weichenandCursor
7fdbee6c0c
Boot memory IAM only via explicit test env opt-in; strict auth cases disable AllowInMemory after startup. Co-authored-by: Cursor <cursoragent@cursor.com>
96 lines
2.6 KiB
Go
96 lines
2.6 KiB
Go
package server_test
|
|
|
|
import (
|
|
"context"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"os"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/jackc/pgx/v5/pgxpool"
|
|
|
|
"chat-agent-system/internal/authz"
|
|
"chat-agent-system/internal/config"
|
|
"chat-agent-system/internal/server"
|
|
)
|
|
|
|
func openPGPool(t *testing.T) *pgxpool.Pool {
|
|
t.Helper()
|
|
dsn := os.Getenv("TEST_DATABASE_URL")
|
|
if dsn == "" {
|
|
dsn = "postgres://app:dev_secret_db_pass@127.0.0.1:5433/agent_system_dev?sslmode=disable"
|
|
}
|
|
ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
|
|
defer cancel()
|
|
pool, err := pgxpool.New(ctx, dsn)
|
|
if err != nil {
|
|
t.Skipf("postgres unavailable: %v", err)
|
|
return nil
|
|
}
|
|
if err := pool.Ping(ctx); err != nil {
|
|
pool.Close()
|
|
t.Skipf("postgres ping failed: %v", err)
|
|
}
|
|
return pool
|
|
}
|
|
|
|
func TestProjectMembers_CrossProjectForbidden(t *testing.T) {
|
|
pool := openPGPool(t)
|
|
if pool == nil {
|
|
return
|
|
}
|
|
defer pool.Close()
|
|
|
|
ctx := context.Background()
|
|
var projectA, projectB int64
|
|
err := pool.QueryRow(ctx, `SELECT id FROM projects ORDER BY id ASC LIMIT 1`).Scan(&projectA)
|
|
if err != nil || projectA <= 0 {
|
|
t.Skip("no projects in database for cross-project test")
|
|
}
|
|
err = pool.QueryRow(ctx, `SELECT id FROM projects WHERE id <> $1 ORDER BY id ASC LIMIT 1`, projectA).Scan(&projectB)
|
|
if err != nil || projectB <= 0 {
|
|
t.Skip("need at least two projects for cross-project test")
|
|
}
|
|
|
|
var outsiderID int64
|
|
err = pool.QueryRow(ctx, `
|
|
SELECT u.id FROM users u
|
|
WHERE NOT EXISTS (SELECT 1 FROM project_members pm WHERE pm.project_id = $1 AND pm.user_id = u.id AND pm.status = 'active')
|
|
AND NOT EXISTS (SELECT 1 FROM projects p WHERE p.id = $1 AND p.creator_user_id = u.id)
|
|
ORDER BY u.id ASC LIMIT 1
|
|
`, projectA).Scan(&outsiderID)
|
|
if err != nil || outsiderID <= 0 {
|
|
t.Skip("no outsider user available for cross-project test")
|
|
}
|
|
|
|
authzSvc := authz.NewAuthorizer(pool)
|
|
if err := authzSvc.RequireProjectAccess(ctx, projectA, outsiderID); err != authz.ErrForbidden {
|
|
t.Fatalf("expected outsider forbidden on project A, got %v", err)
|
|
}
|
|
}
|
|
|
|
func TestProjectMembers_AnonymousReturns401(t *testing.T) {
|
|
cfg := &config.Config{
|
|
Env: "dev",
|
|
DataDir: t.TempDir(),
|
|
AgentBackend: "stub",
|
|
AllowInMemory: true,
|
|
AdminUsername: "admin",
|
|
AdminPassword: "admin123",
|
|
}
|
|
srv := server.NewServer(cfg, nil)
|
|
cfg.AllowInMemory = false
|
|
ts := httptest.NewServer(srv.Routes())
|
|
defer ts.Close()
|
|
|
|
resp, err := http.Get(ts.URL + "/api/v1/projects/1/members")
|
|
if err != nil {
|
|
t.Fatalf("request: %v", err)
|
|
}
|
|
defer resp.Body.Close()
|
|
if resp.StatusCode != http.StatusUnauthorized {
|
|
t.Fatalf("expected 401, got %d", resp.StatusCode)
|
|
}
|
|
}
|