@@ -94,16 +94,14 @@ def mint_token(
9494 kid : str ,
9595 scope : str = "create:content" ,
9696 expired : bool = False ,
97- review_tags : list [str ] | None = None ,
9897 teams : list [str ] | None = None ,
9998 ** extra_claims ,
10099) -> str :
101100 """Replicates cms/authapi token output: claim layout and kid header.
102101
103- `review_tags` mirrors the CMS's tag-scoped reviewer claim
104- (cms/authapi/serializers.py): present only for users with
105- ReviewTagAssignments — None omits the claim, matching the unrestricted
106- default.
102+ `teams` mirrors the CMS's team-scoped reviewer claim
103+ (cms/authapi/serializers.py): present only for non-admin users — None
104+ omits the claim entirely, which the backend fails CLOSED on.
107105 """
108106 now = datetime .now (timezone .utc )
109107 payload = {
@@ -121,8 +119,6 @@ def mint_token(
121119 "iss" : settings .AUTH_ISSUER ,
122120 ** extra_claims ,
123121 }
124- if review_tags is not None :
125- payload ["review_tags" ] = review_tags
126122 if teams is not None :
127123 payload ["teams" ] = teams
128124 return jwt .encode (payload , private_pem , algorithm = "RS256" , headers = {"kid" : kid })
@@ -159,35 +155,6 @@ def test_multiple_required_scopes(verifier, keypair, jwks):
159155 assert payload ["scope" ] == "create:content update:publish"
160156
161157
162- def test_review_tags_claim_round_trips (verifier , keypair , jwks ):
163- """Tag-scoped reviewer token: the CMS withholds review:review-all and
164- mints a sorted review_tags claim; the verifier must hand the claim through
165- unchanged for allowed_review_tags (app/comments/main.py) to enforce."""
166- private_pem , _ = keypair
167- kid = jwks ["keys" ][0 ]["kid" ]
168- token = mint_token (
169- private_pem ,
170- kid ,
171- scope = "create:content_review" ,
172- review_tags = ["environment" , "schools" ],
173- )
174-
175- payload = run_verify (verifier , token , ["create:content_review" ])
176-
177- assert payload ["review_tags" ] == ["environment" , "schools" ]
178- assert "review:review-all" not in payload ["scope" ].split ()
179-
180-
181- def test_review_tags_claim_absent_by_default (verifier , keypair , jwks ):
182- private_pem , _ = keypair
183- kid = jwks ["keys" ][0 ]["kid" ]
184- token = mint_token (private_pem , kid , scope = "create:content_review" )
185-
186- payload = run_verify (verifier , token , ["create:content_review" ])
187-
188- assert "review_tags" not in payload
189-
190-
191158def test_teams_claim_round_trips (verifier , keypair , jwks ):
192159 """Team-scoped reviewer token: the CMS withholds review:review-all and
193160 mints a sorted teams claim; the verifier must hand the claim through
0 commit comments