weichenandCursor
3c2c7f9ccc
arch-check --mode block failed on frozen dev (23 NEW import findings):
modules materialindex/mineru/workflowscope and edges shipped via their
own accepted tasks were never registered in module-boundaries.yaml.
Register the intentional allowlist edges (precedent 97b868a9); no new
exceptions are added.
7 PG tests fell back to a hardcoded dev DB (127.0.0.1:5433) when
TEST_DATABASE_URL/CONTEXT_DB_DSN were unset, contradicting the isolated
test-DB contract (BUG-08) and polluting dev on a bare 'go test -short'.
Change the fallback to skip when no isolated DB env is provided.
Co-authored-by: Cursor <cursoragent@cursor.com>
118 lines
3.1 KiB
Go
118 lines
3.1 KiB
Go
package auth_test
|
|
|
|
import (
|
|
"context"
|
|
"os"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/jackc/pgx/v5/pgxpool"
|
|
|
|
"chat-agent-system/internal/auth"
|
|
"chat-agent-system/internal/config"
|
|
)
|
|
|
|
func openTestPool(t *testing.T) *pgxpool.Pool {
|
|
t.Helper()
|
|
dsn := os.Getenv("TEST_DATABASE_URL")
|
|
if dsn == "" {
|
|
t.Skip("TEST_DATABASE_URL must be set for PostgreSQL integration tests (refusing default dev database)")
|
|
return nil
|
|
}
|
|
ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
|
|
defer cancel()
|
|
pool, err := pgxpool.New(ctx, dsn)
|
|
if err != nil {
|
|
t.Skipf("postgres unavailable: %v", err)
|
|
return nil
|
|
}
|
|
if pingErr := pool.Ping(ctx); pingErr != nil {
|
|
pool.Close()
|
|
t.Skipf("postgres ping failed: %v", pingErr)
|
|
return nil
|
|
}
|
|
if !auth.IAMTablesReady(ctx, pool) {
|
|
pool.Close()
|
|
t.Skip("IAM tables not migrated on test database")
|
|
}
|
|
authStore, storeErr := auth.NewPgStore(pool, &config.Config{Env: "dev"})
|
|
if storeErr == nil {
|
|
_ = auth.ReactivateDevSeedUsers(ctx, authStore, &config.Config{Env: "dev"})
|
|
}
|
|
return pool
|
|
}
|
|
|
|
func TestPgStore_SessionSurvivesNewStoreInstance(t *testing.T) {
|
|
pool := openTestPool(t)
|
|
if pool == nil {
|
|
return
|
|
}
|
|
defer pool.Close()
|
|
|
|
cfg := &config.Config{Env: "dev"}
|
|
ctx := context.Background()
|
|
|
|
store1, err := auth.NewPgStore(pool, cfg)
|
|
if err != nil {
|
|
t.Fatalf("NewPgStore: %v", err)
|
|
}
|
|
user, err := store1.GetUserByUsername(ctx, "admin")
|
|
if err != nil {
|
|
t.Skipf("admin user not seeded in PG: %v", err)
|
|
}
|
|
tokenHash := auth.HashToken("phase1-integration-token-" + time.Now().Format(time.RFC3339Nano))
|
|
if err := store1.CreateSession(ctx, user.ID, tokenHash, auth.SessionMeta{UserAgent: "go-test"}); err != nil {
|
|
t.Fatalf("CreateSession: %v", err)
|
|
}
|
|
t.Cleanup(func() {
|
|
_ = store1.RevokeByTokenHash(context.Background(), tokenHash)
|
|
})
|
|
|
|
store2, err := auth.NewPgStore(pool, cfg)
|
|
if err != nil {
|
|
t.Fatalf("NewPgStore second: %v", err)
|
|
}
|
|
userID, err := store2.ResolveUserID(ctx, tokenHash)
|
|
if err != nil || userID != user.ID {
|
|
t.Fatalf("session should persist across store instances, got (%d, %v)", userID, err)
|
|
}
|
|
|
|
_ = store2.RevokeByTokenHash(ctx, tokenHash)
|
|
}
|
|
|
|
func TestPgStore_DisabledUserSessionRejected(t *testing.T) {
|
|
pool := openTestPool(t)
|
|
if pool == nil {
|
|
return
|
|
}
|
|
defer pool.Close()
|
|
|
|
cfg := &config.Config{Env: "dev"}
|
|
ctx := context.Background()
|
|
store, err := auth.NewPgStore(pool, cfg)
|
|
if err != nil {
|
|
t.Fatalf("NewPgStore: %v", err)
|
|
}
|
|
user, err := store.GetUserByUsername(ctx, "zhanggong")
|
|
if err != nil {
|
|
t.Skipf("zhanggong not seeded: %v", err)
|
|
}
|
|
tokenHash := auth.HashToken("phase1-disable-token-" + time.Now().Format(time.RFC3339Nano))
|
|
if err := store.CreateSession(ctx, user.ID, tokenHash, auth.SessionMeta{}); err != nil {
|
|
t.Fatalf("CreateSession: %v", err)
|
|
}
|
|
t.Cleanup(func() {
|
|
_ = store.RevokeByTokenHash(context.Background(), tokenHash)
|
|
})
|
|
if _, err := store.UpdateUserStatus(ctx, user.ID, auth.StatusDisabled); err != nil {
|
|
t.Fatalf("disable: %v", err)
|
|
}
|
|
if _, err := store.ResolveUserID(ctx, tokenHash); err == nil {
|
|
t.Fatal("expected disabled user session to be rejected")
|
|
}
|
|
|
|
t.Cleanup(func() {
|
|
_, _ = store.UpdateUserStatus(context.Background(), user.ID, auth.StatusActive)
|
|
})
|
|
}
|