43 lines
1.4 KiB
Go
43 lines
1.4 KiB
Go
package server
|
|
|
|
import (
|
|
"encoding/json"
|
|
"testing"
|
|
)
|
|
|
|
func TestProviderChangesAdminOnly(t *testing.T) {
|
|
ts, _ := setupFull(t, echo{})
|
|
ut := registerUser(t, ts.URL, "alice", "correct-horse-1")
|
|
uh := bearerHdr(ut)
|
|
if r := do(t, "GET", ts.URL+"/api/providers", "", uh); r.StatusCode != 200 {
|
|
t.Fatal("users may list providers", r.StatusCode)
|
|
}
|
|
if r := do(t, "PUT", ts.URL+"/api/providers/active", `{"provider":"dahl"}`, uh); r.StatusCode != 403 {
|
|
t.Fatal("user must not change global provider", r.StatusCode)
|
|
}
|
|
var me map[string]any
|
|
json.NewDecoder(do(t, "GET", ts.URL+"/api/auth/me", "", uh).Body).Decode(&me)
|
|
if me["admin"] != false {
|
|
t.Fatalf("%v", me)
|
|
}
|
|
// own session: chat ok, provider change forbidden
|
|
r := do(t, "POST", ts.URL+"/api/chat", `{"text":"hi"}`, uh)
|
|
if r.StatusCode != 200 {
|
|
t.Fatal("user chat", r.StatusCode)
|
|
}
|
|
var cr struct {
|
|
SessionID string `json:"session_id"`
|
|
}
|
|
json.NewDecoder(r.Body).Decode(&cr)
|
|
if cr.SessionID != "" {
|
|
if r := do(t, "PUT", ts.URL+"/api/sessions/"+cr.SessionID+"/provider", `{"provider":"openai"}`, uh); r.StatusCode != 403 {
|
|
t.Fatal("session provider", r.StatusCode)
|
|
}
|
|
}
|
|
if r := do(t, "POST", ts.URL+"/api/chat", `{"text":"hi","provider":"dahl"}`, uh); r.StatusCode != 403 {
|
|
t.Fatal("chat with provider", r.StatusCode)
|
|
}
|
|
if r := do(t, "PUT", ts.URL+"/api/providers/active", `{"provider":"dahl"}`, authH); r.StatusCode != 200 {
|
|
t.Fatal("admin allowed", r.StatusCode)
|
|
}
|
|
}
|