Slice 5a — scope machinery. These DB-backed tests pin the credential-scope contract: minting, prefixes, the resolved principal, legacy backfill, and the cross-user / binding guards.
(t *testing.T, slug string)
| 14 | // cross-user / binding guards. |
| 15 | |
| 16 | func setupScopeUserAgent(t *testing.T, slug string) (*identity.Store, *identity.User, *identity.AgentIdentity) { |
| 17 | t.Helper() |
| 18 | pool := testutil.TestDB(t) |
| 19 | store := identity.NewStore(pool) |
| 20 | ctx := context.Background() |
| 21 | user, err := store.CreateOrGetUser(ctx, "owner-"+slug+"@example.com", "Owner", "google-"+slug) |
| 22 | if err != nil { |
| 23 | t.Fatalf("CreateOrGetUser: %v", err) |
| 24 | } |
| 25 | dom := slug + ".example.com" |
| 26 | if _, err := store.ClaimOrCreateDomain(ctx, dom, user.ID); err != nil { |
| 27 | t.Fatalf("ClaimOrCreateDomain: %v", err) |
| 28 | } |
| 29 | ag, err := store.CreateAgent(ctx, "agent@"+dom, dom, "", "", "", user.ID) |
| 30 | if err != nil { |
| 31 | t.Fatalf("CreateAgent: %v", err) |
| 32 | } |
| 33 | return store, user, ag |
| 34 | } |
| 35 | |
| 36 | func TestCreateAPIKey_DefaultsToAccountScope(t *testing.T) { |
| 37 | store, user, _ := setupScopeUserAgent(t, "scope-acct") |
no test coverage detected