switchboard/core
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Releases 9 Wiki Activity

Changeset 0.28.7 (#193)

Browse Source
This commit is contained in:
xcaliber
2026-03-15 15:45:00 +00:00
parent bffda043db
commit 3237d55e0c
82 changed files with 2481 additions and 2771 deletions
Download Patch File Download Diff File Expand all files Collapse all files

78
server/handlers/task_test.go
View File

@@ -685,6 +685,84 @@ func TestTask_WorkflowTypeRejected(t *testing.T) {
}
}
// ═══════════════════════════════════════════════
// Task Type RBAC (v0.28.7)
// ═══════════════════════════════════════════════
func TestTask_StarlarkTypeRejected(t *testing.T) {
h := setupHarness(t)
_, token := h.createAdminUser("staruser", "staruser@test.com")
// Even admin cannot create starlark tasks — executor doesn't exist yet
w := h.request("POST", "/api/v1/tasks", token, map[string]interface{}{
"name": "Starlark Task",
"task_type": "starlark",
"schedule": "@daily",
"user_prompt": "x",
"model_id": "m",
})
if w.Code != http.StatusBadRequest {
t.Fatalf("starlark task_type: want 400, got %d: %s", w.Code, w.Body.String())
}
body := w.Body.String()
if !strings.Contains(body, "v0.29.0") {
t.Fatalf("expected 'v0.29.0' in error, got: %s", body)
}
}
func TestTask_SystemTypeNonAdminDenied(t *testing.T) {
h := setupHarness(t)
// Seed Everyone group with task.create so the route middleware passes
database.TestDB.Exec(dialectSQL(
`INSERT INTO groups (id, name, source, permissions) VALUES ($1, $2, $3, $4)
ON CONFLICT (id) DO UPDATE SET permissions = $4`),
"00000000-0000-0000-0000-000000000001", "Everyone", "system", `["task.create"]`,
)
// Enable registration so registerUser works
database.TestDB.Exec("INSERT INTO platform_policies (key, value) VALUES ('allow_registration', 'true') ON CONFLICT (key) DO UPDATE SET value = 'true'")
database.TestDB.Exec("INSERT INTO platform_policies (key, value) VALUES ('default_user_active', 'true') ON CONFLICT (key) DO UPDATE SET value = 'true'")
_, userToken := h.registerUser("sysuser", "sysuser@test.com", "password123!")
w := h.request("POST", "/api/v1/tasks", userToken, map[string]interface{}{
"name": "System Task",
"task_type": "system",
"system_function": "session_cleanup",
"schedule": "@daily",
})
if w.Code != http.StatusForbidden {
t.Fatalf("system task as non-admin: want 403, got %d: %s", w.Code, w.Body.String())
}
}
func TestTask_ActionTypeNonAdminDenied(t *testing.T) {
h := setupHarness(t)
// Seed Everyone group with task.create but NOT task.action
database.TestDB.Exec(dialectSQL(
`INSERT INTO groups (id, name, source, permissions) VALUES ($1, $2, $3, $4)
ON CONFLICT (id) DO UPDATE SET permissions = $4`),
"00000000-0000-0000-0000-000000000001", "Everyone", "system", `["task.create"]`,
)
// Enable registration so registerUser works
database.TestDB.Exec("INSERT INTO platform_policies (key, value) VALUES ('allow_registration', 'true') ON CONFLICT (key) DO UPDATE SET value = 'true'")
database.TestDB.Exec("INSERT INTO platform_policies (key, value) VALUES ('default_user_active', 'true') ON CONFLICT (key) DO UPDATE SET value = 'true'")
_, userToken := h.registerUser("actuser", "actuser@test.com", "password123!")
w := h.request("POST", "/api/v1/tasks", userToken, map[string]interface{}{
"name": "Action Task",
"task_type": "action",
"schedule": "webhook",
})
if w.Code != http.StatusForbidden {
t.Fatalf("action task without task.action: want 403, got %d: %s", w.Code, w.Body.String())
}
}
// ═══════════════════════════════════════════════
// F8: Team Task Routes
// ═══════════════════════════════════════════════