Function TestHandler_AgentScoped_WrongAgent_Forbidden

internal/ws/handler_test.go:223–240

HIGH-1 regression: an agent-scoped credential pinned to agent A must NOT be able to open agent B's stream, even when both agents share the same owner.

(t *testing.T)

// HIGH-1 regression: an agent-scoped credential pinned to agent A must NOT be
// able to open agent B's stream, even when both agents share the same owner.
func TestHandler_AgentScoped_WrongAgent_Forbidden(t *testing.T) {
	hub := NewHub()
	defer hub.Close()
	store := &mockStore{
		user:    newTestUser(),          // user_1
		scope:   identity.ScopeAgent,    // agent-scoped credential…
		agentID: "agent_OTHER",          // …bound to a different agent
		agent:   newTestAgent("user_1"), // target agent (id agent_test), same owner
	}
	handler := NewHandler(hub, store)
	srv := startServer(t, handler)

	resp := doHTTP(t, srv, "bot@agents.e2a.dev", "agent_a_key")
	defer resp.Body.Close()
	if resp.StatusCode != http.StatusForbidden {
		t.Fatalf("agent-scoped key for a different agent must be 403, got %d", resp.StatusCode)
	}
}

// HIGH-1: an agent-scoped credential pinned to the SAME agent it targets connects.
func TestHandler_AgentScoped_BoundAgent_Connects(t *testing.T) {