ms2k/remora
SHA256
Watch
0
Code Releases Activity

Implement authorization-fenced web workflows

Browse source
This commit is contained in:
ms2k 2026-07-18 01:49:00 +09:00
commit 267665bb35
1 changed files with 3853 additions and 156 deletions
Download patch file Download diff file Expand all files Collapse all files

21
crates/remora-api/tests/public_api.rs
View file

@ -290,6 +290,10 @@ async fn public_routes_are_authenticated_replayable_authorized_and_redacted() {
assert_eq!(listed.status(), StatusCode::OK);
let page: Value = listed.json().await.unwrap();
serde_json::from_value::<JobPageDto>(page.clone()).unwrap();
assert_eq!(
page["management_capabilities"]["revoke_execution_grants"],
true
);
let first_page_id = page["items"][0]["id"].as_str().unwrap();
assert!(page["event_cursor"].as_str().unwrap().len() >= 16);
let next_cursor = page["next_cursor"].as_str().unwrap();
@ -616,8 +620,13 @@ async fn public_routes_are_authenticated_replayable_authorized_and_redacted() {
.send()
.await
.unwrap();
assert_eq!(access.status(), StatusCode::TEMPORARY_REDIRECT);
assert_eq!(access.status(), StatusCode::OK);
assert_eq!(access.headers()["cache-control"], "no-store");
assert_eq!(access.headers()["pragma"], "no-cache");
let access: Value = access.json().await.unwrap();
let access_url = reqwest::Url::parse(access["url"].as_str().unwrap()).unwrap();
assert!(matches!(access_url.scheme(), "http" | "https"));
assert!(access["expires_at"].is_string());
let attempts = harness
.request(reqwest::Method::GET, &format!("/jobs/{job_id}/attempts"))
@ -743,6 +752,16 @@ async fn public_routes_are_authenticated_replayable_authorized_and_redacted() {
.await
.unwrap();
assert_eq!(lost_scope.status(), StatusCode::NOT_FOUND);
let unprivileged_page = harness
.request_with_token(reqwest::Method::GET, "/jobs", &unprivileged_token)
.send()
.await
.unwrap();
assert_eq!(unprivileged_page.status(), StatusCode::OK);
assert_eq!(
unprivileged_page.json::<Value>().await.unwrap()["management_capabilities"]["revoke_execution_grants"],
false
);
let hidden_submit_replay = harness
.request_with_token(reqwest::Method::POST, "/jobs", &unprivileged_token)
.header("Idempotency-Key", &submit_key)