weichenandCursor
4512132b20
Omit project_role no longer defaults to member. Exclusive duty writes take an advisory lock and retry conflicts so last-writer wins without dual reviewers. Author write tests require err==nil. Co-authored-by: Cursor <cursoragent@cursor.com>
53 lines
1.5 KiB
Go
53 lines
1.5 KiB
Go
package authz_test
|
|
|
|
import (
|
|
"context"
|
|
"testing"
|
|
|
|
"chat-agent-system/internal/authz"
|
|
)
|
|
|
|
func TestService_ListCapabilities_DisabledWithoutPool(t *testing.T) {
|
|
svc := authz.NewService(nil)
|
|
caps, err := svc.ListCapabilities(context.Background(), 1)
|
|
if err != nil {
|
|
t.Fatalf("unexpected error: %v", err)
|
|
}
|
|
if caps != nil {
|
|
t.Fatalf("expected nil caps when pool disabled, got %v", caps)
|
|
}
|
|
}
|
|
|
|
func TestService_IsSystemAdmin_ByRoleID(t *testing.T) {
|
|
svc := authz.NewService(nil)
|
|
admin, err := svc.IsSystemAdmin(context.Background(), 1, "role-admin")
|
|
if err != nil || !admin {
|
|
t.Fatalf("expected admin by role_id, got (%v, %v)", admin, err)
|
|
}
|
|
}
|
|
|
|
func TestUpsertProjectMember_RejectsDocRolesWithoutDB(t *testing.T) {
|
|
a := authz.NewAuthorizer(nil)
|
|
if err := a.UpsertProjectMember(context.Background(), 1, 2, "author"); err == nil {
|
|
t.Fatal("expected author role to be rejected")
|
|
}
|
|
if err := a.UpsertProjectMember(context.Background(), 1, 2, authz.RoleOwner); err != nil {
|
|
t.Fatalf("owner should be allowed: %v", err)
|
|
}
|
|
bad := "viewer"
|
|
if err := a.UpsertProjectMemberSpec(context.Background(), 1, 2, authz.MemberUpsert{
|
|
ProjectRole: authz.RoleMember,
|
|
DocumentDuty: &bad,
|
|
}); err == nil {
|
|
t.Fatal("document_duty=viewer must be rejected")
|
|
}
|
|
}
|
|
|
|
func TestGetProjectMember_DisabledWithoutPool(t *testing.T) {
|
|
a := authz.NewAuthorizer(nil)
|
|
rec, err := a.GetProjectMember(context.Background(), 1, 2)
|
|
if err != nil || rec != nil {
|
|
t.Fatalf("disabled authorizer must not invent a member, got (%v, %v)", rec, err)
|
|
}
|
|
}
|