weichenandCursor
6219caf690
Add roles CRUD backed by system_roles tables, session list/revoke APIs, capabilities fallback for memory mode, and route all admin checks through AuthorizationService instead of hardcoded role-admin checks. Co-authored-by: Cursor <cursoragent@cursor.com>
34 lines
673 B
Go
34 lines
673 B
Go
package authz_test
|
|
|
|
import (
|
|
"context"
|
|
"testing"
|
|
|
|
"chat-agent-system/internal/authz"
|
|
)
|
|
|
|
func TestService_ListRoles_FallbackWithoutPool(t *testing.T) {
|
|
svc := authz.NewService(nil)
|
|
roles, err := svc.ListRoles(context.Background())
|
|
if err != nil {
|
|
t.Fatalf("unexpected error: %v", err)
|
|
}
|
|
if len(roles) < 5 {
|
|
t.Fatalf("expected seeded roles, got %d", len(roles))
|
|
}
|
|
}
|
|
|
|
func TestFallbackCapabilities_AdminHasManage(t *testing.T) {
|
|
caps := authz.FallbackCapabilitiesByRoleID("role-admin")
|
|
found := false
|
|
for _, c := range caps {
|
|
if c == authz.PermManage {
|
|
found = true
|
|
break
|
|
}
|
|
}
|
|
if !found {
|
|
t.Fatal("admin fallback should include perm:manage")
|
|
}
|
|
}
|