Function TestScope_AgentKeyPinnedToBoundAgent

internal/httpapi/scope_test.go:167–187

TestScope_AgentKeyPinnedToBoundAgent: a per-agent runtime route lets an agent-scoped credential act as its bound agent but 403s on any other agent; an account-scoped credential reaches both.

(t *testing.T)

// agent-scoped credential act as its bound agent but 403s on any other agent;
// an account-scoped credential reaches both.
func TestScope_AgentKeyPinnedToBoundAgent(t *testing.T) {
	srv := scopeTestServer(t)

	cases := []struct {
		name, path, bearer string
		wantStatus         int
	}{
		{"bound-agent-ok", "/v1/agents/support%40acme.com", "agtSupport", 200},
		{"other-agent-403", "/v1/agents/other%40acme.com", "agtSupport", 403},
		{"account-reaches-support", "/v1/agents/support%40acme.com", "acct", 200},
		{"account-reaches-other", "/v1/agents/other%40acme.com", "acct", 200},
	}
	for _, c := range cases {
		t.Run(c.name, func(t *testing.T) {
			code, body := sendJSON(t, "GET", srv.URL+c.path, c.bearer, nil)
			if code != c.wantStatus {
				t.Fatalf("GET %s as %s: status %d, want %d (body %v)", c.path, c.bearer, code, c.wantStatus, body)
			}
		})
	}
}

// TestScope_LegacyAuthenticatorIsAccount: with only the legacy Authenticator
// wired (no PrincipalAuthenticator), every caller is treated as account-scoped