xinmi/internal/accesspolicy/context_test.go

package accesspolicy

import (
	"context"
	"testing"
)

func TestManagedResourceRequiresOwnerPublicationOrGrant(t *testing.T) {
	s := &Snapshot{Restricted: true, Permissions: map[string]bool{"knowledge.read": true}, Publications: map[string]bool{"knowledge:k": false}, Grants: map[string]bool{}}
	ctx := WithSnapshot(context.Background(), s)
	if Readable(ctx, "knowledge", "k", false, true) {
		t.Fatal("managed private resource retained native public access")
	}
	if !Readable(ctx, "knowledge", "k", true, false) {
		t.Fatal("owner lost resource access")
	}
	s.Grants["knowledge:k"] = true
	if !Readable(ctx, "knowledge", "k", false, false) {
		t.Fatal("grant did not provide read access")
	}
	delete(s.Grants, "knowledge:k")
	if Readable(ctx, "knowledge", "k", false, true) {
		t.Fatal("revoked grant still readable")
	}
	s.Publications["knowledge:k"] = true
	if !Readable(ctx, "knowledge", "k", false, false) {
		t.Fatal("published resource inaccessible")
	}
	if Allowed(ctx, "knowledge.write") || Allowed(ctx, "content.read") {
		t.Fatal("unassigned feature allowed")
	}
}

func TestSharedIDsSeparateKinds(t *testing.T) {
	ctx := WithSnapshot(context.Background(), &Snapshot{Publications: map[string]bool{"agents:a": true, "agents:b": false, "knowledge:c": true}, Grants: map[string]bool{"agents:a": true}})
	ids := SharedIDs(ctx, "agents")
	if len(ids) != 1 || ids[0] != "a" {
		t.Fatalf("unexpected shared IDs: %v", ids)
	}
}