Function TestUpdateAgentProtectionValidation

internal/identity/protection_test.go:131–159

TestUpdateAgentProtectionValidation rejects invalid postures with a clean error.

(t *testing.T)

// TestUpdateAgentProtectionValidation rejects invalid postures with a clean error.
func TestUpdateAgentProtectionValidation(t *testing.T) {
	store, ctx, agentID, userID := newProtectionAgent(t, "prot-val")

	base := identity.ProtectionConfig{
		InboundGatePolicy: "open", InboundGateAction: "flag", InboundScanSensitivity: "off",
		OutboundGatePolicy: "open", OutboundGateAction: "flag", OutboundScanSensitivity: "off",
		HITLTTLSeconds: 604800, HITLExpirationAction: "reject",
	}
	mut := func(f func(*identity.ProtectionConfig)) identity.ProtectionConfig {
		c := base
		f(&c)
		return c
	}
	cases := map[string]identity.ProtectionConfig{
		"verified_only not a gate value": mut(func(c *identity.ProtectionConfig) { c.InboundGatePolicy = "verified_only" }),
		"bad inbound gate policy":        mut(func(c *identity.ProtectionConfig) { c.InboundGatePolicy = "nope" }),
		"bad outbound gate policy":       mut(func(c *identity.ProtectionConfig) { c.OutboundGatePolicy = "verified_only" }),
		"bad gate action":                mut(func(c *identity.ProtectionConfig) { c.OutboundGateAction = "drop" }),
		"bad sensitivity":                mut(func(c *identity.ProtectionConfig) { c.InboundScanSensitivity = "extreme" }),
		"negative ttl":                   mut(func(c *identity.ProtectionConfig) { c.HITLTTLSeconds = -1 }),
		"bad on_expiry":                  mut(func(c *identity.ProtectionConfig) { c.HITLExpirationAction = "defer" }),
		"allowlist over cap":             mut(func(c *identity.ProtectionConfig) { c.InboundAllowlist = makeAllowlist(1001) }),
	}
	for name, c := range cases {
		if err := store.UpdateAgentProtection(ctx, agentID, userID, c); err == nil {
			t.Errorf("%s: expected validation error, got nil", name)
		}
	}
}

// TestUpdateAgentProtectionWrongOwner: a config write keyed to a non-owner is a
// no-op that errors (tenant isolation at the store layer).