Function TestScope_ProtectionPutIsAccountOnly

internal/httpapi/scope_test.go:129–144

TestScope_ProtectionPutIsAccountOnly: writing protection config is barred for an agent-scoped credential even on its own bound agent (#13). A valid body is sent so the request clears Huma schema validation and reaches the scope gate.

(t *testing.T)

// an agent-scoped credential even on its own bound agent (#13). A valid body is
// sent so the request clears Huma schema validation and reaches the scope gate.
func TestScope_ProtectionPutIsAccountOnly(t *testing.T) {
	srv := scopeTestServer(t)
	body := map[string]any{
		"inbound":  map[string]any{"gate": map[string]any{}, "scan": map[string]any{}},
		"outbound": map[string]any{"gate": map[string]any{}, "scan": map[string]any{}},
		"holds":    map[string]any{},
	}
	code, _ := sendJSON(t, "PUT", srv.URL+"/v1/agents/support%40acme.com/protection", "acct", body)
	if code != 200 {
		t.Errorf("account key PUT protection: status %d, want 200", code)
	}
	code, resp := sendJSON(t, "PUT", srv.URL+"/v1/agents/support%40acme.com/protection", "agtSupport", body)
	if code != 403 || errCode(resp) != "forbidden" {
		t.Errorf("agent key PUT own protection: status %d body %v, want 403 forbidden", code, resp)
	}
}

// TestScope_ApproveRejectIsAccountOnly: HITL approve/reject is barred for an
// agent-scoped credential EVEN ON ITS OWN BOUND AGENT — self-approval would