1package daemon23import (4 "context"5 "net/http"6 "net/http/httptest"7 "strings"8 "testing"9)1011func TestWebMCPReadsUseBrowserSessionPermissions(t *testing.T) {12 app, tenant := testTenant(t)13 policy := tenant.Policy()14 policy.Features.Grasp = true15 if err := tenant.applyPolicy(context.Background(), policy); err != nil {16 t.Fatal(err)17 }18 login := httptest.NewRequest(http.MethodPost, "http://relay.test/session", strings.NewReader(""))19 signRequest(t, login, "")20 response := httptest.NewRecorder()21 app.ServeHTTP(response, login)22 if response.Code != http.StatusOK || len(response.Result().Cookies()) != 1 {23 t.Fatalf("sign in: status %d", response.Code)24 }25 cookie := response.Result().Cookies()[0]26 for _, tc := range []struct {27 name, method string28 signedIn bool29 status int30 }{31 {"public repositories", "browserepos", false, http.StatusOK},32 {"protected status", "browsestatus", false, http.StatusForbidden},33 {"owner status", "browsestatus", true, http.StatusOK},34 {"mutation rejected", "setpolicy", true, http.StatusBadRequest},35 } {36 t.Run(tc.name, func(t *testing.T) {37 request := httptest.NewRequest(http.MethodGet, "http://relay.test/webmcp/query?method="+tc.method, nil)38 if tc.signedIn {39 request.AddCookie(cookie)40 }41 result := httptest.NewRecorder()42 app.ServeHTTP(result, request)43 if result.Code != tc.status || !strings.HasPrefix(result.Header().Get("Content-Type"), "application/json") {44 t.Fatalf("status %d: %s", result.Code, result.Body.String())45 }46 })47 }48}