weichenandCursor
025ffe0ab3
Close FEATURE-MATRIX IAM partial with v3 inventory and policy docs. Co-authored-by: Cursor <cursoragent@cursor.com>
102 lines
3.6 KiB
Go
102 lines
3.6 KiB
Go
package auth
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"strings"
|
|
"testing"
|
|
|
|
"chat-agent-system/internal/config"
|
|
)
|
|
|
|
func TestNewStores_FailClosed_WhenIAMUnavailable(t *testing.T) {
|
|
ctx := context.Background()
|
|
cases := []struct {
|
|
name string
|
|
cfg *config.Config
|
|
}{
|
|
{name: "main_nil_pool", cfg: &config.Config{Env: "main", AllowInMemory: false}},
|
|
{name: "prod_nil_pool", cfg: &config.Config{Env: "prod", AllowInMemory: false}},
|
|
{name: "empty_env_nil_pool", cfg: &config.Config{Env: "", AllowInMemory: true}},
|
|
{name: "unknown_env_nil_pool", cfg: &config.Config{Env: "staging", AllowInMemory: true}},
|
|
{name: "dev_without_opt_in", cfg: &config.Config{Env: "dev", AllowInMemory: false}},
|
|
{name: "test_without_opt_in", cfg: &config.Config{Env: "test", AllowInMemory: false}},
|
|
}
|
|
for _, tc := range cases {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
stores, err := NewStores(ctx, nil, tc.cfg)
|
|
if err == nil {
|
|
t.Fatalf("expected fail-closed error, got stores=%v", stores)
|
|
}
|
|
if stores != nil {
|
|
t.Fatalf("expected nil stores on failure, got %#v", stores)
|
|
}
|
|
if !strings.Contains(err.Error(), "IAM") && !strings.Contains(err.Error(), "memory") {
|
|
t.Fatalf("error should mention IAM/memory policy: %v", err)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestNewStores_AllowsMemoryOnlyWithDevTestOptIn(t *testing.T) {
|
|
ctx := context.Background()
|
|
for _, env := range []string{"dev", "test"} {
|
|
t.Run(env, func(t *testing.T) {
|
|
cfg := &config.Config{
|
|
Env: env,
|
|
AllowInMemory: true,
|
|
AdminUsername: "admin",
|
|
AdminPassword: "admin-test-pass",
|
|
}
|
|
stores, err := NewStores(ctx, nil, cfg)
|
|
if err != nil {
|
|
t.Fatalf("expected memory fixture: %v", err)
|
|
}
|
|
if stores == nil || stores.Auth == nil || stores.Sessions == nil {
|
|
t.Fatal("expected auth+session stores")
|
|
}
|
|
if _, ok := stores.Auth.(*MemoryStore); !ok {
|
|
t.Fatalf("Auth should be MemoryStore, got %T", stores.Auth)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
// brokenSessionStore simulates IAM/session dependency outage after process start.
|
|
type brokenSessionStore struct{}
|
|
|
|
func (brokenSessionStore) CreateSession(ctx context.Context, userID int64, tokenHash string, meta SessionMeta) error {
|
|
return fmt.Errorf("session store unavailable")
|
|
}
|
|
func (brokenSessionStore) ResolveUserID(ctx context.Context, tokenHash string) (int64, error) {
|
|
return 0, fmt.Errorf("session store unavailable")
|
|
}
|
|
func (brokenSessionStore) TouchSession(ctx context.Context, tokenHash string) error {
|
|
return fmt.Errorf("session store unavailable")
|
|
}
|
|
func (brokenSessionStore) RevokeByTokenHash(ctx context.Context, tokenHash string) error {
|
|
return fmt.Errorf("session store unavailable")
|
|
}
|
|
func (brokenSessionStore) RevokeAllForUser(ctx context.Context, userID int64) error {
|
|
return fmt.Errorf("session store unavailable")
|
|
}
|
|
func (brokenSessionStore) ListActiveSessions(ctx context.Context, userID int64, currentTokenHash string) ([]SessionRecord, error) {
|
|
return nil, fmt.Errorf("session store unavailable")
|
|
}
|
|
func (brokenSessionStore) RevokeSessionByID(ctx context.Context, userID int64, sessionID string) error {
|
|
return fmt.Errorf("session store unavailable")
|
|
}
|
|
|
|
func TestAuthStore_SessionInterruptFailClosed(t *testing.T) {
|
|
// After a session was "established", subsequent lookups must not silently
|
|
// succeed with cached authority when the session store is down.
|
|
var ss SessionStore = brokenSessionStore{}
|
|
_, err := ss.ResolveUserID(context.Background(), "hash-already-issued")
|
|
if err == nil {
|
|
t.Fatal("interrupted session store must fail-closed on ResolveUserID")
|
|
}
|
|
if !strings.Contains(err.Error(), "unavailable") {
|
|
t.Fatalf("want unavailable error, got %v", err)
|
|
}
|
|
}
|