danvics/Pulse
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

test: Add edge case for RequireScope empty scope

Browse source 
Empty scope should allow all requests through without checking token.
Coverage: 84.6% to 100%.
This commit is contained in:
rcourtman 2025-12-01 23:33:11 +00:00
parent 0fa717a78a
commit 890178acb0
1 changed files with 19 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
internal/api/auth_scope_test.go
View file

@ -24,6 +24,25 @@ func TestRequireScopeAllowsSession(t *testing.T) {
} }
} }
func TestRequireScopeEmptyScopeAllowsAll(t *testing.T) {
// Empty scope should allow all requests through without checking token
handler := RequireScope("", func(w http.ResponseWriter, r *http.Request) {
w.WriteHeader(http.StatusOK)
})
req := httptest.NewRequest(http.MethodGet, "/", nil)
// Attach a token with no scopes - should still be allowed through
record := config.APITokenRecord{ID: "token-empty", Scopes: []string{}}
attachAPITokenRecord(req, &record)
rr := httptest.NewRecorder()
handler(rr, req)
if rr.Code != http.StatusOK {
t.Fatalf("expected status 200 when scope is empty, got %d", rr.Code)
}
}
func TestRequireScopeRejectsMissingScope(t *testing.T) { func TestRequireScopeRejectsMissingScope(t *testing.T) {
handler := RequireScope(config.ScopeSettingsWrite, func(w http.ResponseWriter, r *http.Request) { handler := RequireScope(config.ScopeSettingsWrite, func(w http.ResponseWriter, r *http.Request) {
w.WriteHeader(http.StatusOK) w.WriteHeader(http.StatusOK)