55 lines
1.9 KiB
Go
55 lines
1.9 KiB
Go
package ai
|
|
|
|
import (
|
|
"bytes"
|
|
"testing"
|
|
"time"
|
|
|
|
"git.ipao.vip/rogee/go-sip/contracts"
|
|
)
|
|
|
|
func TestValidateAuthorizationBindsSnapshotAndTenant(t *testing.T) {
|
|
snapshotRaw, err := contracts.Read("examples/agent-version-asr-only.json")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
snapshot, err := ValidateForMode(snapshotRaw, ModeASROnly)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
authorizationRaw, err := contracts.Files.ReadFile("local/v0.3/examples/ai-authorization-v0.2.json")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if _, err := ValidateAuthorization(authorizationRaw, snapshot, "tenant-1", "tenant-demo-key", time.Date(2026, 9, 18, 0, 0, 30, 0, time.UTC)); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if _, err := ValidateAuthorization(authorizationRaw, snapshot, "other", "tenant-demo-key", time.Date(2026, 9, 18, 0, 0, 30, 0, time.UTC)); err == nil {
|
|
t.Fatal("expected tenant mismatch")
|
|
}
|
|
if _, err := ValidateAuthorization(authorizationRaw, snapshot, "tenant-1", "tenant-demo-key", time.Date(2026, 9, 18, 0, 2, 0, 0, time.UTC)); err == nil {
|
|
t.Fatal("expected expired authorization")
|
|
}
|
|
if _, err := ValidateAuthorization(bytes.Replace(authorizationRaw, []byte(`"revoked": false`), []byte(`"revoked": true`), 1), snapshot, "tenant-1", "tenant-demo-key", time.Date(2026, 9, 18, 0, 0, 30, 0, time.UTC)); err == nil {
|
|
t.Fatal("expected revocation rejection")
|
|
}
|
|
}
|
|
|
|
func TestAuthorizationRejectsRemovedEgressPoolField(t *testing.T) {
|
|
snapshotRaw, err := contracts.Read("examples/agent-version-asr-only.json")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
snapshot, err := ValidateForMode(snapshotRaw, ModeASROnly)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
old, err := contracts.Files.ReadFile("upstream/v1/examples/ai-authorization.json")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if _, err := DecodeBoundAuthorization(old, snapshot, "tenant-1", "tenant-demo-key"); err == nil {
|
|
t.Fatal("legacy egress-pool authorization field unexpectedly accepted")
|
|
}
|
|
}
|