t
2bbf42b741
Remove Agent Desk users, roles, login sessions, tokens, and local permission persistence. Expose the backend as an embeddable ai-agent module with host-provided subject lookup and operation authorization callbacks, and complete the frontend/backend repository split.
69 lines
2.0 KiB
Go
69 lines
2.0 KiB
Go
package services
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"net/http/httptest"
|
|
"testing"
|
|
|
|
"code.tczkiot.com/wlw/ai-agent/identity"
|
|
"code.tczkiot.com/wlw/ai-agent/internal/pkg/constants"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
)
|
|
|
|
func TestExternalAuthDelegatesOperationToHost(t *testing.T) {
|
|
SetQuerySubjects(func(_ context.Context, query identity.Query) ([]identity.Subject, error) {
|
|
if !query.Current {
|
|
return nil, nil
|
|
}
|
|
return []identity.Subject{{
|
|
Type: identity.SubjectAdmin,
|
|
Category: identity.CategorySystem,
|
|
ID: 9,
|
|
Username: "admin",
|
|
Name: "Admin",
|
|
Enabled: true,
|
|
}}, nil
|
|
})
|
|
|
|
var gotOperation string
|
|
SetAuthorize(func(_ context.Context, operation string) error {
|
|
gotOperation = operation
|
|
return nil
|
|
})
|
|
|
|
ctx, _ := gin.CreateTestContext(httptest.NewRecorder())
|
|
ctx.Request = httptest.NewRequest("GET", "/api/dashboard/conversation/list", nil)
|
|
principal, err := AuthService.RequirePermission(ctx, constants.PermissionConversationView)
|
|
if err != nil {
|
|
t.Fatalf("RequirePermission() error = %v", err)
|
|
}
|
|
if principal.UserID != 9 || principal.SubjectType != identity.SubjectAdmin {
|
|
t.Fatalf("principal = %#v", principal)
|
|
}
|
|
if gotOperation != constants.PermissionConversationView.Code {
|
|
t.Fatalf("operation = %q, want %q", gotOperation, constants.PermissionConversationView.Code)
|
|
}
|
|
}
|
|
|
|
func TestExternalAuthRejectsHostDeniedOperation(t *testing.T) {
|
|
SetQuerySubjects(func(_ context.Context, query identity.Query) ([]identity.Subject, error) {
|
|
if !query.Current {
|
|
return nil, nil
|
|
}
|
|
return []identity.Subject{{
|
|
Type: identity.SubjectAgent, Category: identity.CategorySystem, ID: 10, Enabled: true,
|
|
}}, nil
|
|
})
|
|
SetAuthorize(func(_ context.Context, _ string) error {
|
|
return errors.New("denied by host")
|
|
})
|
|
|
|
ctx, _ := gin.CreateTestContext(httptest.NewRecorder())
|
|
ctx.Request = httptest.NewRequest("POST", "/api/dashboard/ai-config/delete", nil)
|
|
if _, err := AuthService.RequirePermission(ctx, constants.PermissionAIConfigDelete); err == nil {
|
|
t.Fatal("RequirePermission() error = nil, want forbidden")
|
|
}
|
|
}
|