spec.listeners./workspace/source/test/e2e/tests/test_tenant_discovery_isolation.py:268: Skipping when Gateway uses ClusterIP + OpenShift Route (unsupported configuration). This mixes incompatible routing paradigms. Gateway has no external hostname in spec.listeners, so /v1/tenants returns an error. Supported configuration: LoadBalancer service with hostname in spec.listeners.self = <test_api_keys.TestAPIKeyAuthorization object at 0x7f35dd3244f0> api_keys_base_url = 'https://e2e-worker-w0-2b2343.apps.0d83b1d6-1b40-4899-8980-d2ca2f692764.prod.konfluxeaas.com/maas-api/v1/api-keys' headers = {'Authorization': 'Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6Im1Rbnd5ejFqMkJZRXJZTDZzNnZ4Z2FHdGJFVGRfMlN4ODNGYW5aSWZYdDAifQ.e...dC1JdnfMRh-iEzYvdhAB3SogfQ9SMz-wNbxb2nOu7DjtbATJ8eoPw0tA-lSw4fkZENAW0MYQU1-X3Rz5Q', 'Content-Type': 'application/json'} admin_headers = {'Authorization': 'Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6Im1Rbnd5ejFqMkJZRXJZTDZzNnZ4Z2FHdGJFVGRfMlN4ODNGYW5aSWZYdDAifQ.e...uMj-CcWYBpvFciiMWxEsZJTHDylB7iKTYq7mmKuffWzdYOgUMrtMEK7RuKGYMoxX8R04NbZgBlx8HQkxA', 'Content-Type': 'application/json'} def test_admin_manage_other_users_keys(self, api_keys_base_url: str, headers: dict, admin_headers: dict): """Test 4: Admin can manage other user's keys - list and revoke.""" if not admin_headers: pytest.skip("ADMIN_OC_TOKEN not set") # Create key as regular user r_create = requests.post(api_keys_base_url, headers=headers, json={"name": "regular-user-key"}, timeout=30, verify=TLS_VERIFY) assert r_create.status_code in (200, 201) user_key_id = r_create.json()["id"] # Get username r_get = requests.get(f"{api_keys_base_url}/{user_key_id}", headers=headers, timeout=30, verify=TLS_VERIFY) username = r_get.json().get("username") or r_get.json().get("owner") assert username print(f"[admin] User '{username}' created key {user_key_id}") # Admin lists keys filtered by username using search endpoint r_admin = requests.post( f"{api_keys_base_url}/search", headers=admin_headers, json={ "filters": {"username": username, "status": ["active"]}, "sort": {"by": "created_at", "order": "desc"}, "pagination": {"limit": 50, "offset": 0} }, timeout=30, verify=TLS_VERIFY ) > assert r_admin.status_code == 200 E assert 403 == 200 E + where 403 = <Response [403]>.status_code test/e2e/tests/test_api_keys.py:317: AssertionErrorself = <test_api_keys.TestAPIKeyBulkOperations object at 0x7f35dd336550> api_keys_base_url = 'https://e2e-worker-w0-2b2343.apps.0d83b1d6-1b40-4899-8980-d2ca2f692764.prod.konfluxeaas.com/maas-api/v1/api-keys' headers = {'Authorization': 'Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6Im1Rbnd5ejFqMkJZRXJZTDZzNnZ4Z2FHdGJFVGRfMlN4ODNGYW5aSWZYdDAifQ.e...dC1JdnfMRh-iEzYvdhAB3SogfQ9SMz-wNbxb2nOu7DjtbATJ8eoPw0tA-lSw4fkZENAW0MYQU1-X3Rz5Q', 'Content-Type': 'application/json'} admin_headers = {'Authorization': 'Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6Im1Rbnd5ejFqMkJZRXJZTDZzNnZ4Z2FHdGJFVGRfMlN4ODNGYW5aSWZYdDAifQ.e...uMj-CcWYBpvFciiMWxEsZJTHDylB7iKTYq7mmKuffWzdYOgUMrtMEK7RuKGYMoxX8R04NbZgBlx8HQkxA', 'Content-Type': 'application/json'} def test_bulk_revoke_admin_can_revoke_any_user(self, api_keys_base_url: str, headers: dict, admin_headers: dict): """Test 10: Bulk revoke - admin can bulk revoke any user's keys.""" if not admin_headers: pytest.skip("ADMIN_OC_TOKEN not set") # Create a key as regular user r = requests.post(api_keys_base_url, headers=headers, json={"name": "admin-bulk-revoke-test"}, timeout=30, verify=TLS_VERIFY) assert r.status_code in (200, 201) key_id = r.json()["id"] # Get username r_get = requests.get(f"{api_keys_base_url}/{key_id}", headers=headers, timeout=30, verify=TLS_VERIFY) username = r_get.json().get("username") or r_get.json().get("owner") assert username # Admin bulk revokes user's keys r_bulk = requests.post( f"{api_keys_base_url}/bulk-revoke", headers=admin_headers, json={"username": username}, timeout=30, verify=TLS_VERIFY ) > assert r_bulk.status_code == 200 E assert 403 == 200 E + where 403 = <Response [403]>.status_code test/e2e/tests/test_api_keys.py:425: AssertionErrorself = <test_api_keys.TestAPIKeyBulkOperations object at 0x7f35dd336f10> api_keys_base_url = 'https://e2e-worker-w0-2b2343.apps.0d83b1d6-1b40-4899-8980-d2ca2f692764.prod.konfluxeaas.com/maas-api/v1/api-keys' headers = {'Authorization': 'Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6Im1Rbnd5ejFqMkJZRXJZTDZzNnZ4Z2FHdGJFVGRfMlN4ODNGYW5aSWZYdDAifQ.e...dC1JdnfMRh-iEzYvdhAB3SogfQ9SMz-wNbxb2nOu7DjtbATJ8eoPw0tA-lSw4fkZENAW0MYQU1-X3Rz5Q', 'Content-Type': 'application/json'} admin_headers = {'Authorization': 'Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6Im1Rbnd5ejFqMkJZRXJZTDZzNnZ4Z2FHdGJFVGRfMlN4ODNGYW5aSWZYdDAifQ.e...uMj-CcWYBpvFciiMWxEsZJTHDylB7iKTYq7mmKuffWzdYOgUMrtMEK7RuKGYMoxX8R04NbZgBlx8HQkxA', 'Content-Type': 'application/json'} def test_bulk_revoke_by_subscription(self, api_keys_base_url: str, headers: dict, admin_headers: dict): """Admin can bulk revoke all keys bound to a subscription.""" if not admin_headers: pytest.skip("ADMIN_OC_TOKEN not set") sub_name = f"e2e-bulk-sub-{os.urandom(4).hex()}" ns = _ns() sa_name = f"e2e-bulk-sa-{os.urandom(4).hex()}" key_ids = [] try: oc_token = _create_sa_token(sa_name, namespace=MODEL_NAMESPACE) sa_user = _sa_to_user(sa_name, namespace=MODEL_NAMESPACE) sa_headers = {"Authorization": f"Bearer {oc_token}", "Content-Type": "application/json"} _create_test_auth_policy(f"{sub_name}-auth", MODEL_REF, users=[sa_user]) _create_test_subscription(sub_name, MODEL_REF, users=[sa_user]) _wait_for_maas_subscription_phase(sub_name, namespace=ns) for i in range(3): r = _request_with_gateway_retry( requests.post, api_keys_base_url, headers=sa_headers, json={"name": f"sub-bulk-{i}", "subscription": sub_name}, timeout=TIMEOUT, verify=TLS_VERIFY, ) assert r.status_code in (200, 201), f"Failed to create key: {r.text}" key_ids.append(r.json()["id"]) r_bulk = requests.post( f"{api_keys_base_url}/bulk-revoke", headers=admin_headers, json={"subscription": sub_name}, timeout=30, verify=TLS_VERIFY, ) > assert r_bulk.status_code == 200 E assert 403 == 200 E + where 403 = <Response [403]>.status_code test/e2e/tests/test_api_keys.py:465: AssertionErrorself = <test_api_keys.TestAPIKeyBulkOperations object at 0x7f35dd3367c0> api_keys_base_url = 'https://e2e-worker-w0-2b2343.apps.0d83b1d6-1b40-4899-8980-d2ca2f692764.prod.konfluxeaas.com/maas-api/v1/api-keys' headers = {'Authorization': 'Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6Im1Rbnd5ejFqMkJZRXJZTDZzNnZ4Z2FHdGJFVGRfMlN4ODNGYW5aSWZYdDAifQ.e...dC1JdnfMRh-iEzYvdhAB3SogfQ9SMz-wNbxb2nOu7DjtbATJ8eoPw0tA-lSw4fkZENAW0MYQU1-X3Rz5Q', 'Content-Type': 'application/json'} admin_headers = {'Authorization': 'Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6Im1Rbnd5ejFqMkJZRXJZTDZzNnZ4Z2FHdGJFVGRfMlN4ODNGYW5aSWZYdDAifQ.e...uMj-CcWYBpvFciiMWxEsZJTHDylB7iKTYq7mmKuffWzdYOgUMrtMEK7RuKGYMoxX8R04NbZgBlx8HQkxA', 'Content-Type': 'application/json'} def test_bulk_revoke_dry_run_by_subscription(self, api_keys_base_url: str, headers: dict, admin_headers: dict): """Admin dry-run by subscription returns correct key count.""" if not admin_headers: pytest.skip("ADMIN_OC_TOKEN not set") sub_name = f"e2e-dry-sub-{os.urandom(4).hex()}" ns = _ns() sa_name = f"e2e-dry-sa-{os.urandom(4).hex()}" key_ids = [] try: oc_token = _create_sa_token(sa_name, namespace=MODEL_NAMESPACE) sa_user = _sa_to_user(sa_name, namespace=MODEL_NAMESPACE) sa_headers = {"Authorization": f"Bearer {oc_token}", "Content-Type": "application/json"} _create_test_auth_policy(f"{sub_name}-auth", MODEL_REF, users=[sa_user]) _create_test_subscription(sub_name, MODEL_REF, users=[sa_user]) _wait_for_maas_subscription_phase(sub_name, namespace=ns) for i in range(2): r = _request_with_gateway_retry( requests.post, api_keys_base_url, headers=sa_headers, json={"name": f"dry-sub-{i}", "subscription": sub_name}, timeout=TIMEOUT, verify=TLS_VERIFY, ) assert r.status_code in (200, 201) key_ids.append(r.json()["id"]) r_dry = requests.post( f"{api_keys_base_url}/bulk-revoke", headers=admin_headers, json={"subscription": sub_name, "dryRun": True}, timeout=30, verify=TLS_VERIFY, ) > assert r_dry.status_code == 200 E assert 403 == 200 E + where 403 = <Response [403]>.status_code test/e2e/tests/test_api_keys.py:574: AssertionErrorself = <test_api_keys.TestAPIKeyBulkOperations object at 0x7f35dd319d90> api_keys_base_url = 'https://e2e-worker-w0-2b2343.apps.0d83b1d6-1b40-4899-8980-d2ca2f692764.prod.konfluxeaas.com/maas-api/v1/api-keys' headers = {'Authorization': 'Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6Im1Rbnd5ejFqMkJZRXJZTDZzNnZ4Z2FHdGJFVGRfMlN4ODNGYW5aSWZYdDAifQ.e...dC1JdnfMRh-iEzYvdhAB3SogfQ9SMz-wNbxb2nOu7DjtbATJ8eoPw0tA-lSw4fkZENAW0MYQU1-X3Rz5Q', 'Content-Type': 'application/json'} admin_headers = {'Authorization': 'Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6Im1Rbnd5ejFqMkJZRXJZTDZzNnZ4Z2FHdGJFVGRfMlN4ODNGYW5aSWZYdDAifQ.e...uMj-CcWYBpvFciiMWxEsZJTHDylB7iKTYq7mmKuffWzdYOgUMrtMEK7RuKGYMoxX8R04NbZgBlx8HQkxA', 'Content-Type': 'application/json'} def test_bulk_revoke_combined_user_and_subscription(self, api_keys_base_url: str, headers: dict, admin_headers: dict): """Admin can revoke keys for a specific user within a specific subscription. Negative control: a second user's keys in the same subscription must remain active. """ if not admin_headers: pytest.skip("ADMIN_OC_TOKEN not set") sub_name = f"e2e-combo-sub-{os.urandom(4).hex()}" ns = _ns() sa_name = f"e2e-combo-sa-{os.urandom(4).hex()}" sa2_name = f"e2e-combo-sa2-{os.urandom(4).hex()}" key_ids = [] key_ids_user2 = [] try: oc_token = _create_sa_token(sa_name, namespace=MODEL_NAMESPACE) sa_user = _sa_to_user(sa_name, namespace=MODEL_NAMESPACE) sa_headers = {"Authorization": f"Bearer {oc_token}", "Content-Type": "application/json"} oc_token2 = _create_sa_token(sa2_name, namespace=MODEL_NAMESPACE) sa_user2 = _sa_to_user(sa2_name, namespace=MODEL_NAMESPACE) sa2_headers = {"Authorization": f"Bearer {oc_token2}", "Content-Type": "application/json"} _create_test_auth_policy(f"{sub_name}-auth", MODEL_REF, users=[sa_user, sa_user2]) _create_test_subscription(sub_name, MODEL_REF, users=[sa_user, sa_user2]) _wait_for_maas_subscription_phase(sub_name, namespace=ns) for i in range(2): r = _request_with_gateway_retry( requests.post, api_keys_base_url, headers=sa_headers, json={"name": f"combined-{i}", "subscription": sub_name}, timeout=TIMEOUT, verify=TLS_VERIFY, ) assert r.status_code in (200, 201) key_ids.append(r.json()["id"]) r_u2 = _request_with_gateway_retry( requests.post, api_keys_base_url, headers=sa2_headers, json={"name": "user2-key", "subscription": sub_name}, timeout=TIMEOUT, verify=TLS_VERIFY, ) assert r_u2.status_code in (200, 201) key_ids_user2.append(r_u2.json()["id"]) r_get = requests.get(f"{api_keys_base_url}/{key_ids[0]}", headers=sa_headers, timeout=30, verify=TLS_VERIFY) username = r_get.json().get("username") or r_get.json().get("owner") assert username r_bulk = requests.post( f"{api_keys_base_url}/bulk-revoke", headers=admin_headers, json={"username": username, "subscription": sub_name}, timeout=30, verify=TLS_VERIFY, ) > assert r_bulk.status_code == 200 E assert 403 == 200 E + where 403 = <Response [403]>.status_code test/e2e/tests/test_api_keys.py:651: AssertionError/workspace/source/test/e2e/tests/test_tenant_auth_isolation.py:215: Per-tenant OIDC tokens unavailable — set OIDC_TOKEN_URL (tenant-a) and OIDC_TOKEN_URL_TENANT_B (tenant-b), or OIDC_TOKEN_TENANT_A / OIDC_TOKEN_TENANT_Bself = <test_models_endpoint.TestModelsEndpoint object at 0x7f0e2c2553d0> def test_multiple_api_keys_different_subscriptions(self): """ Test: Multiple API keys each bound to different subscriptions. Creates two API keys from the same user, each explicitly bound to a different subscription. Verifies each key returns only its bound subscription's models. Expected: Each API key returns models only from its bound subscription. """ sa_name = "e2e-multi-keys-sa" sa_ns = "default" maas_ns = _ns() sub1_name = "e2e-multi-keys-sub1" sub2_name = "e2e-multi-keys-sub2" auth1_name = "e2e-multi-keys-auth1" auth2_name = "e2e-multi-keys-auth2" api_key1 = None api_key2 = None try: # Create SA sa_token = _create_sa_token(sa_name, namespace=sa_ns) sa_user = _sa_to_user(sa_name, namespace=sa_ns) # Create two subscriptions with different models log.info(f"Creating subscription 1 with {DISTINCT_MODEL_REF}") _create_test_auth_policy(auth1_name, DISTINCT_MODEL_REF, users=[sa_user]) _create_test_subscription(sub1_name, DISTINCT_MODEL_REF, users=[sa_user]) log.info(f"Creating subscription 2 with {DISTINCT_MODEL_2_REF}") _create_test_auth_policy(auth2_name, DISTINCT_MODEL_2_REF, users=[sa_user]) _create_test_subscription(sub2_name, DISTINCT_MODEL_2_REF, users=[sa_user]) # Wait for both subscriptions to reconcile before creating API keys _wait_for_maas_subscription_phase(sub1_name, namespace=maas_ns) _wait_for_maas_subscription_phase(sub2_name, namespace=maas_ns) # Create two API keys, each bound to a different subscription log.info(f"Creating API key 1 bound to {sub1_name}") api_key1_response = _request_with_gateway_retry( requests.post, f"{_maas_api_url()}/v1/api-keys", headers={"Authorization": f"Bearer {sa_token}", "Content-Type": "application/json"}, json={"name": "key1", "subscription": sub1_name}, ) assert api_key1_response.status_code in (200, 201) api_key1 = api_key1_response.json().get("key") bound_sub1 = api_key1_response.json().get("subscription") assert bound_sub1 == sub1_name, f"Key 1 should be bound to {sub1_name}, got {bound_sub1}" log.info(f"Creating API key 2 bound to {sub2_name}") api_key2_response = _request_with_gateway_retry( requests.post, f"{_maas_api_url()}/v1/api-keys", headers={"Authorization": f"Bearer {sa_token}", "Content-Type": "application/json"}, json={"name": "key2", "subscription": sub2_name}, ) assert api_key2_response.status_code in (200, 201) api_key2 = api_key2_response.json().get("key") bound_sub2 = api_key2_response.json().get("subscription") assert bound_sub2 == sub2_name, f"Key 2 should be bound to {sub2_name}, got {bound_sub2}" _wait_for_maas_auth_policy_phase(auth1_name, require_enforced=False) _wait_for_maas_auth_policy_phase(auth2_name, require_enforced=False) # Test key1 - should return models from sub1 only log.info(f"Testing API key 1 (bound to {sub1_name})") r1 = _get_models_with_gateway_retry( headers={"Authorization": f"Bearer {api_key1}"}, ) assert r1.status_code == 200, f"Expected 200 for key1, got {r1.status_code}: {r1.text}" models1 = r1.json().get("data") or [] model_ids1 = {m["id"] for m in models1} assert DISTINCT_MODEL_ID in model_ids1, f"Key1 should see {DISTINCT_MODEL_ID} from {sub1_name}" assert DISTINCT_MODEL_2_ID not in model_ids1, f"Key1 should NOT see {DISTINCT_MODEL_2_ID} from {sub2_name}" # Test key2 - should return models from sub2 only log.info(f"Testing API key 2 (bound to {sub2_name})") r2 = _get_models_with_gateway_retry( headers={"Authorization": f"Bearer {api_key2}"}, ) assert r2.status_code == 200, f"Expected 200 for key2, got {r2.status_code}: {r2.text}" models2 = r2.json().get("data") or [] model_ids2 = {m["id"] for m in models2} > assert DISTINCT_MODEL_2_ID in model_ids2, f"Key2 should see {DISTINCT_MODEL_2_ID} from {sub2_name}" E AssertionError: Key2 should see publishers/e2e-models-e2e-worker-w4-933e9d/models/e2e/distinct-2-w4-933e9d from e2e-multi-keys-sub2 E assert 'publishers/e2e-models-e2e-worker-w4-933e9d/models/e2e/distinct-2-w4-933e9d' in set() test/e2e/tests/test_models_endpoint.py:2062: AssertionError/workspace/source/test/e2e/tests/test_gateway_scoped_authpolicy.py:219: legacy gateway-default-auth is scoped to the shared default gateway