weichen
3145550a59
Unify auth middleware and remove X-User-ID trust, add project_members authorization, sandbox workspaces via resolver, and admin-only reconcile by run_id. Introduce goose migrations with startup schema gate, fail closed when DB unavailable outside explicit ALLOW_IN_MEMORY, bundle web/dist in app Dockerfile, and remove frontend pseudo-login fallback.
31 lines
634 B
Go
31 lines
634 B
Go
package workspace
|
|
|
|
import (
|
|
"os"
|
|
"path/filepath"
|
|
"testing"
|
|
)
|
|
|
|
func TestResolver_RejectsPathEscape(t *testing.T) {
|
|
root := t.TempDir()
|
|
r := NewResolver(root, nil)
|
|
|
|
outside := filepath.Join(os.TempDir(), "outside-ws-test")
|
|
_, err := r.EnsureUnderDataRoot(outside)
|
|
if err != ErrPathEscape {
|
|
t.Fatalf("expected ErrPathEscape, got %v", err)
|
|
}
|
|
|
|
inside := filepath.Join(root, "workspaces", "bizdev", "task_1")
|
|
if err := os.MkdirAll(inside, 0o755); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
got, err := r.EnsureUnderDataRoot(inside)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if got != inside {
|
|
t.Fatalf("expected %s got %s", inside, got)
|
|
}
|
|
}
|