nexarch/connect/internal/statusapi/statusapi_policy_test.go

package statusapi

import (
	"encoding/json"
	"net/http"
	"net/http/httptest"
	"testing"

	"gitea.perlbach24.de/scripte/nexarch/common/policyclient"
)

// newFakePolicyAPI steht fuer Core's echten POST /authorize-Vertrag (nimmt
// role/permission/tenant entgegen, antwortet {"allowed": bool} exakt wie
// internal/policyapi). Testet die echte Durchsetzungskette
// (requirePermission -> policyclient.Client -> HTTP -> 403/next), nicht
// nur einen wirkungslosen Datenbankeintrag.
func newFakePolicyAPI(t *testing.T, allow bool) *httptest.Server {
	t.Helper()
	return httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		if r.URL.Path != "/authorize" || r.Header.Get("X-Service-Token") == "" {
			t.Fatalf("unerwartete anfrage: %s %s", r.Method, r.URL.Path)
		}
		w.Header().Set("Content-Type", "application/json")
		_ = json.NewEncoder(w).Encode(map[string]bool{"allowed": allow})
	}))
}

func TestHandleList_PolicyDenies_Rejected(t *testing.T) {
	s := newTestServer(t)
	policyAPI := newFakePolicyAPI(t, false)
	defer policyAPI.Close()
	s = s.WithPolicy(policyclient.New(policyAPI.URL, "test-token"))
	mux := http.NewServeMux()
	s.RegisterRoutes(mux)

	req := httptest.NewRequest("GET", "/connectors/status", nil)
	req.Header.Set("X-User-Id", "u1")
	req.Header.Set("X-Tenant-Slug", "acme")
	rec := httptest.NewRecorder()
	mux.ServeHTTP(rec, req)
	if rec.Code != http.StatusForbidden {
		t.Fatalf("erwartet 403 ohne berechtigung, bekam %d: %s", rec.Code, rec.Body.String())
	}
}

func TestHandleList_PolicyAllows_Passes(t *testing.T) {
	s := newTestServer(t)
	policyAPI := newFakePolicyAPI(t, true)
	defer policyAPI.Close()
	s = s.WithPolicy(policyclient.New(policyAPI.URL, "test-token"))
	mux := http.NewServeMux()
	s.RegisterRoutes(mux)

	req := httptest.NewRequest("GET", "/connectors/status", nil)
	req.Header.Set("X-User-Id", "u1")
	req.Header.Set("X-Tenant-Slug", "acme")
	rec := httptest.NewRecorder()
	mux.ServeHTTP(rec, req)
	if rec.Code != http.StatusOK {
		t.Fatalf("erwartet 200 mit berechtigung, bekam %d: %s", rec.Code, rec.Body.String())
	}
}