mirror of
https://github.com/hanzoai/compute.git
synced 2026-10-30 14:50:41 +00:00
zeekayandHanzo Dev
3664ba419a
Four routes spelled one resource three ways: POST .../bind-agent to create, GET and DELETE .../agent-binding to read and remove, GET /v1/agent-bindings to list. A caller had to learn that create lived at a different path from its own read, and every projection published three names for one thing. A machine hosts at most one agent, so it is a to-one sub-resource — singular at the member, plural at the collection, the method carrying the verb: PUT /v1/machines/:id/agent bind (idempotent, so PUT) GET /v1/machines/:id/agent read, reconciled; 404 when unbound DELETE /v1/machines/:id/agent unbind; 204, the machine stays GET /v1/machines/agents the caller org's bindings That is the address hanzoai/cloud already publishes to its own callers, so the translation it was keeping in bots.go disappears rather than moving. All four are TYPED ops. Only a typed op is in the registry that OpenAPI, MCP, the CLI and the by-name call plane read; an untyped route is invisible to every one of them. Typing them drops the casibase envelope with it — the answer IS the value and the status IS the outcome — which is a wire break, so it lands with its cloud caller in the same change. An op declares the identity it reads: header:"Authorization" and url:"owner" on the embedded caller, because a typed handler is given a context and no request to reach into. principal() is now the ONE rule turning those two into an org, and resolveComputeOrg calls it instead of restating it. Not landed, and worth saying: the comment claiming a literal must be registered ahead of its :param sibling is folklore. Moving registerAgent below the :id routes leaves /v1/machines/agents still reaching ListAgents — fiber prefers the static segment whatever the order. The test pins the outcome instead. Co-authored-by: Hanzo Dev <[email protected]>
46 lines
1.7 KiB
Go
46 lines
1.7 KiB
Go
// Copyright 2024 Hanzo Industries Inc. All Rights Reserved.
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
|
|
package controllers
|
|
|
|
import "testing"
|
|
|
|
// splitOwnerName is the panic-safety core of the tenant guard: the `:id` path
|
|
// param is attacker-controlled and must never crash the request. util's
|
|
// GetOwnerAndNameFromId panics on != 2 tokens and NoCheck index-panics on a
|
|
// single token; splitOwnerName must fail closed instead.
|
|
func TestSplitOwnerNameNeverPanics(t *testing.T) {
|
|
cases := []struct {
|
|
id string
|
|
wantOwner string
|
|
wantName string
|
|
}{
|
|
{"hanzoai/m1", "hanzoai", "m1"},
|
|
{"m1", "", ""}, // bare name — the common :id shape; must NOT panic
|
|
{"", "", ""}, // empty
|
|
{"a/b/c", "", ""}, // three tokens
|
|
{"/m1", "", ""}, // empty owner
|
|
{"hanzoai/", "", ""}, // empty name
|
|
{"/", "", ""}, // both empty
|
|
{"hanzoai/m1/", "", ""}, // trailing slash → three tokens
|
|
}
|
|
for _, tc := range cases {
|
|
// A panic here fails the test rather than the process.
|
|
o, n := splitOwnerName(tc.id)
|
|
if o != tc.wantOwner || n != tc.wantName {
|
|
t.Errorf("splitOwnerName(%q) = (%q,%q), want (%q,%q)", tc.id, o, n, tc.wantOwner, tc.wantName)
|
|
}
|
|
}
|
|
}
|