mirror of
https://github.com/zap-proto/zip.git
synced 2026-10-19 15:38:57 +00:00
zeekayandHanzo Dev
b2159fbf09
Three survivors, and one of them was a live cross-tenant bug.
ActingAs derives a caller acting on another org's behalf. It does NOT weaken the
laundering guard: it cannot invent a caller, only re-point one already
authenticated, and with nothing authenticated it refuses — so stating an
identity still cannot override an authenticated one. What it adds is that the
derived caller carries both facts. Org is whose data the call is for; ActedBy is
who chose to touch it; the original actor survives a chain of hops; and both
travel in the forwarded identity set, so the impersonation is visible at the
next hop instead of the trail ending at this process. That is the wrong-ledger
bug: the admin's own org was being forwarded.
It deliberately does not authorise. Whether a principal may act for an org is a
tenancy policy, and policy belongs in an Authorizer — this supplies the
vocabulary and the audit trail, nothing more.
WithStatus now accepts a declared non-2xx, for an op whose failure carries a
typed body the error envelope cannot express. The doctrine survives where it was
load-bearing: an error return still renders {status, code, error}, and that is
still the way to answer a failure with nothing extra to say. The test that
pinned the old rule is rewritten to state the new one rather than deleted.
Gap 9 needed no change: json.RawMessage as the input already round-trips a body
verbatim, unnamed fields and all. Measured, then pinned — a passthrough is
expressible as a typed op with an opaque declared body, so the RequestOf refusal
still stands.
Co-authored-by: Hanzo Dev <[email protected]>
83 lines
2.5 KiB
Go
83 lines
2.5 KiB
Go
package zip
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
type lookupIn struct {
|
|
ID string `json:"id"`
|
|
}
|
|
type lookupOut struct {
|
|
Found bool `json:"found"`
|
|
Suggestion []string `json:"suggestion,omitempty"`
|
|
}
|
|
|
|
// A 404 carrying what was searched for — a typed body the error envelope
|
|
// cannot express.
|
|
func (l *lookupOut) StatusCode() int {
|
|
if l.Found {
|
|
return 200
|
|
}
|
|
return 404
|
|
}
|
|
|
|
// Gap 8: an op declares a non-2xx and answers it with its own typed body.
|
|
func TestNonSuccess_TypedBodyOnADeclaredNon2xx(t *testing.T) {
|
|
app := quiet("svc")
|
|
Post(app, "/v1/lookup", func(_ context.Context, in *lookupIn) (*lookupOut, error) {
|
|
if in.ID == "known" {
|
|
return &lookupOut{Found: true}, nil
|
|
}
|
|
return &lookupOut{Suggestion: []string{"known"}}, nil
|
|
}, WithOperationID("lookup"), WithStatus(200, 404))
|
|
|
|
if code, body := postJSON(t, app, "/v1/lookup", `{"id":"known"}`); code != 200 || !strings.Contains(body, `"found":true`) {
|
|
t.Errorf("found case: %d %s", code, body)
|
|
}
|
|
code, body := postJSON(t, app, "/v1/lookup", `{"id":"missing"}`)
|
|
if code != 404 {
|
|
t.Errorf("missing case answered %d, want 404", code)
|
|
}
|
|
// The typed body reached the wire, not the error envelope.
|
|
if !strings.Contains(body, `"suggestion"`) {
|
|
t.Errorf("the 404 did not carry the op's own body: %s", body)
|
|
}
|
|
if strings.Contains(body, `"error"`) {
|
|
t.Errorf("the 404 rendered the error envelope instead of the typed body: %s", body)
|
|
}
|
|
|
|
// And the document describes it under 404, with the Out schema.
|
|
spec := app.OpenAPISpec()
|
|
post := spec["paths"].(map[string]map[string]any)["/v1/lookup"]["post"].(map[string]any)
|
|
raw, _ := json.Marshal(post["responses"])
|
|
for _, want := range []string{`"200"`, `"404"`} {
|
|
if !strings.Contains(string(raw), want) {
|
|
t.Errorf("document omits %s: %s", want, raw)
|
|
}
|
|
}
|
|
}
|
|
|
|
// Gap 9: a verbatim passthrough is already expressible — json.RawMessage as the
|
|
// input keeps every unnamed field, so forwarding bytes to an upstream that owns
|
|
// the contract needs no raw-request accessor.
|
|
type echoOut struct {
|
|
Echo json.RawMessage `json:"echo"`
|
|
}
|
|
|
|
func TestVerbatimBody_NeedsNoRawRequestAccessor(t *testing.T) {
|
|
app := quiet("svc")
|
|
Post(app, "/v1/pass", func(_ context.Context, in *json.RawMessage) (*echoOut, error) {
|
|
return &echoOut{Echo: *in}, nil
|
|
}, WithOperationID("pass"))
|
|
|
|
_, body := postJSON(t, app, "/v1/pass", `{"known":1,"unnamed":{"deep":true},"extra":[1,2]}`)
|
|
for _, want := range []string{"unnamed", "deep", "extra"} {
|
|
if !strings.Contains(body, want) {
|
|
t.Errorf("re-marshalling dropped %q: %s", want, body)
|
|
}
|
|
}
|
|
}
|