TestChatOwnerOnlyWriteHandlers verifies that only the chat owner can call handlers that trigger chat processing. Org admins pass the RBAC ActionUpdate check (org-level permission) but must still be blocked because processing forwards the *owner's* credentials to external services.
(t *testing.T)
| 14880 | // because processing forwards the *owner's* credentials to external |
| 14881 | // services. |
| 14882 | func TestChatOwnerOnlyWriteHandlers(t *testing.T) { |
| 14883 | t.Parallel() |
| 14884 | |
| 14885 | // setupOrgAdminAndOwnerChat creates an org-admin user and a chat |
| 14886 | // owned by the first (site-admin) user. Returns both clients, |
| 14887 | // the chat, and the DB handle. |
| 14888 | setupOrgAdminAndOwnerChat := func(t *testing.T) ( |
| 14889 | ownerClient *codersdk.ExperimentalClient, |
| 14890 | adminClient *codersdk.ExperimentalClient, |
| 14891 | chat codersdk.Chat, |
| 14892 | db database.Store, |
| 14893 | ) { |
| 14894 | t.Helper() |
| 14895 | |
| 14896 | ctx := testutil.Context(t, testutil.WaitLong) |
| 14897 | ownerClient, db = newChatClientWithDatabase(t) |
| 14898 | firstUser := coderdtest.CreateFirstUser(t, ownerClient.Client) |
| 14899 | _ = createChatModelConfig(t, ownerClient) |
| 14900 | |
| 14901 | // Create a chat owned by the first user. |
| 14902 | var err error |
| 14903 | chat, err = ownerClient.CreateChat(ctx, codersdk.CreateChatRequest{ |
| 14904 | OrganizationID: firstUser.OrganizationID, |
| 14905 | Content: []codersdk.ChatInputPart{{ |
| 14906 | Type: codersdk.ChatInputPartTypeText, |
| 14907 | Text: "owner chat for authz test", |
| 14908 | }}, |
| 14909 | }) |
| 14910 | require.NoError(t, err) |
| 14911 | |
| 14912 | // Create an org admin in the same org. |
| 14913 | orgAdminRaw, _ := coderdtest.CreateAnotherUser( |
| 14914 | t, |
| 14915 | ownerClient.Client, |
| 14916 | firstUser.OrganizationID, |
| 14917 | rbac.ScopedRoleOrgAdmin(firstUser.OrganizationID), |
| 14918 | rbac.ScopedRoleAgentsAccess(firstUser.OrganizationID), |
| 14919 | ) |
| 14920 | adminClient = codersdk.NewExperimentalClient(orgAdminRaw) |
| 14921 | return ownerClient, adminClient, chat, db |
| 14922 | } |
| 14923 | |
| 14924 | t.Run("PostChatMessages", func(t *testing.T) { |
| 14925 | t.Parallel() |
| 14926 | |
| 14927 | ctx := testutil.Context(t, testutil.WaitLong) |
| 14928 | _, adminClient, chat, _ := setupOrgAdminAndOwnerChat(t) |
| 14929 | |
| 14930 | _, err := adminClient.CreateChatMessage(ctx, chat.ID, codersdk.CreateChatMessageRequest{ |
| 14931 | Content: []codersdk.ChatInputPart{{ |
| 14932 | Type: codersdk.ChatInputPartTypeText, |
| 14933 | Text: "org admin should not be able to send this", |
| 14934 | }}, |
| 14935 | }) |
| 14936 | sdkErr := requireSDKError(t, err, http.StatusForbidden) |
| 14937 | require.Contains(t, sdkErr.Message, "Only the chat owner") |
| 14938 | }) |
| 14939 |
nothing calls this directly
no test coverage detected