Rebuild SCUM plugin data ownership

2026-08-14 10:03:58 +08:00
parent c8b49c711c
commit a6c4cdac5d
79 changed files with 532 additions and 1842 deletions
@@ -0,0 +1,31 @@
+package service
+
+import (
+	"testing"
+
+	"browser.local/platform/domain"
+)
+
+func TestPluginDataIsOpaqueAndScopedToItsServerPlugin(t *testing.T) {
+	svc := newTestCoreService()
+	plugin, endpoint := createPluginAndRunEndpoint(t, svc)
+	owner, err := svc.RegisterUser(domain.UserRegistration{DisplayName: "Plugin data owner", Email: "plugin-data@example.test", Password: "secret-password"})
+	if err != nil {
+		t.Fatalf("register owner: %v", err)
+	}
+	if _, err := svc.CreateServerInstance(domain.ServerInstance{ID: "server-1", PluginID: plugin.ID, RunEndpointID: endpoint.ID, OwnerUserID: owner.User.ID, Name: "SCUM"}); err != nil {
+		t.Fatalf("create server: %v", err)
+	}
+	sessionID := owner.SessionID
+	stored, err := svc.PutPluginDataForSession(sessionID, domain.PluginDataRecord{PluginID: "server.scum", ServerInstanceID: "server-1", Collection: "scum_users", Key: "steam-1", Value: map[string]any{"steamId": "steam-1", "futureField": true}})
+	if err != nil || stored.Value["futureField"] != true {
+		t.Fatalf("put plugin data=%+v err=%v", stored, err)
+	}
+	items, err := svc.ListPluginDataForSession(sessionID, domain.PluginDataFilter{PluginID: "server.scum", ServerInstanceID: "server-1", Collection: "scum_users"})
+	if err != nil || len(items) != 1 || items[0].Key != "steam-1" || items[0].Value["steamId"] != "steam-1" {
+		t.Fatalf("list plugin data=%+v err=%v", items, err)
+	}
+	if _, err := svc.ListPluginDataForSession(sessionID, domain.PluginDataFilter{PluginID: "other.plugin", ServerInstanceID: "server-1", Collection: "scum_users"}); err != ErrForbidden {
+		t.Fatalf("expected plugin isolation error, got %v", err)
+	}
+}