Fix project_protection tests (missing auth header → 403) — unblocks CI image build - #203
Open
vsilent wants to merge 1 commit into
Open
Fix project_protection tests (missing auth header → 403) — unblocks CI image build#203vsilent wants to merge 1 commit into
vsilent wants to merge 1 commit into
Conversation
The 9 project_protection integration tests sent no Authorization header, so every request was anonymous -> casbin denied -> 403 (even POST /project). They never passed, which froze the Docker CICD image build (docker.yml gates on cargo test) and blocked deploying the audit feature to production. Add `Authorization: Bearer USER_A_TOKEN` before .send() on every request (the single-user mock returns test_user_id / group_user for any token, matching the create_test_project owner), mirroring the passing IDOR test. The casbin grant for PATCH /project/:id/protection already exists (20260727130000_casbin_project_protection_rule). Co-Authored-By: Claude Opus 4.8 <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The 9
tests/project_protection.rsintegration tests fail (all403vs200), including basicPOST /project. They send noAuthorizationheader, so every request is anonymous → casbin denies → 403. They never passed.Because
docker.ymlgates the image build oncargo test, this frozetrydirect/stacker:latest— which is why the audit feature (/api/audit/*) can't be deployed to production (it 404s) and why the agent-gateway PR #202 CI is red.Fix
Add
Authorization: Bearer USER_A_TOKENbefore.send()on every request (16 of 17; the IDOR test already had one). The single-user mock returnstest_user_id/group_userfor any token — matching thecreate_test_projectowner and the existing casbin grants (incl.PATCH /project/:id/protectionfrom20260727130000_casbin_project_protection_rule). Mirrors the passing IDOR test.Effect
cargo test --test project_protectionshould pass → unfreezes the Docker CICD image build →:latestrebuilds with the audit routes → production audit deploy unblocked.Compiles clean (
cargo test --test project_protection --no-run). Runtime verification is via CI (needs Postgres + the test harness).🤖 Generated with Claude Code