Codex Local
bf1233d5df
ci / verify (push) Canceled after 0s
Add customer and operator login, BLE provisioning, device fleet controls, call memory, memoir generation, and refreshed family and maintenance portals. Include API contracts, migrations, firmware sources, tests, assets, and deployment documentation.
87 lines
3.5 KiB
Go
87 lines
3.5 KiB
Go
package httpapi
|
|
|
|
import (
|
|
"encoding/json"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
|
|
"data-terminal-cloud/internal/alerts"
|
|
"data-terminal-cloud/internal/identity"
|
|
"data-terminal-cloud/internal/onboarding"
|
|
)
|
|
|
|
func TestCustomerModelReadDoesNotGrantOperatorWrites(t *testing.T) {
|
|
for _, tc := range []struct {
|
|
method, path string
|
|
allowed bool
|
|
}{
|
|
{"GET", "/api/v1/content-models", true},
|
|
{"POST", "/api/v1/content-models", false},
|
|
{"POST", "/api/v1/content-models/123/activate", false},
|
|
{"GET", "/api/v1/content-models/123", false},
|
|
{"GET", "/api/v1/ops/content-models", false},
|
|
} {
|
|
if customerCookieRequest(httptest.NewRequest(tc.method, tc.path, nil)) != tc.allowed {
|
|
t.Fatalf("wrong auth boundary: %s %s", tc.method, tc.path)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestAlertRoutesSelectOperatorCookieAuthentication(t *testing.T) {
|
|
router := NewRouter(RouterOptions{ServiceName: "api", TokenVerifier: &identity.OIDCVerifier{}, AlertService: &alerts.Service{}, OnboardingService: &onboarding.Service{}})
|
|
for _, path := range []string{"alert-routing-policies", "alerts", "alert-silences", "alert-delivery-tests"} {
|
|
r := httptest.NewRequest("GET", "https://platform.example/api/v1/ops/"+path, nil)
|
|
r.AddCookie(&http.Cookie{Name: "__Host-platform-onboarding", Value: "customer-cookie"})
|
|
w := httptest.NewRecorder()
|
|
router.ServeHTTP(w, r)
|
|
var body struct {
|
|
Code string `json:"code"`
|
|
}
|
|
if err := json.Unmarshal(w.Body.Bytes(), &body); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if w.Code != 401 || body.Code != "LOGIN_REQUIRED" {
|
|
t.Fatalf("%s must require an operator cookie: %s", path, w.Body.String())
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestCustomerCookieRouteBoundary(t *testing.T) {
|
|
for _, path := range []string{"/api/v1/memoirs/query", "/api/v1/memoirs/generate", "/api/v1/memoirs/import", "/api/v1/memoirs/illustrations/123"} {
|
|
if !customerCookiePath(path) {
|
|
t.Errorf("memoir customer auth unavailable: %s", path)
|
|
}
|
|
}
|
|
for _, path := range []string{"/api/v1/me", "/api/v1/devices", "/api/v1/households/123", "/api/v1/events", "/api/v1/memories/mutations", "/api/v1/stories/123", "/api/v1/conversations/123/turns", "/api/v1/privacy-requests/123", "/api/v1/exports/123", "/api/v1/member-invitations/accept"} {
|
|
if !customerCookiePath(path) {
|
|
t.Errorf("customer route not enabled: %s", path)
|
|
}
|
|
}
|
|
for _, path := range []string{"/api/v1/ops/devices", "/api/v1/content-models", "/api/v1/device/calls/prepare", "/api/v1/device/v3/sessions", "/api/v1/memories-admin", "/api/v1/devices-admin", "/internal/v1/tools/memory-search", "/callbacks/v1/vertc/voice-chat"} {
|
|
if customerCookiePath(path) {
|
|
t.Errorf("cookie crossed authentication boundary: %s", path)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestOperatorCookieRouteBoundary(t *testing.T) {
|
|
for _, path := range []string{"/api/v1/ops/devices", "/api/v1/ops/device-inventory", "/api/v1/content-models", "/api/v1/me", "/api/v1/events"} {
|
|
r := httptest.NewRequest("GET", path, nil)
|
|
r.Header.Set("X-Login-Portal", "operator")
|
|
if !operatorCookieRequest(r) {
|
|
t.Errorf("operator route unavailable: %s", path)
|
|
}
|
|
}
|
|
for _, path := range []string{"/api/v1/ops-admin", "/api/v1/device/calls/prepare", "/api/v1/web/login/password", "/callbacks/v1/vertc/voice-chat", "/api/v1/households", "/internal/v1/tools/memory-search"} {
|
|
r := httptest.NewRequest("POST", path, nil)
|
|
r.Header.Set("X-Login-Portal", "operator")
|
|
if operatorCookieRequest(r) {
|
|
t.Errorf("operator cookie crossed boundary: %s", path)
|
|
}
|
|
}
|
|
if operatorCookieRequest(httptest.NewRequest("GET", "/api/v1/me", nil)) {
|
|
t.Fatal("operator identity selected in customer portal")
|
|
}
|
|
}
|