Function TestHTTP_Consent_Allow_CreateNew

internal/agent/oauth_consent_test.go:296–338

──────────────────────── /consent ──────────────────────── TestHTTP_Consent_Allow_CreateNew is the happy path: user picks "create_new" + a slug, gets a code redirected to the client's redirect_uri. Verifies (a) status 303, (b) code has our prefix, (c) iss is present per RFC 9207, (d) state round-tri

(t *testing.T)

// (c) iss is present per RFC 9207, (d) state round-trips, and
// (e) the agent row was actually created.
func TestHTTP_Consent_Allow_CreateNew(t *testing.T) {
	f := newConsentFixture(t)
	_, challenge := newPKCE(t)

	form := authorizeParams(challenge, f.clientID, "s1s1s1s1s1s1s1s1")
	form.Set("action", "allow")
	form.Set("agent_choice", "create_new")
	form.Set("new_agent_slug", "myconsentbot")

	resp := f.consentPOST(t, form)
	defer resp.Body.Close()
	if resp.StatusCode != http.StatusSeeOther {
		t.Fatalf("status = %d, want 303 See Other", resp.StatusCode)
	}
	loc, err := url.Parse(resp.Header.Get("Location"))
	if err != nil {
		t.Fatalf("Location parse: %v", err)
	}
	if !strings.HasPrefix(loc.String(), "http://localhost:8765/callback") {
		t.Errorf("must redirect back to client redirect_uri: got %q", loc.String())
	}
	code := loc.Query().Get("code")
	if !strings.HasPrefix(code, oauth.AuthCodePrefix) {
		t.Errorf("code missing %q prefix: %q", oauth.AuthCodePrefix, code)
	}
	if got := loc.Query().Get("state"); got != "s1s1s1s1s1s1s1s1" {
		t.Errorf("state round-trip: got %q, want s1s1s1s1s1s1s1s1", got)
	}
	if got := loc.Query().Get("iss"); got != "https://test.e2a.dev" {
		t.Errorf("RFC 9207 iss missing/wrong: got %q, want https://test.e2a.dev", got)
	}

	// Verify the agent was actually created on the shared domain.
	var count int
	if err := f.pool.QueryRow(context.Background(),
		`SELECT count(*) FROM agent_identities WHERE id = $1 AND user_id = $2`,
		"myconsentbot@agents.e2a.dev", f.userID).Scan(&count); err != nil {
		t.Fatal(err)
	}
	if count != 1 {
		t.Errorf("expected exactly 1 agent row for new slug, got %d", count)
	}
}

// TestHTTP_Consent_Allow_Existing — user picks an agent they already
// own. No new agent created; code issued bound to the chosen email.