first commit

run/protocol/job_validation_test.go

@@ -0,0 +1,46 @@
+package protocol
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestValidateRunJobAssignmentScopedFilePayloads(t *testing.T) {
+	assignment := RunJobAssignment{
+		JobID:            "job-config-write",
+		ServerInstanceID: "server-1",
+		RunEndpointID:    "run-local",
+		Capability:       RunCapabilityConfigWrite,
+		TargetKey:        "server.properties",
+		InputRef:         "input://server-config/server-1/server.properties/v1",
+		IdempotencyKey:   "idem-config",
+	}
+	if err := ValidateRunJobAssignment(assignment); err != nil {
+		t.Fatalf("expected valid config write assignment: %v", err)
+	}
+
+	assignment.TargetKey = "/Users/tasia/server.properties"
+	if err := ValidateRunJobAssignment(assignment); err == nil || !strings.Contains(err.Error(), "targetKey") {
+		t.Fatalf("expected raw host path rejection, got %v", err)
+	}
+
+	assignment.TargetKey = "server.properties"
+	assignment.InputRef = "sk-raw-secret"
+	if err := ValidateRunJobAssignment(assignment); err == nil || !strings.Contains(err.Error(), "inputRef") {
+		t.Fatalf("expected raw credential ref rejection, got %v", err)
+	}
+}
+
+func TestValidateRunJobAssignmentScopedReadDoesNotRequireInputRef(t *testing.T) {
+	assignment := RunJobAssignment{
+		JobID:            "job-files-read",
+		ServerInstanceID: "server-1",
+		RunEndpointID:    "run-local",
+		Capability:       RunCapabilityFilesRead,
+		TargetKey:        "logs/latest.log",
+		IdempotencyKey:   "idem-read",
+	}
+	if err := ValidateRunJobAssignment(assignment); err != nil {
+		t.Fatalf("expected valid file read assignment: %v", err)
+	}
+}