(t *testing.T)
| 202 | } |
| 203 | |
| 204 | func TestHandler_NotOwner(t *testing.T) { |
| 205 | hub := NewHub() |
| 206 | defer hub.Close() |
| 207 | store := &mockStore{ |
| 208 | user: newTestUser(), |
| 209 | agent: newTestAgent("other_user"), |
| 210 | } |
| 211 | handler := NewHandler(hub, store) |
| 212 | srv := startServer(t, handler) |
| 213 | |
| 214 | resp := doHTTP(t, srv, "bot@agents.e2a.dev", "valid_key") |
| 215 | defer resp.Body.Close() |
| 216 | if resp.StatusCode != http.StatusForbidden { |
| 217 | t.Fatalf("expected 403, got %d", resp.StatusCode) |
| 218 | } |
| 219 | } |
| 220 | |
| 221 | // HIGH-1 regression: an agent-scoped credential pinned to agent A must NOT be |
| 222 | // able to open agent B's stream, even when both agents share the same owner. |
nothing calls this directly
no test coverage detected