weichenandCursor
7fdbee6c0c
Boot memory IAM only via explicit test env opt-in; strict auth cases disable AllowInMemory after startup. Co-authored-by: Cursor <cursoragent@cursor.com>
68 lines
2.3 KiB
Go
68 lines
2.3 KiB
Go
package server
|
||
|
||
import (
|
||
"net/http"
|
||
"net/http/httptest"
|
||
"strings"
|
||
"testing"
|
||
|
||
"chat-agent-system/internal/app"
|
||
"chat-agent-system/internal/bizdev"
|
||
"chat-agent-system/internal/config"
|
||
)
|
||
|
||
func TestGateA_LineageAndRunsRequireProjectAccess(t *testing.T) {
|
||
// Gate 行为可用 test+AllowInMemory fixture；main 不得再靠 MemoryStore 旁路搭服务。
|
||
cfg := &config.Config{DataDir: t.TempDir(), AgentBackend: "stub", AllowInMemory: true, Env: "test", ContextDbHost: "127.0.0.1"}
|
||
srv := NewServer(cfg, bizdev.MustNewService(t, &config.Config{DataDir: t.TempDir(), AgentBackend: "stub", AllowInMemory: true, Env: "test"}))
|
||
srv.cfg = cfg
|
||
|
||
cases := []struct {
|
||
method string
|
||
path string
|
||
}{
|
||
{http.MethodGet, "/api/v1/projects/999/lineage?doc_id=doc_x"},
|
||
{http.MethodGet, "/api/v1/projects/999/workflows/main/runs"},
|
||
}
|
||
for _, tc := range cases {
|
||
req := httptest.NewRequest(tc.method, tc.path, nil)
|
||
rec := httptest.NewRecorder()
|
||
srv.Routes().ServeHTTP(rec, req)
|
||
if rec.Code != http.StatusUnauthorized {
|
||
t.Fatalf("%s %s expected 401 without auth, got %d", tc.method, tc.path, rec.Code)
|
||
}
|
||
}
|
||
}
|
||
|
||
func TestGateA_CreateProjectRequiresPermission(t *testing.T) {
|
||
cfg := &config.Config{DataDir: t.TempDir(), AgentBackend: "stub", AllowInMemory: true, Env: "test", ContextDbHost: "127.0.0.1"}
|
||
srv := NewServer(cfg, bizdev.MustNewService(t, &config.Config{DataDir: t.TempDir(), AgentBackend: "stub", AllowInMemory: true, Env: "test"}))
|
||
srv.cfg = cfg
|
||
|
||
req := httptest.NewRequest(http.MethodPost, "/api/v1/projects", nil)
|
||
req.Header.Set("Authorization", "Bearer invalid")
|
||
rec := httptest.NewRecorder()
|
||
srv.Routes().ServeHTTP(rec, req)
|
||
if rec.Code != http.StatusUnauthorized {
|
||
t.Fatalf("expected 401, got %d", rec.Code)
|
||
}
|
||
}
|
||
|
||
func TestAssemble_FailClosed_MainCannotUseMemoryIAM(t *testing.T) {
|
||
cfg := &config.Config{
|
||
DataDir: t.TempDir(),
|
||
AgentBackend: "stub",
|
||
AllowInMemory: true,
|
||
Env: "main",
|
||
ContextDbHost: "127.0.0.1",
|
||
}
|
||
svc := bizdev.MustNewService(t, &config.Config{DataDir: t.TempDir(), AgentBackend: "stub", AllowInMemory: true, Env: "test"})
|
||
_, err := app.Assemble(cfg, svc)
|
||
if err == nil {
|
||
t.Fatal("expected assemble fail-closed when main lacks IAM PG store")
|
||
}
|
||
if !strings.Contains(err.Error(), "fail-closed") && !strings.Contains(err.Error(), "auth store") {
|
||
t.Fatalf("unexpected error: %v", err)
|
||
}
|
||
}
|