TestCreateScopedAPIKey_Guards: an agent key must name an owned agent; an account key must not name one; unknown scope is rejected.
(t *testing.T)
| 90 | // TestCreateScopedAPIKey_Guards: an agent key must name an owned agent; an |
| 91 | // account key must not name one; unknown scope is rejected. |
| 92 | func TestCreateScopedAPIKey_Guards(t *testing.T) { |
| 93 | store, user, ag := setupScopeUserAgent(t, "scope-guard") |
| 94 | ctx := context.Background() |
| 95 | |
| 96 | // agent scope, no agent id → error |
| 97 | if _, err := store.CreateScopedAPIKey(ctx, user.ID, "x", identity.ScopeAgent, "", nil); err == nil { |
| 98 | t.Error("expected error for agent scope without agent_id") |
| 99 | } |
| 100 | // account scope, with agent id → error |
| 101 | if _, err := store.CreateScopedAPIKey(ctx, user.ID, "x", identity.ScopeAccount, ag.ID, nil); err == nil { |
| 102 | t.Error("expected error for account scope naming an agent") |
| 103 | } |
| 104 | // unknown scope → error |
| 105 | if _, err := store.CreateScopedAPIKey(ctx, user.ID, "x", "root", "", nil); err == nil { |
| 106 | t.Error("expected error for unknown scope") |
| 107 | } |
| 108 | |
| 109 | // agent scope bound to ANOTHER user's agent → error (cross-tenant guard) |
| 110 | store2, user2, _ := setupScopeUserAgent(t, "scope-guard2") |
| 111 | _ = store2 |
| 112 | if _, err := store.CreateScopedAPIKey(ctx, user2.ID, "x", identity.ScopeAgent, ag.ID, nil); err == nil { |
| 113 | t.Error("expected error binding a key to another user's agent") |
| 114 | } |
| 115 | } |
| 116 | |
| 117 | // TestLegacyKeyResolvesAccount: a pre-Slice-5a row with NULL scope resolves to |
| 118 | // account (the backfill guarantee — no key silently loses authority). |
nothing calls this directly
no test coverage detected