admin343/browser
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Remove pre-1.0 audit and protected request scaffolding

Browse Source
This commit is contained in:
npc0-hue
2026-08-20 23:42:02 +08:00
parent 40b35b05c7
commit a7e2e4c6c0
130 changed files with 526 additions and 3767 deletions
Download Patch File Download Diff File Expand all files Collapse all files
platform/api/resource_handlers_test.go
+9 -46
View File
@@ -127,21 +127,6 @@ func TestCoreAPICreateListDetailWorkflows(t *testing.T) {
t.Fatalf("expected explicitly created stream in list, got %+v", streams)
}
auditResponse := postJSON[dto.AuditEventResponse](t, router, "/api/v1/audit-events", dto.AuditEventCreateRequest{
ID: "audit-1",
ActorID: "user-1",
Action: "server.create",
ResourceKind: "server-instance",
ResourceID: "server-1",
Result: domain.AuditResultSuccess,
Summary: "created server instance",
})
if auditResponse.Result != domain.AuditResultSuccess {
t.Fatalf("expected successful audit event, got %+v", auditResponse)
}
getJSON[dto.AuditEventResponse](t, router, "/api/v1/audit-events/audit-1")
auditEvents := getJSON[dto.AuditEventListResponse](t, router, "/api/v1/audit-events?actorId=user-1&resourceKind=server-instance&resourceId=server-1&result=success")
assertListCount(t, auditEvents.Count, 1)
}
func TestMetricsAndConfigReadAPIAreSafeAndRoleScoped(t *testing.T) {
@@ -349,16 +334,6 @@ func TestCoreAPIServerRuntimeDistributionAndJobWorkflows(t *testing.T) {
}
}
audits := getJSONWithAuth[dto.AuditEventListResponse](t, router, "/api/v1/audit-events?resourceId="+serverID, adminSession)
auditActions := map[string]bool{}
for _, audit := range audits.Items {
auditActions[audit.Action] = true
}
for _, action := range []string{"run.generate", "client-manager.build", "dependency.install", "runtime-key.reset"} {
if !auditActions[action] {
t.Fatalf("expected audit action %q in %+v", action, audits.Items)
}
}
}
func TestCoreAPIRunDistributionDenialNamesMissingPluginPermission(t *testing.T) {
@@ -1538,31 +1513,19 @@ func TestGamePluginRegistryResponseDoesNotExposeRawInternals(t *testing.T) {
}
}
func TestProductionOperationsGovernanceRoutesAreDurableAndRedacted(t *testing.T) {
func TestPluginLifecycleAndAIConfigRoutesAreDurableAndRedacted(t *testing.T) {
router := newTestRouter()
adminSession := createAdminSession(t, router)
serverID := createRuntimeAPIFixtures(t, router, adminSession)
createAIProviderFixture(t, router, adminSession)
capacity := getJSONWithAuth[dto.ProductionCapacitySummaryResponse](t, router, "/api/v1/production/capacity", adminSession)
if len(capacity.Endpoints) == 0 {
t.Fatalf("expected persisted capacity endpoints, got %+v", capacity)
lifecycle := postOKJSONWithAuth[dto.PluginLifecycleActionResponse](t, router, "/api/v1/plugin-lifecycles/server.runtime/actions", dto.PluginLifecycleActionRequest{ServerInstanceID: serverID, Operation: "install", TargetVersion: "1.0.0", IdempotencyKey: "api-plugin-install", Confirmed: false}, adminSession)
if lifecycle.Status != "queued" || lifecycle.Job.ID == "" || lifecycle.Installation.ID == "" {
t.Fatalf("expected queued plugin lifecycle job, got %+v", lifecycle)
}
decision := postOKJSONWithAuth[dto.CapacityAdmissionDecisionResponse](t, router, "/api/v1/production/capacity/admission", dto.CapacityAdmissionRequest{ServerInstanceID: serverID, Capability: domain.JobCapabilityRemoteRunRCONCommand, IdempotencyKey: "api-capacity-check"}, adminSession)
if decision.Accepted || decision.AlertID == "" || decision.AuditEventID == "" {
t.Fatalf("expected unavailable capability admission to create durable evidence, got %+v", decision)
}
alerts := getJSONWithAuth[dto.AlertListResponse](t, router, "/api/v1/alerts?state=active", adminSession)
if alerts.Count == 0 {
t.Fatalf("expected durable alert list, got %+v", alerts)
}
acknowledged := postOKJSONWithAuth[dto.AlertResponse](t, router, "/api/v1/alerts/"+decision.AlertID+"/acknowledge", dto.AlertAcknowledgeRequest{Note: "operator review"}, adminSession)
if acknowledged.State != string(domain.AlertStateAcknowledged) {
t.Fatalf("expected acknowledged state, got %+v", acknowledged)
}
resolved := postOKJSONWithAuth[dto.AlertResponse](t, router, "/api/v1/alerts/"+decision.AlertID+"/resolve", dto.AlertResolveRequest{Note: "review complete"}, adminSession)
if resolved.State != string(domain.AlertStateResolved) {
t.Fatalf("expected resolved state, got %+v", resolved)
lifecycles := getJSONWithAuth[dto.PluginLifecycleListResponse](t, router, "/api/v1/plugin-lifecycles?serverInstanceId="+serverID, adminSession)
if lifecycles.Count != 1 || lifecycles.Items[0].JobID != lifecycle.Job.ID {
t.Fatalf("expected persisted plugin lifecycle, got %+v", lifecycles)
}
invocation := postOKJSONWithAuth[dto.AIInvocationResponse](t, router, "/api/v1/ai/invocations", dto.AIInvocationRequest{RequestID: "api-ai-config-diff", ServerInstanceID: serverID, Purpose: "config.suggest", ProviderID: "ai.openai", Prompt: "disable pvp"}, adminSession)
@@ -1580,10 +1543,10 @@ func TestProductionOperationsGovernanceRoutesAreDurableAndRedacted(t *testing.T)
t.Fatalf("expected approved diff with config write job, got %+v", approval)
}
evidence := fmt.Sprintf("%+v %+v %+v %+v %+v %+v", capacity, decision, alerts, resolved, diffs, approval)
evidence := fmt.Sprintf("%+v %+v %+v %+v", lifecycle, lifecycles, diffs, approval)
for _, forbidden := range []string{"/Users/", "/private/", "unix://", "tcp://", "Bearer ", "sk-", "password=", "apiKeyRef", "rawApiKey", "https://api.openai.com"} {
if strings.Contains(evidence, forbidden) {
t.Fatalf("production governance response leaked forbidden fragment %q: %s", forbidden, evidence)
t.Fatalf("production operations response leaked forbidden fragment %q: %s", forbidden, evidence)
}
}
}