Function TestScope_LegacyAuthenticatorIsAccount

internal/httpapi/scope_test.go:192–212

TestScope_LegacyAuthenticatorIsAccount: with only the legacy Authenticator wired (no PrincipalAuthenticator), every caller is treated as account-scoped — the pre-Slice-5a behavior, so the ceiling never falsely 403s old deployments.

(t *testing.T)

// wired (no PrincipalAuthenticator), every caller is treated as account-scoped
// — the pre-Slice-5a behavior, so the ceiling never falsely 403s old deployments.
func TestScope_LegacyAuthenticatorIsAccount(t *testing.T) {
	deps := Deps{
		Authenticator: func(r *http.Request) (*identity.User, error) {
			if r.Header.Get("Authorization") == "Bearer good" {
				return &identity.User{ID: "u_1"}, nil
			}
			return nil, errors.New("unauthorized")
		},
		ListAgents: func(ctx context.Context, userID string) ([]identity.AgentIdentity, error) {
			return []identity.AgentIdentity{sampleAgent()}, nil
		},
		Legacy: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { w.WriteHeader(http.StatusTeapot) }),
	}
	srv := httptest.NewServer(New(deps))
	t.Cleanup(srv.Close)

	code, body := sendJSON(t, "GET", srv.URL+"/v1/agents", "good", nil)
	if code != 200 {
		t.Fatalf("legacy authenticator on account route: status %d, want 200 (body %v)", code, body)
	}
}