Files
Agent-System/internal/server/chat_recategorize_api_test.go
T
weichenandCursor fad7fac044 fix(authz): close preference, session project, and recategorize IDOR gaps
Bind preference writes and session-scoped project reads to the authenticated principal, and require an owned session_id for recategorize so empty ids cannot touch all messages.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-20 10:42:58 +00:00

63 lines
1.9 KiB
Go

package server_test
import (
"encoding/json"
"net/http"
"net/http/httptest"
"strings"
"testing"
"chat-agent-system/internal/bizdev"
"chat-agent-system/internal/config"
"chat-agent-system/internal/server"
)
func TestServer_ChatRecategorizeAPI(t *testing.T) {
cfg := &config.Config{
Env: "dev",
HTTPHost: "127.0.0.1",
HTTPPort: 8892,
DataDir: t.TempDir(),
AdminUsername: "admin",
AdminPassword: "admin-test-pass",
AgentBackend: "stub",
}
svc := bizdev.MustNewService(t, cfg)
srv := server.NewServer(cfg, svc)
handler := srv.Routes()
adminToken := loginTestAdmin(t, handler, cfg)
sessID := "sess_recategorize_api_001"
ctx := t.Context()
ctxMgr := bizdev.Snapshot(svc).Ctx
if _, err := ctxMgr.EnsureChatSession(ctx, sessID, 1, 0, "recategorize"); err != nil {
t.Fatalf("ensure session: %v", err)
}
_, _ = ctxMgr.RecordUserMessageWithID(ctx, sessID, 1, "user", "请问二类注册审批周期?", "QUERY_REGULATIONS", "", nil)
_, _ = ctxMgr.RecordUserMessageWithID(ctx, sessID, 0, "assistant", "根据现有规定,一般需 6-9 个月。", "", "", nil)
reqBody := `{"session_id":"` + sessID + `"}`
req := httptest.NewRequest(http.MethodPost, "/api/v1/chat/recategorize", strings.NewReader(reqBody))
req.Header.Set("Content-Type", "application/json")
withBearerAuth(req, adminToken)
rec := httptest.NewRecorder()
handler.ServeHTTP(rec, req)
if rec.Code != http.StatusOK {
t.Fatalf("expected status 200, got %d: %s", rec.Code, rec.Body.String())
}
var res map[string]any
if err := json.Unmarshal(rec.Body.Bytes(), &res); err != nil {
t.Fatalf("json unmarshal failed: %v", err)
}
if success, ok := res["success"].(bool); !ok || !success {
t.Fatalf("expected success: true, got %v", res)
}
if totalProcessed, ok := res["total_processed"].(float64); !ok || totalProcessed < 2 {
t.Fatalf("expected total_processed >= 2, got %v", res["total_processed"])
}
}