weichen/Agent-System
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(authz): close project-context ABAC gap and repair CI PG fixtures

Browse Source 
enforceChatProjectAccess before allowAnyStageAccess on GET /context/project
so activated projects are no longer readable by arbitrary authenticated users.

Align failing gate fixtures with official workflow keys, isolated TEST_DATABASE_URL,
unique project names (00057), duty membership, and in-memory bizdev-cli envs.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
weichen
2026-09-22 18:12:26 +08:00
co-authored by Cursor
parent 3c2c7f9ccc
commit c767a99807
11 changed files with 162 additions and 138 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/bizdev-cli/main_test.go
+12 -6
View File
@@ -30,7 +30,13 @@ func TestBizdevCLIHelpAndRun(t *testing.T) {
}
func TestBizdevCLIListTasks(t *testing.T) {
cmd := exec.Command("go", "run", "./cmd/bizdev-cli", "-list-tasks")
tmpDir := t.TempDir()
envContent := "ENV=test\nDATA_DIR=" + tmpDir + "\nAGENT_BACKEND=stub\nALLOW_IN_MEMORY=true\n"
envPath := filepath.Join(tmpDir, ".env")
if err := os.WriteFile(envPath, []byte(envContent), 0o644); err != nil {
t.Fatal(err)
}
cmd := exec.Command("go", "run", "./cmd/bizdev-cli", "-list-tasks", "-env", envPath)
cmd.Dir = moduleRoot(t)
out, err := cmd.CombinedOutput()
if err != nil {
@@ -43,7 +49,7 @@ func TestBizdevCLIListTasks(t *testing.T) {
func TestBizdevCLIExecuteAndInspect(t *testing.T) {
tmpDir := t.TempDir()
envContent := "ENV=dev\nDATA_DIR=" + tmpDir + "\nAGENT_BACKEND=stub\n"
envContent := "ENV=test\nDATA_DIR=" + tmpDir + "\nAGENT_BACKEND=stub\nALLOW_IN_MEMORY=true\n"
envPath := filepath.Join(tmpDir, ".env")
_ = os.WriteFile(envPath, []byte(envContent), 0o644)
@@ -108,7 +114,7 @@ func TestBizdevCLIExecuteAndInspect(t *testing.T) {
func TestBizdevCLIStageExecution(t *testing.T) {
tmpDir := t.TempDir()
envContent := "ENV=dev\nDATA_DIR=" + tmpDir + "\nAGENT_BACKEND=stub\n"
envContent := "ENV=test\nDATA_DIR=" + tmpDir + "\nAGENT_BACKEND=stub\nALLOW_IN_MEMORY=true\n"
envPath := filepath.Join(tmpDir, ".env")
_ = os.WriteFile(envPath, []byte(envContent), 0o644)
@@ -152,7 +158,7 @@ func TestBizdevCLIStageExecution(t *testing.T) {
func TestBizdevCLIChatQueries(t *testing.T) {
tmpDir := t.TempDir()
envContent := "ENV=dev\nDATA_DIR=" + tmpDir + "\nAGENT_BACKEND=stub\n"
envContent := "ENV=test\nDATA_DIR=" + tmpDir + "\nAGENT_BACKEND=stub\nALLOW_IN_MEMORY=true\n"
envPath := filepath.Join(tmpDir, ".env")
_ = os.WriteFile(envPath, []byte(envContent), 0o644)
@@ -238,7 +244,7 @@ func TestBizdevCLIChatQueries(t *testing.T) {
func TestBizdevCLIThreeBranchQueries(t *testing.T) {
tmpDir := t.TempDir()
envContent := "ENV=dev\nDATA_DIR=" + tmpDir + "\nAGENT_BACKEND=stub\n"
envContent := "ENV=test\nDATA_DIR=" + tmpDir + "\nAGENT_BACKEND=stub\nALLOW_IN_MEMORY=true\n"
envPath := filepath.Join(tmpDir, ".env")
_ = os.WriteFile(envPath, []byte(envContent), 0o644)
@@ -339,7 +345,7 @@ func TestBizdevCLIThreeBranchQueries(t *testing.T) {
func TestBizdevCLIExecuteAdhocTask(t *testing.T) {
tmpDir := t.TempDir()
envContent := "ENV=dev\nDATA_DIR=" + tmpDir + "\nAGENT_BACKEND=stub\n"
envContent := "ENV=test\nDATA_DIR=" + tmpDir + "\nAGENT_BACKEND=stub\nALLOW_IN_MEMORY=true\n"
envPath := filepath.Join(tmpDir, ".env")
_ = os.WriteFile(envPath, []byte(envContent), 0o644)