Function scopeTestServer

internal/httpapi/scope_test.go:18–64

Slice 5a — the hard scope ceiling. This exercises the 403 matrix over the real v1 handlers: account-only routes reject agent-scoped credentials; per-agent routes pin an agent-scoped credential to its bound agent; an account-scoped credential passes everywhere it owns.

(t *testing.T)

// account-scoped credential passes everywhere it owns.

func scopeTestServer(t *testing.T) *httptest.Server {
	t.Helper()
	u := &identity.User{ID: "u_1", Email: "owner@acme.com"}
	deps := Deps{
		// Scope-aware auth keyed by bearer:
		//   acct        → account scope
		//   agtSupport  → agent scope bound to support@acme.com
		//   agtOther    → agent scope bound to other@acme.com
		PrincipalAuthenticator: func(r *http.Request) (*identity.Principal, error) {
			switch r.Header.Get("Authorization") {
			case "Bearer acct":
				return &identity.Principal{User: u, Scope: identity.ScopeAccount}, nil
			case "Bearer agtSupport":
				return &identity.Principal{User: u, Scope: identity.ScopeAgent, AgentID: "support@acme.com"}, nil
			case "Bearer agtOther":
				return &identity.Principal{User: u, Scope: identity.ScopeAgent, AgentID: "other@acme.com"}, nil
			}
			return nil, errors.New("unauthorized")
		},
		ListAgents: func(ctx context.Context, userID string) ([]identity.AgentIdentity, error) {
			return []identity.AgentIdentity{sampleAgent()}, nil
		},
		GetAgent: func(ctx context.Context, address string) (*identity.AgentIdentity, error) {
			switch address {
			case "support@acme.com":
				a := sampleAgent()
				return &a, nil
			case "other@acme.com":
				a := sampleAgent()
				a.ID = "other@acme.com"
				return &a, nil
			}
			return nil, errors.New("not found")
		},
		UpdateAgentName: func(ctx context.Context, agentID, userID, name string) error {
			return nil
		},
		UpdateAgentProtection: func(ctx context.Context, agentID, userID string, cfg identity.ProtectionConfig) error {
			return nil
		},
		DeleteAgent: func(ctx context.Context, agentID, userID string) error { return nil },
		Legacy:      http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { w.WriteHeader(http.StatusTeapot) }),
	}
	srv := httptest.NewServer(New(deps))
	t.Cleanup(srv.Close)
	return srv
}

func TestScope_AccountOnlyRoutesRejectAgentKeys(t *testing.T) {
	srv := scopeTestServer(t)