feat: release manager 1.4.4 agnet persistence

2026-05-26 16:01:49 +08:00
parent 1ebaa1ccce
commit a80c3e0c35
17 changed files with 1980 additions and 66 deletions
@@ -103,6 +103,62 @@ func TestCreateResourceRejectsPlaintextSecretKeys(t *testing.T) {
 	require.Contains(t, w.Body.String(), "plaintext secrets are not allowed")
 }

+func TestDeleteResourceRevokesBindingAndActiveGrants(t *testing.T) {
+	db := setupResourceControllerTestDB(t)
+	resource := model.ResourceBinding{
+		UserId:       7,
+		BindingScope: "project-alpha",
+		Name:         "Project repo",
+		ResourceType: "git",
+		Provider:     "gitee",
+		SecretRef:    "azkv://heicode-kv.vault.azure.net/secrets/project-alpha",
+		Status:       "active",
+	}
+	require.NoError(t, db.Create(&resource).Error)
+	grant := model.ResourceGrant{
+		UserId:          7,
+		BindingScope:    "project-alpha",
+		ResourceId:      resource.Id,
+		Role:            "backend",
+		AgnetId:         "agent-backend-1",
+		PermissionScope: `{"actions":["repo:read"]}`,
+		Status:          "active",
+	}
+	require.NoError(t, db.Create(&grant).Error)
+
+	w := performResourceRequestWithRoute(
+		DeleteResource,
+		7,
+		http.MethodDelete,
+		"/:id",
+		fmt.Sprintf("/%d", resource.Id),
+		"",
+	)
+
+	require.Equal(t, http.StatusOK, w.Code)
+	require.Contains(t, w.Body.String(), `"status":"revoked"`)
+
+	var storedResource model.ResourceBinding
+	require.NoError(t, db.First(&storedResource, resource.Id).Error)
+	require.Equal(t, "revoked", storedResource.Status)
+
+	var storedGrant model.ResourceGrant
+	require.NoError(t, db.First(&storedGrant, grant.Id).Error)
+	require.Equal(t, "revoked", storedGrant.Status)
+	require.NotZero(t, storedGrant.RevokedAt)
+
+	listActive := performResourceRequestWithRoute(
+		ListResources,
+		7,
+		http.MethodGet,
+		"/",
+		"/?status=active",
+		"",
+	)
+	require.Equal(t, http.StatusOK, listActive.Code)
+	require.Contains(t, listActive.Body.String(), `"items":[]`)
+}
+
 func TestCreateResourceGrantAssignsBoundResourceToRoleAgnet(t *testing.T) {
 	db := setupResourceControllerTestDB(t)
 	resource := model.ResourceBinding{
@@ -220,6 +276,59 @@ func TestGenerateResourceGrantManifestIncludesActiveGrantsOnly(t *testing.T) {
 	require.NotContains(t, w.Body.String(), `"allowed_actions":["write"]`)
 }

+func TestDeleteResourceGrantRevokesInsteadOfDeleting(t *testing.T) {
+	db := setupResourceControllerTestDB(t)
+	resource := model.ResourceBinding{
+		UserId:       7,
+		BindingScope: "project-alpha",
+		Name:         "Project repo",
+		ResourceType: "git",
+		Provider:     "gitee",
+		SecretRef:    "azkv://heicode-kv.vault.azure.net/secrets/project-alpha",
+		Status:       "active",
+	}
+	require.NoError(t, db.Create(&resource).Error)
+	grant := model.ResourceGrant{
+		UserId:          7,
+		BindingScope:    "project-alpha",
+		ResourceId:      resource.Id,
+		Role:            "backend",
+		AgnetId:         "agent-backend-1",
+		PermissionScope: `{"actions":["repo:read","repo:write"]}`,
+		Constraints:     `{"paths":["src/**"]}`,
+		Status:          "active",
+	}
+	require.NoError(t, db.Create(&grant).Error)
+
+	w := performResourceRequestWithRoute(
+		DeleteResourceGrant,
+		7,
+		http.MethodDelete,
+		"/:id",
+		fmt.Sprintf("/%d", grant.Id),
+		"",
+	)
+
+	require.Equal(t, http.StatusOK, w.Code)
+	require.Contains(t, w.Body.String(), `"status":"revoked"`)
+
+	var stored model.ResourceGrant
+	require.NoError(t, db.First(&stored, grant.Id).Error)
+	require.Equal(t, "revoked", stored.Status)
+	require.NotZero(t, stored.RevokedAt)
+
+	manifestRecorder := performResourceRequestWithRoute(
+		GenerateResourceGrantManifest,
+		7,
+		http.MethodGet,
+		"/manifest",
+		"/manifest?binding_scope=project-alpha",
+		"",
+	)
+	require.Equal(t, http.StatusOK, manifestRecorder.Code)
+	require.Contains(t, manifestRecorder.Body.String(), `"resource_grants":[]`)
+}
+
 func TestUpsertResourceSecretWritesAzureKeyVaultAndStoresOnlySecretRef(t *testing.T) {
 	db := setupResourceControllerTestDB(t)
 	resource := model.ResourceBinding{