Agent-System-Backend/internal/settings/settings_account_write_test.go

package settings

import (
	"errors"
	"path/filepath"
	"testing"

	"agent-system-backend/internal/store"
)

func TestGuardedSettingsMergePreservesManagedPathsAndEffectiveState(t *testing.T) {
	st, err := store.OpenSQLite(filepath.Join(t.TempDir(), "settings.db"))
	if err != nil {
		t.Fatal(err)
	}
	t.Cleanup(func() { st.Close() })
	svc := NewService(st)
	for _, a := range []struct {
		owner string
		admin bool
	}{{"admin", true}, {"alice", false}} {
		if err := st.CreateAccount(a.owner, "", "", a.admin); err != nil {
			t.Fatal(err)
		}
	}
	project, err := st.CreateProject("alice", "owned")
	if err != nil {
		t.Fatal(err)
	}
	if err := svc.MergeUserAccountChecked("alice", map[string]any{"models.chat.apiKey": "forbidden"}, false); err == nil {
		t.Fatal("guarded user merge accepted managed path")
	} else {
		var managed *ErrManagedPath
		if !errors.As(err, &managed) {
			t.Fatalf("managed path error lost: %v", err)
		}
	}
	if err := svc.MergeUserAccountChecked("alice", map[string]any{"ui.theme": "light"}, false); err != nil {
		t.Fatal(err)
	}
	if err := svc.MergeProjectAccountChecked("alice", project.ID, map[string]any{"context.maxHistoryMessages": 12}, false); err != nil {
		t.Fatal(err)
	}
	if err := svc.MergeSystemAccountChecked("alice", map[string]any{"models.chat.apiKey": "forbidden"}, false); !errors.Is(err, store.ErrAccountForbidden) {
		t.Fatalf("non-admin wrote system settings: %v", err)
	}
	if err := svc.MergeSystemAccountChecked("admin", map[string]any{"models.chat.apiKey": "system-secret"}, false); err != nil {
		t.Fatal(err)
	}
	if got := svc.Effective("alice", project.ID); got.GetString("models.chat.apiKey", "") != "system-secret" || got.GetString("ui.theme", "") != "light" {
		t.Fatalf("guarded merges did not produce effective settings: %#v", got)
	}
	for _, scope := range []struct{ owner, name string }{{"alice", ScopeUser}, {"alice", ScopeProjectPrefix + project.ID}, {OwnerSystemRow, ScopeSystem}} {
		var count int
		if err := st.DB().QueryRow(`SELECT COUNT(*) FROM settings_snapshots WHERE owner=? AND scope=?`, scope.owner, scope.name).Scan(&count); err != nil || count != 1 {
			t.Fatalf("guarded merge snapshot %s/%s count=%d err=%v", scope.owner, scope.name, count, err)
		}
	}
	account, err := st.GetAccountByOwner("alice")
	if err != nil {
		t.Fatal(err)
	}
	if _, err := st.SetAccountEnabled("admin", account.ID, account.StateVersion, false); err != nil {
		t.Fatal(err)
	}
	if err := svc.MergeUserAccountChecked("alice", map[string]any{"ui.theme": "dark"}, false); !errors.Is(err, store.ErrAccountForbidden) {
		t.Fatalf("disabled user merge admitted: %v", err)
	}
	if err := svc.MergeProjectAccountChecked("alice", project.ID, map[string]any{"context.maxHistoryMessages": 99}, false); !errors.Is(err, store.ErrAccountForbidden) {
		t.Fatalf("disabled project merge admitted: %v", err)
	}
	if got := svc.Effective("alice", project.ID); got.GetString("ui.theme", "") != "light" {
		t.Fatalf("disabled merge changed effective settings: %#v", got)
	}
}

func TestGuardedSystemMergeAllowsImplicitLocalAndRejectsExplicitDisable(t *testing.T) {
	st, err := store.OpenSQLite(filepath.Join(t.TempDir(), "settings.db"))
	if err != nil {
		t.Fatal(err)
	}
	t.Cleanup(func() { st.Close() })
	svc := NewService(st)
	if err := svc.MergeSystemAccountChecked(store.OwnerDefault, map[string]any{"runtime.mock": true}, false); !errors.Is(err, store.ErrAccountForbidden) {
		t.Fatalf("implicit local system write admitted without allowance: %v", err)
	}
	if err := svc.MergeSystemAccountChecked(store.OwnerDefault, map[string]any{"runtime.mock": true}, true); err != nil {
		t.Fatal(err)
	}
	if err := st.CreateAccount("admin", "", "", true); err != nil {
		t.Fatal(err)
	}
	if err := st.EnsureUser(store.OwnerDefault, ""); err != nil {
		t.Fatal(err)
	}
	account, err := st.GetAccountByOwner(store.OwnerDefault)
	if err != nil {
		t.Fatal(err)
	}
	if _, err := st.SetAccountEnabled("admin", account.ID, account.StateVersion, false); err != nil {
		t.Fatal(err)
	}
	if err := svc.MergeSystemAccountChecked(store.OwnerDefault, map[string]any{"runtime.mock": false}, true); !errors.Is(err, store.ErrAccountForbidden) {
		t.Fatalf("disabled local system write admitted: %v", err)
	}
}