diff options
Diffstat (limited to 'internal/auth/static_test.go')
| -rw-r--r-- | internal/auth/static_test.go | 31 |
1 files changed, 31 insertions, 0 deletions
diff --git a/internal/auth/static_test.go b/internal/auth/static_test.go index cf54ba6..a037ce1 100644 --- a/internal/auth/static_test.go +++ b/internal/auth/static_test.go @@ -4,6 +4,7 @@ import ( "crypto/sha256" "net/http" "testing" + "time" "aigw/internal/domain" ) @@ -74,3 +75,33 @@ func TestStaticAuthenticatorAcceptsAnthropicHeader(t *testing.T) { t.Fatal(err) } } + +func TestStaticAuthenticatorLoadsRestrictionsAndRejectsExpiredKey(t *testing.T) { + future := time.Now().Add(time.Hour).UTC().Format(time.RFC3339Nano) + authenticator, err := NewStatic(`[{"key":"sk-limited","key_id":"key-1","tenant_id":"tenant-1","project_id":"project-1","allowed_models":["model/allowed"],"monthly_spend_micros":1250000,"expires_at":"`+future+`"}]`, false) + if err != nil { + t.Fatal(err) + } + request, _ := http.NewRequest(http.MethodGet, "http://gateway.test/v1/models", nil) + request.Header.Set("Authorization", "Bearer sk-limited") + principal, err := authenticator.Authenticate(request) + if err != nil { + t.Fatal(err) + } + if principal.MonthlySpendMicros != 1_250_000 { + t.Fatalf("monthly spend limit = %d", principal.MonthlySpendMicros) + } + if _, ok := principal.AllowedModels["model/allowed"]; !ok { + t.Fatalf("allowed model was not loaded: %+v", principal.AllowedModels) + } + + past := time.Now().Add(-time.Minute) + hash := sha256.Sum256([]byte("sk-expired")) + authenticator.ReplaceHashed([]HashedKeyRecord{{Hash: hash, Principal: domain.Principal{ + KeyID: "expired", TenantID: "tenant-1", ProjectID: "project-1", ExpiresAt: &past, + }}}) + request.Header.Set("Authorization", "Bearer sk-expired") + if _, err := authenticator.Authenticate(request); err != ErrUnauthorized { + t.Fatalf("expired key error = %v, want ErrUnauthorized", err) + } +} |