weichen
4258d88415
Wire authz service into server, expose capabilities on /auth/me, and add project member management routes with owner/admin gates.
38 lines
1.0 KiB
Go
38 lines
1.0 KiB
Go
package authz_test
|
|
|
|
import (
|
|
"context"
|
|
"testing"
|
|
|
|
"chat-agent-system/internal/authz"
|
|
)
|
|
|
|
func TestService_ListCapabilities_DisabledWithoutPool(t *testing.T) {
|
|
svc := authz.NewService(nil)
|
|
caps, err := svc.ListCapabilities(context.Background(), 1)
|
|
if err != nil {
|
|
t.Fatalf("unexpected error: %v", err)
|
|
}
|
|
if caps != nil {
|
|
t.Fatalf("expected nil caps when pool disabled, got %v", caps)
|
|
}
|
|
}
|
|
|
|
func TestService_IsSystemAdmin_ByRoleID(t *testing.T) {
|
|
svc := authz.NewService(nil)
|
|
admin, err := svc.IsSystemAdmin(context.Background(), 1, "role-admin")
|
|
if err != nil || !admin {
|
|
t.Fatalf("expected admin by role_id, got (%v, %v)", admin, err)
|
|
}
|
|
}
|
|
|
|
func TestUpsertProjectMember_RejectsDocRolesWithoutDB(t *testing.T) {
|
|
a := authz.NewAuthorizer(nil)
|
|
if err := a.UpsertProjectMember(context.Background(), 1, 2, "author"); err == nil {
|
|
t.Fatal("expected author role to be rejected")
|
|
}
|
|
if err := a.UpsertProjectMember(context.Background(), 1, 2, authz.RoleOwner); err != nil {
|
|
t.Fatalf("owner should be allowed: %v", err)
|
|
}
|
|
}
|