coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add bounded resource audiences and enforce browser scope grants
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 36s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06e87-e039-7ed2-b85c-20ad37f8a21b
This commit is contained in:
tegwick 2026-09-05 00:41:17 +02:00
parent b8dda4115a
commit 403904b901
22 changed files with 449 additions and 35 deletions
Download patch file Download diff file Expand all files Collapse all files

21
src/internal/config/config_test.go
View file

@ -385,8 +385,8 @@ func TestServiceClientExampleContracts(t *testing.T) {
if errs := config.ValidateConfig(cfg); len(errs) != 0 {
t.Fatalf("service client examples must validate: %v", errs)
}
if len(cfg.Clients) != 2 {
t.Fatalf("service client examples: want 2, got %d", len(cfg.Clients))
if len(cfg.Clients) != 4 {
t.Fatalf("service client examples: want 4, got %d", len(cfg.Clients))
}
codingAgent := cfg.Clients[0]
@ -479,3 +479,20 @@ func containsErr(errs []string, substring string) bool {
}
return false
}
func TestValidateConfigAudience(t *testing.T) {
for _, audience := range []string{"", "approval-engine", "https://api.example.com"} {
cfg := validConfig("key.pem")
cfg.Clients[0].Audience = audience
if errs := config.ValidateConfig(cfg); len(errs) != 0 {
t.Fatalf("valid audience %q: %v", audience, errs)
}
}
for _, audience := range []string{" ", "approval-engine other", "approval-engine\n"} {
cfg := validConfig("key.pem")
cfg.Clients[0].Audience = audience
if errs := config.ValidateConfig(cfg); len(errs) == 0 {
t.Fatalf("accepted audience %q", audience)
}
}
}