TestHandler_QueryTokenRejected pins the cutover: the legacy `?token= ` query parameter is no longer accepted — only the Authorization: Bearer header.
(t *testing.T)
| 152 | // TestHandler_QueryTokenRejected pins the cutover: the legacy `?token=<key>` |
| 153 | // query parameter is no longer accepted — only the Authorization: Bearer header. |
| 154 | func TestHandler_QueryTokenRejected(t *testing.T) { |
| 155 | hub := NewHub() |
| 156 | defer hub.Close() |
| 157 | store := &mockStore{user: newTestUser()} |
| 158 | handler := NewHandler(hub, store) |
| 159 | srv := startServer(t, handler) |
| 160 | |
| 161 | // GET with the credential ONLY in the query string, no Authorization header. |
| 162 | url := fmt.Sprintf("%s/api/v1/agents/%s/ws?token=%s", srv.URL, "bot@agents.e2a.dev", "valid_key") |
| 163 | resp, err := http.Get(url) |
| 164 | if err != nil { |
| 165 | t.Fatalf("GET: %v", err) |
| 166 | } |
| 167 | defer resp.Body.Close() |
| 168 | if resp.StatusCode != http.StatusUnauthorized { |
| 169 | t.Fatalf("a ?token= query must be rejected (header-only auth), got %d", resp.StatusCode) |
| 170 | } |
| 171 | } |
| 172 | |
| 173 | func TestHandler_InvalidToken(t *testing.T) { |
| 174 | hub := NewHub() |
nothing calls this directly
no test coverage detected