Agent-System/internal/auth/store_factory_test.go

package auth

import (
	"context"
	"strings"
	"testing"

	"chat-agent-system/internal/config"
)

func TestNewStores_FailClosed_WhenIAMUnavailable(t *testing.T) {
	ctx := context.Background()
	cases := []struct {
		name string
		cfg  *config.Config
	}{
		{name: "main_nil_pool", cfg: &config.Config{Env: "main", AllowInMemory: false}},
		{name: "prod_nil_pool", cfg: &config.Config{Env: "prod", AllowInMemory: false}},
		{name: "empty_env_nil_pool", cfg: &config.Config{Env: "", AllowInMemory: true}},
		{name: "unknown_env_nil_pool", cfg: &config.Config{Env: "staging", AllowInMemory: true}},
		{name: "dev_without_opt_in", cfg: &config.Config{Env: "dev", AllowInMemory: false}},
		{name: "test_without_opt_in", cfg: &config.Config{Env: "test", AllowInMemory: false}},
	}
	for _, tc := range cases {
		t.Run(tc.name, func(t *testing.T) {
			stores, err := NewStores(ctx, nil, tc.cfg)
			if err == nil {
				t.Fatalf("expected fail-closed error, got stores=%v", stores)
			}
			if stores != nil {
				t.Fatalf("expected nil stores on failure, got %#v", stores)
			}
			if !strings.Contains(err.Error(), "IAM") && !strings.Contains(err.Error(), "memory") {
				t.Fatalf("error should mention IAM/memory policy: %v", err)
			}
		})
	}
}

func TestNewStores_AllowsMemoryOnlyWithDevTestOptIn(t *testing.T) {
	ctx := context.Background()
	for _, env := range []string{"dev", "test"} {
		t.Run(env, func(t *testing.T) {
			cfg := &config.Config{
				Env:           env,
				AllowInMemory: true,
				AdminUsername: "admin",
				AdminPassword: "admin-test-pass",
			}
			stores, err := NewStores(ctx, nil, cfg)
			if err != nil {
				t.Fatalf("expected memory fixture: %v", err)
			}
			if stores == nil || stores.Auth == nil || stores.Sessions == nil {
				t.Fatal("expected auth+session stores")
			}
			if _, ok := stores.Auth.(*MemoryStore); !ok {
				t.Fatalf("Auth should be MemoryStore, got %T", stores.Auth)
			}
		})
	}
}