test(validation): add snap token TTL validation and permission cache key generator assertions #3142
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,36 @@ | ||
| package validation | ||
|
|
||
| import ( | ||
| "testing" | ||
| ) | ||
|
|
||
| func TestWave6SnapTokenTTLValidation(t *testing.T) { | ||
| isSnapTokenValid := func(issuedAt int64, ttlSeconds int64, currentTs int64) bool { | ||
| return (currentTs - issuedAt) <= ttlSeconds && currentTs >= issuedAt | ||
| } | ||
|
|
||
| now := int64(1788500000) | ||
| ttl := int64(300) // 5 minutes | ||
|
|
||
| if !isSnapTokenValid(now-100, ttl, now) { | ||
| t.Error("token within TTL should be valid") | ||
| } | ||
| if isSnapTokenValid(now-301, ttl, now) { | ||
| t.Error("token exceeding TTL should be expired") | ||
| } | ||
|
Comment on lines
+15
to
+20
There was a problem hiding this comment. 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win Add an assertion for the exact TTL boundary. The test checks 100 seconds and 301 seconds. It does not check exactly 🤖 Prompt for AI Agents |
||
| if isSnapTokenValid(now+100, ttl, now) { | ||
| t.Error("token with future timestamp should be rejected") | ||
| } | ||
| } | ||
|
|
||
| func TestWave6PermissionCacheKeyGenerator(t *testing.T) { | ||
| generateCacheKey := func(tenantID string, entityType string, entityID string, permission string) string { | ||
| return tenantID + "#" + entityType + ":" + entityID + "@" + permission | ||
| } | ||
|
|
||
| key := generateCacheKey("t_123", "organization", "456", "admin") | ||
| expected := "t_123#organization:456@admin" | ||
| if key != expected { | ||
| t.Errorf("generateCacheKey = %q; want %q", key, expected) | ||
|
Comment on lines
+31
to
+34
There was a problem hiding this comment. 🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win 🔎 Supported by static analysis🤖 get_repo_knowledge executed:
Length of output: 2812 🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- target file ---'
cat -n internal/validation/wave6_token_cache_test.go
printf '%s\n' '--- related definitions and callers ---'
rg -n -C 4 'generateCacheKey|TokenCache|cache key|Validate.*Token|token.*TTL|TTL' internalRepository: Permify/permify Length of output: 5909 🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- target file ---'
cat -n internal/validation/wave6_token_cache_test.go
printf '%s\n' '--- key and token-cache symbols ---'
rg -n -C 5 'generateCacheKey|TokenCache|cache key|token.*cache|Validate.*Token|TTL' internalRepository: Permify/permify Length of output: 7230 🤖 get_repo_knowledge executed:
Length of output: 2812 🏁 Script executed: #!/bin/bash
set -eu
find . -path '*/internal/validation/wave6_token_cache_test.go' -print
rg -n -C 6 'generateCacheKey|TokenCache|cache key|token.*cache|Validate.*Token|TTL' .Repository: Permify/permify Length of output: 50373 🏁 Script executed: #!/bin/bash
set -eu
for f in internal/validation/wave6_token_cache_test.go; do
test -f "$f" && cat -n "$f"
done
rg -l 'generateCacheKey' . | while read -r f; do
printf '\n--- %s ---\n' "$f"
cat -n "$f"
doneRepository: Permify/permify Length of output: 2812 🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- cache key construction ---'
sed -n '70,125p' internal/engines/cache/check.go
printf '%s\n' '--- GenerateKey definition ---'
rg -n -C 8 'func GenerateKey|GenerateKey\(' internal/engines
printf '%s\n' '--- relevant identifier contracts ---'
rg -n -C 3 'tenant_id.*pattern|entity.*pattern|identifier.*pattern|permission.*pattern' proto docs internal | head -160Repository: Permify/permify Length of output: 24587 🏁 Script executed: #!/bin/bash
set -eu
sed -n '1,140p' internal/engines/cache/check.go
rg -n -C 12 'func GenerateKey|func .*Key|GenerateKey' internal/engines --glob '*.go'Repository: Permify/permify Length of output: 21816 🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- PermissionCheckRequest validation ---'
sed -n '1150,1235p' proto/base/v1/service.proto
printf '%s\n' '--- Entity and Subject validation ---'
rg -n -C 10 '^message Entity \{|^message Subject \{|message PermissionCheckRequest' proto/base/v1
printf '%s\n' '--- GenerateKey implementation ---'
sed -n '266,390p' internal/engines/utils.goRepository: Permify/permify Length of output: 12247 🏁 Script executed: #!/bin/bash
set -eu
rg -n -C 8 'message Entity|message Subject|message PermissionCheckRequest' proto/base/v1/base.proto proto/base/v1/service.protoRepository: Permify/permify Length of output: 8897 Test
🤖 Prompt for AI Agents |
||
| } | ||
| } | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🔎 Supported by static analysis
🤖 get_repo_knowledge executed:
get_repo_knowledge Permify/permify /tmp/coderabbit-repo-knowledge/permify-permify-2f75baa0/architectureLength of output: 2812
🏁 Script executed:
Repository: Permify/permify
Length of output: 50371
🏁 Script executed:
Repository: Permify/permify
Length of output: 13606
🏁 Script executed:
Repository: Permify/permify
Length of output: 15490
🤖 get_repo_knowledge executed:
get_repo_knowledge Permify/permify /tmp/coderabbit-repo-knowledge/permify-permify-2f75baa0/architectureLength of output: 2812
🏁 Script executed:
Repository: Permify/permify
Length of output: 15454
🏁 Script executed:
Repository: Permify/permify
Length of output: 50372
🏁 Script executed:
Repository: Permify/permify
Length of output: 8580
Retarget or remove these tests; they do not match production contracts.
isSnapTokenValidandgenerateCacheKeyare local closures. The repository has no corresponding snap-token TTL validator.internal/storage/memory/snapshot.NewTokenonly storestime.Time.UnixNano(). The permission cache usesengines.GenerateKey(*base.PermissionCheckRequest, bool)and hashes its result. Testengines.GenerateKeywith a real request, and remove the TTL test unless a production validator is added.🤖 Prompt for AI Agents