DenozordecandCursor
5a16a45922
Секрет agent больше не отдаётся viewer/editor в GET/list speakers; остаётся только при создании спикера. Co-authored-by: Cursor <cursoragent@cursor.com>
63 lines
1.8 KiB
Go
63 lines
1.8 KiB
Go
package httpapi
|
|
|
|
import (
|
|
"encoding/json"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestGetSpeaker_redactsAgentSecret(t *testing.T) {
|
|
srv, err := New(Options{InsecureDev: true, SeedDemo: true, BundleSeedHex: testBundleSeed})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
defer srv.Close()
|
|
tenant, _, _, _, demoSpk := srv.Store().DemoIDs()
|
|
mustSetTestAPIKeys(t, srv, "vwkey|"+tenant+"|viewer")
|
|
|
|
req := httptest.NewRequest(http.MethodGet, "/v1/speakers/"+demoSpk, nil)
|
|
req.Header.Set("Authorization", "Bearer vwkey")
|
|
rec := httptest.NewRecorder()
|
|
srv.Handler().ServeHTTP(rec, req)
|
|
if rec.Code != http.StatusOK {
|
|
t.Fatalf("status %d body %s", rec.Code, rec.Body.String())
|
|
}
|
|
var out map[string]any
|
|
if err := json.Unmarshal(rec.Body.Bytes(), &out); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if out["agent_secret"] != nil {
|
|
t.Fatalf("agent_secret must not appear at top level: %#v", out["agent_secret"])
|
|
}
|
|
meta, _ := out["meta_json"].(map[string]any)
|
|
if meta != nil {
|
|
if v, ok := meta["agent_secret"]; ok && v != nil && v != "" {
|
|
t.Fatalf("agent_secret must be redacted from meta_json: %#v", v)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestListSpeakers_redactsAgentSecret(t *testing.T) {
|
|
srv, err := New(Options{InsecureDev: true, SeedDemo: true, BundleSeedHex: testBundleSeed})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
defer srv.Close()
|
|
tenant, _, _, _, _ := srv.Store().DemoIDs()
|
|
mustSetTestAPIKeys(t, srv, "vwkey|"+tenant+"|viewer")
|
|
|
|
req := httptest.NewRequest(http.MethodGet, "/v1/speakers", nil)
|
|
req.Header.Set("Authorization", "Bearer vwkey")
|
|
rec := httptest.NewRecorder()
|
|
srv.Handler().ServeHTTP(rec, req)
|
|
if rec.Code != http.StatusOK {
|
|
t.Fatalf("status %d body %s", rec.Code, rec.Body.String())
|
|
}
|
|
body := rec.Body.String()
|
|
if strings.Contains(body, "agent_secret") {
|
|
t.Fatalf("list response must not contain agent_secret: %s", body)
|
|
}
|
|
}
|