Function TestChatAdvisorConfig_MemberCannotWriteButCanRead

coderd/exp_chats_test.go:12811–12850

(t *testing.T)

}

func TestChatAdvisorConfig_MemberCannotWriteButCanRead(t *testing.T) {
	t.Parallel()

	ctx := testutil.Context(t, testutil.WaitLong)
	adminClient := newChatClient(t)
	firstUser := coderdtest.CreateFirstUser(t, adminClient.Client)
	memberClientRaw, _ := coderdtest.CreateAnotherUser(t, adminClient.Client, firstUser.OrganizationID)
	memberClient := codersdk.NewExperimentalClient(memberClientRaw)

	want := codersdk.AdvisorConfig{
		Enabled:         true,
		MaxUsesPerRun:   2,
		MaxOutputTokens: 256,
	}

	err := adminClient.UpdateChatAdvisorConfig(ctx, want)
	require.NoError(t, err)

	resp, err := adminClient.GetChatAdvisorConfig(ctx)
	require.NoError(t, err)
	require.Equal(t, want, resp)

	err = memberClient.UpdateChatAdvisorConfig(ctx, codersdk.UpdateAdvisorConfigRequest{
		Enabled: true,
	})
	requireSDKError(t, err, http.StatusForbidden)

	// Members must still be able to read the advisor config: the dbauthz
	// layer only requires an authenticated actor, and the GET handler has
	// no RBAC check because the admin settings UI and chatd runtime are
	// the planned consumers. This assertion pins that behavior so a
	// future RBAC tightening is a deliberate change.
	memberResp, err := memberClient.GetChatAdvisorConfig(ctx)
	require.NoError(t, err)
	require.Equal(t, want, memberResp)

	resp, err = adminClient.GetChatAdvisorConfig(ctx)
	require.NoError(t, err)
	require.Equal(t, want, resp)
}

func TestChatAdvisorConfig_NegativeMaxUsesPerRunRejected(t *testing.T) {
	t.Parallel()