(t *testing.T)
| 61 | } |
| 62 | |
| 63 | func TestCreateScopedAPIKey_Agent(t *testing.T) { |
| 64 | store, user, ag := setupScopeUserAgent(t, "scope-agent") |
| 65 | ctx := context.Background() |
| 66 | |
| 67 | key, err := store.CreateScopedAPIKey(ctx, user.ID, "runtime", identity.ScopeAgent, ag.ID, nil) |
| 68 | if err != nil { |
| 69 | t.Fatalf("CreateScopedAPIKey(agent): %v", err) |
| 70 | } |
| 71 | if key.Scope != identity.ScopeAgent { |
| 72 | t.Errorf("scope = %q, want agent", key.Scope) |
| 73 | } |
| 74 | if key.AgentID == nil || *key.AgentID != ag.ID { |
| 75 | t.Errorf("agent key AgentID = %v, want %s", key.AgentID, ag.ID) |
| 76 | } |
| 77 | if !strings.HasPrefix(key.PlaintextKey, "e2a_agt_") { |
| 78 | t.Errorf("agent key prefix = %q, want e2a_agt_", key.PlaintextKey[:11]) |
| 79 | } |
| 80 | |
| 81 | p, err := store.GetPrincipalByAPIKey(ctx, key.PlaintextKey) |
| 82 | if err != nil { |
| 83 | t.Fatalf("GetPrincipalByAPIKey: %v", err) |
| 84 | } |
| 85 | if p.Scope != identity.ScopeAgent || p.AgentID != ag.ID { |
| 86 | t.Errorf("principal = %+v, want agent scope bound to %s", p, ag.ID) |
| 87 | } |
| 88 | } |
| 89 | |
| 90 | // TestCreateScopedAPIKey_Guards: an agent key must name an owned agent; an |
| 91 | // account key must not name one; unknown scope is rejected. |
nothing calls this directly
no test coverage detected