Provider-Wechsel nur für Admin (403 für Nutzer); App blendet Provider-Auswahl für Nicht-Admins aus; v0.3.1

internal/server/admin_test.go

@@ -0,0 +1,43 @@
+package server
+
+import (
+	"encoding/json"
+	"testing"
+)
+
+func TestProviderChangesAdminOnly(t *testing.T) {
+	ts, _ := setupFull(t, echo{})
+	ut := registerUser(t, ts.URL, "alice", "correct-horse-1")
+	uh := bearerHdr(ut)
+	if r := do(t, "GET", ts.URL+"/api/providers", "", uh); r.StatusCode != 200 {
+		t.Fatal("users may list providers", r.StatusCode)
+	}
+	if r := do(t, "PUT", ts.URL+"/api/providers/active", `{"provider":"dahl"}`, uh); r.StatusCode != 403 {
+		t.Fatal("user must not change global provider", r.StatusCode)
+	}
+	var me map[string]any
+	json.NewDecoder(do(t, "GET", ts.URL+"/api/auth/me", "", uh).Body).Decode(&me)
+	if me["admin"] != false {
+		t.Fatalf("%v", me)
+	}
+	// own session: chat ok, provider change forbidden
+	r := do(t, "POST", ts.URL+"/api/chat", `{"text":"hi"}`, uh)
+	if r.StatusCode != 200 {
+		t.Fatal("user chat", r.StatusCode)
+	}
+	var cr struct {
+		SessionID string `json:"session_id"`
+	}
+	json.NewDecoder(r.Body).Decode(&cr)
+	if cr.SessionID != "" {
+		if r := do(t, "PUT", ts.URL+"/api/sessions/"+cr.SessionID+"/provider", `{"provider":"openai"}`, uh); r.StatusCode != 403 {
+			t.Fatal("session provider", r.StatusCode)
+		}
+	}
+	if r := do(t, "POST", ts.URL+"/api/chat", `{"text":"hi","provider":"dahl"}`, uh); r.StatusCode != 403 {
+		t.Fatal("chat with provider", r.StatusCode)
+	}
+	if r := do(t, "PUT", ts.URL+"/api/providers/active", `{"provider":"dahl"}`, authH); r.StatusCode != 200 {
+		t.Fatal("admin allowed", r.StatusCode)
+	}
+}