7862d22a03
Add lib/api/middleware/agent_auth.js: agentOrOwner accepts the owner token (kind=user actor) or a hashed agent token (kind=agent actor carrying capabilities + scopes). /api router now mounts this in place of ownerOnly so agent tokens become first-class. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
56 lines
1.8 KiB
JavaScript
56 lines
1.8 KiB
JavaScript
import { describe, it, expect, beforeAll } from 'vitest';
|
|
import request from 'supertest';
|
|
import { setup } from './helpers.js';
|
|
import * as agentsRepo from '../../lib/db/repos/agents.js';
|
|
|
|
let app, ownerHeaders;
|
|
const owner = { kind: 'user', id: null };
|
|
|
|
beforeAll(async () => { ({ app, ownerHeaders } = await setup()); });
|
|
|
|
describe('agent_or_owner bearer auth', () => {
|
|
it('missing header → 401', async () => {
|
|
const res = await request(app).get('/api/spaces');
|
|
expect(res.status).toBe(401);
|
|
});
|
|
|
|
it('wrong token → 401', async () => {
|
|
const res = await request(app).get('/api/spaces').set('Authorization', 'Bearer wrong');
|
|
expect(res.status).toBe(401);
|
|
});
|
|
|
|
it('owner token → 200', async () => {
|
|
const res = await request(app).get('/api/spaces').set(ownerHeaders);
|
|
expect(res.status).toBe(200);
|
|
});
|
|
|
|
it('valid agent token → 200 and req.actor.kind=agent', async () => {
|
|
const agent = await agentsRepo.create({
|
|
slug: `a-${Date.now()}`,
|
|
name: 'Test',
|
|
kind: 'claude',
|
|
model: 'sonnet',
|
|
capabilities: { read: 'allow', write: 'suggest' },
|
|
scopes: {}
|
|
}, owner);
|
|
const { token } = await agentsRepo.createToken(agent.id, 'test');
|
|
const res = await request(app).get('/api/spaces').set('Authorization', `Bearer ${token}`);
|
|
expect(res.status).toBe(200);
|
|
});
|
|
|
|
it('revoked agent token → 401', async () => {
|
|
const agent = await agentsRepo.create({
|
|
slug: `b-${Date.now()}`,
|
|
name: 'Revoked',
|
|
kind: 'claude',
|
|
model: 'sonnet',
|
|
capabilities: {},
|
|
scopes: {}
|
|
}, owner);
|
|
const { token, id: tokenId } = await agentsRepo.createToken(agent.id, 'rev');
|
|
await agentsRepo.revokeToken(tokenId);
|
|
const res = await request(app).get('/api/spaces').set('Authorization', `Bearer ${token}`);
|
|
expect(res.status).toBe(401);
|
|
});
|
|
});
|