agent-bot
ee1e53b510
Root causes of the remaining 5 CI PG failures (and the hidden flaky set):
1. All PG-integration packages shared ONE database under parallel package
execution - migrations/seeds/truncates raced (nondeterministic failure
sets, locally and in CI).
Fix: RequireTestDatabaseURL/SkipIfNoTestDatabaseURL now derive a
per-package database (<base>_<pkgHash>, advisory-lock-guarded
CREATE); 9 raw-env straggler tests funnelled through the helpers;
db-package tests call it unqualified (no import cycle).
2. Approval-chain fixtures were not production-shaped: freezeReviewSnapshot
only honors head_snapshot_id, fake content hashes never froze a
snapshot, so ApproverApprove rejected with 'approved requires frozen
review_snapshot_id'. Errors were swallowed (_, _ =) hiding this.
Fix (ownership-respecting, arch-enforced):
- docrevision.SeedContentSnapshotForTest seeds the ledger tables it owns
- docgov GovernanceEngine.FreezeHeadSnapshotForTest freezes head/review
pointers on document_records (docgov-owned) and clears engine cache
- all four integration fixtures use the pair; swallowed errors checked
3. Fixed-name fixtures collide once a package shares one DB (projects
uq_projects_name_global): uniquified in projectinstance + server tests.
4. CAS/ctxmgr tests never bootstrapped migrations (relied on other packages
having migrated the shared DB): explicit RunMigrationsOnceForTest.
Verified: full parallel short suite = 75 packages, 0 failures against an
isolated throwaway PG. CI skip list removed - short tests fully required.
106 lines
2.8 KiB
Go
106 lines
2.8 KiB
Go
package server_test
|
|
|
|
import (
|
|
"chat-agent-system/internal/db"
|
|
"context"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/jackc/pgx/v5/pgxpool"
|
|
|
|
"chat-agent-system/internal/authz"
|
|
"chat-agent-system/internal/config"
|
|
"chat-agent-system/internal/server"
|
|
)
|
|
|
|
func openPGPool(t *testing.T) *pgxpool.Pool {
|
|
t.Helper()
|
|
dsn := db.SkipIfNoTestDatabaseURL(t)
|
|
ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
|
|
defer cancel()
|
|
pool, err := pgxpool.New(ctx, dsn)
|
|
if err != nil {
|
|
t.Skipf("postgres unavailable: %v", err)
|
|
return nil
|
|
}
|
|
if err := pool.Ping(ctx); err != nil {
|
|
pool.Close()
|
|
t.Skipf("postgres ping failed: %v", err)
|
|
}
|
|
return pool
|
|
}
|
|
|
|
func TestProjectMembers_CrossProjectForbidden(t *testing.T) {
|
|
pool := openPGPool(t)
|
|
if pool == nil {
|
|
return
|
|
}
|
|
defer pool.Close()
|
|
|
|
ctx := context.Background()
|
|
var projectA, projectB int64
|
|
err := pool.QueryRow(ctx, `SELECT id FROM projects ORDER BY id ASC LIMIT 1`).Scan(&projectA)
|
|
if err != nil || projectA <= 0 {
|
|
t.Skip("no projects in database for cross-project test")
|
|
}
|
|
err = pool.QueryRow(ctx, `SELECT id FROM projects WHERE id <> $1 ORDER BY id ASC LIMIT 1`, projectA).Scan(&projectB)
|
|
if err != nil || projectB <= 0 {
|
|
t.Skip("need at least two projects for cross-project test")
|
|
}
|
|
|
|
var outsiderID int64
|
|
err = pool.QueryRow(ctx, `
|
|
SELECT u.id FROM users u
|
|
WHERE NOT EXISTS (SELECT 1 FROM project_members pm WHERE pm.project_id = $1 AND pm.user_id = u.id AND pm.status = 'active')
|
|
AND NOT EXISTS (SELECT 1 FROM projects p WHERE p.id = $1 AND p.creator_user_id = u.id)
|
|
ORDER BY u.id ASC LIMIT 1
|
|
`, projectA).Scan(&outsiderID)
|
|
if err != nil || outsiderID <= 0 {
|
|
t.Skip("no outsider user available for cross-project test")
|
|
}
|
|
|
|
authzSvc := authz.NewAuthorizer(pool)
|
|
if err := authzSvc.RequireProjectAccess(ctx, projectA, outsiderID); err != authz.ErrForbidden {
|
|
t.Fatalf("expected outsider forbidden on project A, got %v", err)
|
|
}
|
|
}
|
|
|
|
func TestProjectMembers_ManageMembersPermissionKeyInCatalog(t *testing.T) {
|
|
found := false
|
|
for _, p := range authz.PermissionCatalog() {
|
|
if p.Key == authz.PermManageProjectMembers {
|
|
found = true
|
|
break
|
|
}
|
|
}
|
|
if !found {
|
|
t.Fatalf("expected %s in system permission catalog", authz.PermManageProjectMembers)
|
|
}
|
|
}
|
|
|
|
func TestProjectMembers_AnonymousReturns401(t *testing.T) {
|
|
cfg := &config.Config{
|
|
Env: "dev",
|
|
DataDir: t.TempDir(),
|
|
AgentBackend: "stub",
|
|
AllowInMemory: true,
|
|
AdminUsername: "admin",
|
|
AdminPassword: "admin123",
|
|
}
|
|
srv := server.NewServer(cfg, nil)
|
|
cfg.AllowInMemory = false
|
|
ts := httptest.NewServer(srv.Routes())
|
|
defer ts.Close()
|
|
|
|
resp, err := http.Get(ts.URL + "/api/v1/projects/1/members")
|
|
if err != nil {
|
|
t.Fatalf("request: %v", err)
|
|
}
|
|
defer resp.Body.Close()
|
|
if resp.StatusCode != http.StatusUnauthorized {
|
|
t.Fatalf("expected 401, got %d", resp.StatusCode)
|
|
}
|
|
}
|