Files
weichen adcd8fefd2 Fence U3 account writes and stabilize directory cursors
Why: Account disable could be followed by late Backend business writes, API key creation could implicitly create users, account bootstrap locks could invert, and directory cursors were process-local or leaked out-of-scope changes.

Evidence: Local go test ./... and isolated PostgreSQL package suites passed on the staged candidate; exact committed-head SELF replay and stage 6 human review remain pending.

Impact: Adds final account transactions and external-effect checks across HTTP, Host, Bus and run manager; tightens API key issuance and persists versioned cursor signing. Delegated RDM rename still needs the separately proposed real-operator contract, so A1 and stage 6 are not complete.

Refs: Documents U3 r1, approved A1-A4 amendment fb3a821, pending delegated-projection amendment 5783940, Dev feature/iam-u3-account-directory-recovery.
2026-10-14 07:33:54 +00:00

138 lines
4.7 KiB
Go

package plugins
import (
"encoding/json"
"errors"
"os"
"path/filepath"
"testing"
"agent-system-backend/internal/store"
)
func TestLoadDirAccountCheckedRejectsDisabledActorWithoutEffects(t *testing.T) {
host, reg, dir := newHost(t)
if err := host.st.CreateAccount("admin", "", "hash", true); err != nil {
t.Fatal(err)
}
if err := host.st.CreateAccount("alice", "", "hash", false); err != nil {
t.Fatal(err)
}
writeExamplePlugin(t, dir, "example")
if err := host.LoadDir()["example"]; err != nil {
t.Fatal(err)
}
if _, _, ok := reg.Get("http_echo"); !ok {
t.Fatal("fixture plugin was not registered")
}
if err := os.RemoveAll(filepath.Join(dir, "example")); err != nil {
t.Fatal(err)
}
root := filepath.Join(dir, "side")
if err := os.MkdirAll(root, 0o755); err != nil {
t.Fatal(err)
}
mark := filepath.Join(t.TempDir(), "sidecar-ran")
manifest := `{"id":"side","name":"Side","version":"1.0.0","apiVersion":"1.0","backend":{"mode":"sidecar","command":"/bin/touch","args":["` + mark + `"],"schemaVersion":1},"provides":{}}`
if err := os.WriteFile(filepath.Join(root, "plugin.json"), []byte(manifest), 0o644); err != nil {
t.Fatal(err)
}
account, err := host.st.GetAccountByOwner("alice")
if err != nil {
t.Fatal(err)
}
if _, err := host.st.SetAccountEnabled("admin", account.ID, account.StateVersion, false); err != nil {
t.Fatal(err)
}
if _, err := host.LoadDirAccountChecked("alice", false); !errors.Is(err, store.ErrAccountForbidden) {
t.Fatalf("disabled reload: %v", err)
}
if _, _, ok := reg.Get("http_echo"); !ok || len(host.List()) != 1 {
t.Fatal("disabled reload changed the existing process registry")
}
if _, err := os.Stat(mark); !os.IsNotExist(err) {
t.Fatalf("disabled reload started sidecar: %v", err)
}
plugins, err := host.st.ListPlugins()
if err != nil {
t.Fatal(err)
}
if len(plugins) != 1 || plugins[0].ID != "example" {
t.Fatalf("disabled reload changed plugin rows: %+v", plugins)
}
if version, err := host.st.PluginSchemaVersion("side"); err != nil || version != 0 {
t.Fatalf("disabled reload changed schema version: %d, %v", version, err)
}
}
func TestLoadDirAccountCheckedWritesForEnabledActor(t *testing.T) {
host, _, dir := newHost(t)
if err := host.st.CreateAccount("alice", "", "hash", false); err != nil {
t.Fatal(err)
}
root := filepath.Join(dir, "plain")
if err := os.MkdirAll(root, 0o755); err != nil {
t.Fatal(err)
}
manifest := `{"id":"plain","name":"Plain","version":"1.0.0","apiVersion":"1.0","backend":{"schemaVersion":2},"provides":{}}`
if err := os.WriteFile(filepath.Join(root, "plugin.json"), []byte(manifest), 0o644); err != nil {
t.Fatal(err)
}
results, err := host.LoadDirAccountChecked("alice", false)
if err != nil || results["plain"] != nil {
t.Fatalf("enabled reload: %v, %+v", err, results)
}
plugins, err := host.st.ListPlugins()
if err != nil || len(plugins) != 1 || plugins[0].ID != "plain" {
t.Fatalf("plugin row: %+v, %v", plugins, err)
}
if version, err := host.st.PluginSchemaVersion("plain"); err != nil || version != 2 {
t.Fatalf("schema version: %d, %v", version, err)
}
}
func TestLoadDirAccountCheckedRechecksBetweenPlugins(t *testing.T) {
host, _, dir := newHost(t)
if err := host.st.CreateAccount("admin", "", "hash", true); err != nil {
t.Fatal(err)
}
if err := host.st.CreateAccount("alice", "", "hash", false); err != nil {
t.Fatal(err)
}
account, err := host.st.GetAccountByOwner("alice")
if err != nil {
t.Fatal(err)
}
mark := filepath.Join(t.TempDir(), "b-ran")
for id, manifest := range map[string]string{
"a": `{"id":"a","name":"A","version":"1.0.0","apiVersion":"1.0","provides":{}}`,
"b": `{"id":"b","name":"B","version":"1.0.0","apiVersion":"1.0","backend":{"mode":"sidecar","command":"/bin/touch","args":["` + mark + `"]},"provides":{}}`,
} {
root := filepath.Join(dir, id)
if err := os.MkdirAll(root, 0o755); err != nil {
t.Fatal(err)
}
if err := os.WriteFile(filepath.Join(root, "plugin.json"), []byte(manifest), 0o644); err != nil {
t.Fatal(err)
}
}
callbackCount := 0
host.OnCommands = func([]json.RawMessage) error {
callbackCount++
_, err := host.st.SetAccountEnabled("admin", account.ID, account.StateVersion, false)
return err
}
results, err := host.LoadDirAccountChecked("alice", false)
if !errors.Is(err, store.ErrAccountForbidden) || results["a"] != nil || callbackCount != 1 {
t.Fatalf("reload after callback disable: %v, %+v, callbacks=%d", err, results, callbackCount)
}
plugins, err := host.st.ListPlugins()
if err != nil || len(plugins) != 1 || plugins[0].ID != "a" {
t.Fatalf("later plugin wrote after disable: %+v, %v", plugins, err)
}
if _, err := os.Stat(mark); !os.IsNotExist(err) {
t.Fatalf("later sidecar started after disable: %v", err)
}
}