76 lines
2.0 KiB
Go
76 lines
2.0 KiB
Go
package store
|
|
|
|
import (
|
|
"encoding/json"
|
|
"fmt"
|
|
"testing"
|
|
"time"
|
|
|
|
"git.ipao.vip/rogee/go-sip/contracts"
|
|
"git.ipao.vip/rogee/go-sip/internal/contract"
|
|
"git.ipao.vip/rogee/go-sip/internal/tenant"
|
|
)
|
|
|
|
func TestRevokedAuthorizationCannotReappearUnderNewRequest(t *testing.T) {
|
|
s, err := Open(":memory:")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
defer s.Close()
|
|
if err := s.BindDispatcherID(identityA); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
now := time.Date(2026, 9, 21, 0, 0, 1, 0, time.UTC)
|
|
s.now = func() time.Time { return now }
|
|
raw, err := contracts.Files.ReadFile("upstream/" + contract.MQSourceCommit + "/examples/ai-config-request.json")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
route, err := tenant.NewDispatcherRoute(identityA, "tenant-a")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
for step := 0; step < 4; step++ {
|
|
var request, response map[string]any
|
|
if err := json.Unmarshal(raw, &request); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
request["message_id"] = fmt.Sprintf("request-%d", step)
|
|
requestRaw, err := json.Marshal(request)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := s.QueueAIConfigRequest(requestRaw); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := json.Unmarshal(validAIReply(t, now), &response); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
response["message_id"] = fmt.Sprintf("response-%d", step)
|
|
response["correlation_id"] = request["message_id"]
|
|
auth := response["payload"].(map[string]any)["authorization"].(map[string]any)
|
|
auth["revoked"] = step == 1
|
|
if step == 1 {
|
|
auth["revocation_reason"] = "revoked by local test"
|
|
}
|
|
if step == 3 {
|
|
auth["authorization_id"] = "new-grant-after-revocation"
|
|
}
|
|
responseRaw, err := json.Marshal(response)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := s.StoreAIConfigResponse(responseRaw, route.InboundKey); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
_, _, err = s.LoadAuthorizedAI("tenant-a", "tenant-a", "version-a", "egress-mock")
|
|
if step == 1 || step == 2 {
|
|
if err == nil {
|
|
t.Fatalf("revoked grant admitted at step %d", step)
|
|
}
|
|
} else if err != nil {
|
|
t.Fatalf("valid new grant rejected: %v", err)
|
|
}
|
|
}
|
|
}
|