| 1 | package daemon |
| 2 | |
| 3 | import ( |
| 4 | "context" |
| 5 | "net/http" |
| 6 | "net/http/httptest" |
| 7 | "strings" |
| 8 | "testing" |
| 9 | ) |
| 10 | |
| 11 | func TestWebMCPReadsUseBrowserSessionPermissions(t *testing.T) { |
| 12 | app, tenant := testTenant(t) |
| 13 | policy := tenant.Policy() |
| 14 | policy.Features.Grasp = true |
| 15 | if err := tenant.applyPolicy(context.Background(), policy); err != nil { |
| 16 | t.Fatal(err) |
| 17 | } |
| 18 | login := httptest.NewRequest(http.MethodPost, "http://relay.test/session" , strings.NewReader("" )) |
| 19 | signRequest(t, login, "" ) |
| 20 | response := httptest.NewRecorder() |
| 21 | app.ServeHTTP(response, login) |
| 22 | if response.Code != http.StatusOK || len(response.Result().Cookies()) != 1 { |
| 23 | t.Fatalf("sign in: status %d" , response.Code) |
| 24 | } |
| 25 | cookie := response.Result().Cookies()[0] |
| 26 | for _, tc := range []struct { |
| 27 | name, method string |
| 28 | signedIn bool |
| 29 | status int |
| 30 | }{ |
| 31 | {"public repositories" , "browserepos" , false, http.StatusOK}, |
| 32 | {"protected status" , "browsestatus" , false, http.StatusForbidden}, |
| 33 | {"owner status" , "browsestatus" , true, http.StatusOK}, |
| 34 | {"mutation rejected" , "setpolicy" , true, http.StatusBadRequest}, |
| 35 | } { |
| 36 | t.Run(tc.name, func(t *testing.T) { |
| 37 | request := httptest.NewRequest(http.MethodGet, "http://relay.test/webmcp/query?method=" +tc.method, nil) |
| 38 | if tc.signedIn { |
| 39 | request.AddCookie(cookie) |
| 40 | } |
| 41 | result := httptest.NewRecorder() |
| 42 | app.ServeHTTP(result, request) |
| 43 | if result.Code != tc.status || !strings.HasPrefix(result.Header().Get("Content-Type" ), "application/json" ) { |
| 44 | t.Fatalf("status %d: %s" , result.Code, result.Body.String()) |
| 45 | } |
| 46 | }) |
| 47 | } |
| 48 | } |