weichenandCursor
bcb122ac53
Reject empty environment/project, disable FAV consumers at register time, and keep historical classification/repair/replay as audited application use cases with no raw SQL entrypoint. Co-authored-by: Cursor <cursoragent@cursor.com>
26 lines
841 B
Go
26 lines
841 B
Go
package events
|
|
|
|
import "testing"
|
|
|
|
func TestPrincipalRejectsWildcardAndFAV(t *testing.T) {
|
|
if err := ValidatePrincipal(ServicePrincipal{ID: "wildcard", Environment: "dev", Consumer: ConsumerNotify}); err == nil {
|
|
t.Fatal("wildcard")
|
|
}
|
|
if err := ValidatePrincipal(ServicePrincipal{ID: "p", Environment: "dev", Consumer: ConsumerFAV}); err == nil {
|
|
t.Fatal("fav")
|
|
}
|
|
}
|
|
|
|
func TestAuthorizePrincipalFailClosed(t *testing.T) {
|
|
p := ServicePrincipal{ID: "notify-dev", Environment: "dev", Consumer: ConsumerNotify, Actions: []string{"notify.emit"}}
|
|
if err := AuthorizePrincipal(p, "dev", 9, "notify.emit"); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := AuthorizePrincipal(p, "test", 9, "notify.emit"); err == nil {
|
|
t.Fatal("env mismatch")
|
|
}
|
|
if err := AuthorizePrincipal(p, "dev", 0, "notify.emit"); err == nil {
|
|
t.Fatal("project 0")
|
|
}
|
|
}
|