test(gateway): 补齐计划审批分支覆盖

覆盖 approve_plan 的网关校验、运行时端口缺失、多工作区路由错误和 bridge 访问拒绝分支。

Author: wynxing

internal/cli/gateway_runtime_bridge_test.go

@@ -1160,6 +1160,30 @@ func TestGatewayRuntimePortBridgeApprovePlanInvalidAction(t *testing.T) {
 	}
 }
 
+func TestGatewayRuntimePortBridgeApprovePlanAccessDenied(t *testing.T) {
+	runtimeSvc := &runtimePlanApproverStub{
+		runtimeStub: &runtimeStub{eventsCh: make(chan agentruntime.RuntimeEvent, 1)},
+	}
+	bridge, err := newGatewayRuntimePortBridge(context.Background(), runtimeSvc, testSessionStore)
+	if err != nil {
+		t.Fatalf("new bridge: %v", err)
+	}
+	t.Cleanup(func() { _ = bridge.Close() })
+
+	_, err = bridge.ApprovePlan(context.Background(), gateway.ApprovePlanInput{
+		SubjectID: "other-subject",
+		SessionID: "session-1",
+		PlanID:    "plan-1",
+		Revision:  1,
+	})
+	if !errors.Is(err, gateway.ErrRuntimeAccessDenied) {
+		t.Fatalf("approve_plan error = %v, want ErrRuntimeAccessDenied", err)
+	}
+	if runtimeSvc.approveInput.SessionID != "" {
+		t.Fatalf("runtime approve should not be called, input = %#v", runtimeSvc.approveInput)
+	}
+}
+
 func TestGatewayRuntimePortBridgeLoadSessionNotFoundBranches(t *testing.T) {
 	t.Parallel()
 

internal/gateway/bootstrap_test.go

@@ -59,6 +59,10 @@ type bootstrapRuntimeStub struct {
 	checkpointDiffFn     func(ctx context.Context, input CheckpointDiffInput) (CheckpointDiffResult, error)
 }
 
+type runtimePortWithoutPlanApproval struct {
+	RuntimePort
+}
+
 func (s *bootstrapRuntimeStub) Run(ctx context.Context, input RunInput) error {
 	if s != nil && s.runFn != nil {
 		return s.runFn(ctx, input)
@@ -2630,6 +2634,86 @@ func TestHandleCancelListLoadResolveBranches(t *testing.T) {
 		}
 	})
 
+	t.Run("approve plan runtime unavailable", func(t *testing.T) {
+		response := handleApprovePlanFrame(context.Background(), MessageFrame{
+			Type:   FrameTypeRequest,
+			Action: FrameActionApprovePlan,
+			Payload: map[string]any{
+				"session_id": "session-1",
+				"plan_id":    "plan-1",
+				"revision":   1,
+			},
+		}, nil)
+		if response.Type != FrameTypeError {
+			t.Fatalf("response type = %q, want %q", response.Type, FrameTypeError)
+		}
+		if response.Error == nil || response.Error.Code != ErrorCodeInternalError.String() {
+			t.Fatalf("response error = %#v, want %q", response.Error, ErrorCodeInternalError.String())
+		}
+	})
+
+	t.Run("approve plan unsupported runtime port", func(t *testing.T) {
+		response := handleApprovePlanFrame(context.Background(), MessageFrame{
+			Type:   FrameTypeRequest,
+			Action: FrameActionApprovePlan,
+			Payload: map[string]any{
+				"session_id": "session-1",
+				"plan_id":    "plan-1",
+				"revision":   1,
+			},
+		}, runtimePortWithoutPlanApproval{RuntimePort: &bootstrapRuntimeStub{}})
+		if response.Type != FrameTypeError {
+			t.Fatalf("response type = %q, want %q", response.Type, FrameTypeError)
+		}
+		if response.Error == nil || response.Error.Code != ErrorCodeInternalError.String() {
+			t.Fatalf("response error = %#v, want %q", response.Error, ErrorCodeInternalError.String())
+		}
+	})
+
+	t.Run("approve plan fills session from frame", func(t *testing.T) {
+		stub := &bootstrapRuntimeStub{
+			approvePlanFn: func(_ context.Context, input ApprovePlanInput) (ApprovePlanResult, error) {
+				if input.SessionID != "session-from-frame" {
+					t.Fatalf("session_id = %q, want frame session", input.SessionID)
+				}
+				return ApprovePlanResult{PlanID: input.PlanID, Revision: input.Revision, Status: "approved"}, nil
+			},
+		}
+		response := handleApprovePlanFrame(context.Background(), MessageFrame{
+			Type:      FrameTypeRequest,
+			Action:    FrameActionApprovePlan,
+			SessionID: " session-from-frame ",
+			Payload: map[string]any{
+				"plan_id":  "plan-1",
+				"revision": 1,
+			},
+		}, stub)
+		if response.Type != FrameTypeAck {
+			t.Fatalf("response = %#v, want ack", response)
+		}
+		if response.SessionID != "session-from-frame" {
+			t.Fatalf("response session_id = %q, want frame session", response.SessionID)
+		}
+	})
+
+	t.Run("approve plan invalid revision", func(t *testing.T) {
+		response := handleApprovePlanFrame(context.Background(), MessageFrame{
+			Type:   FrameTypeRequest,
+			Action: FrameActionApprovePlan,
+			Payload: map[string]any{
+				"session_id": "session-1",
+				"plan_id":    "plan-1",
+				"revision":   0,
+			},
+		}, &bootstrapRuntimeStub{})
+		if response.Type != FrameTypeError {
+			t.Fatalf("response type = %q, want %q", response.Type, FrameTypeError)
+		}
+		if response.Error == nil || response.Error.Code != ErrorCodeInvalidAction.String() {
+			t.Fatalf("response error = %#v, want %q", response.Error, ErrorCodeInvalidAction.String())
+		}
+	})
+
 	t.Run("approve plan success", func(t *testing.T) {
 		stub := &bootstrapRuntimeStub{
 			approvePlanFn: func(ctx context.Context, input ApprovePlanInput) (ApprovePlanResult, error) {

internal/gateway/multi_workspace_runtime_test.go

@@ -5,6 +5,7 @@ import (
 	"errors"
 	"os"
 	"path/filepath"
+	"strings"
 	"sync"
 	"sync/atomic"
 	"testing"
@@ -548,6 +549,43 @@ func TestMultiWorkspaceRuntime_ApprovePlanRoutesByWorkspace(t *testing.T) {
 	}
 }
 
+func TestMultiWorkspaceRuntime_ApprovePlanErrors(t *testing.T) {
+	t.Run("workspace not found", func(t *testing.T) {
+		idx, alpha, _ := setupIndex(t)
+		builder := newTestBuilder()
+		mw := NewMultiWorkspaceRuntime(idx, alpha.Hash, builder.build)
+		t.Cleanup(func() { _ = mw.Close() })
+
+		_, err := mw.ApprovePlan(ctxWithHash(t, "missing-workspace"), ApprovePlanInput{
+			SessionID: "session-1",
+			PlanID:    "plan-1",
+			Revision:  1,
+		})
+		if !errors.Is(err, ErrRuntimeResourceNotFound) {
+			t.Fatalf("ApprovePlan error = %v, want ErrRuntimeResourceNotFound", err)
+		}
+	})
+
+	t.Run("runtime port does not support plan approval", func(t *testing.T) {
+		idx, alpha, beta := setupIndex(t)
+		builder := newTestBuilder()
+		mw := NewMultiWorkspaceRuntime(idx, alpha.Hash, builder.build)
+		mw.PreloadWorkspaceBundle(beta.Hash, runtimePortWithoutPlanApproval{
+			RuntimePort: newRecordingPort("beta"),
+		}, func() error { return nil })
+		t.Cleanup(func() { _ = mw.Close() })
+
+		_, err := mw.ApprovePlan(ctxWithHash(t, beta.Hash), ApprovePlanInput{
+			SessionID: "session-1",
+			PlanID:    "plan-1",
+			Revision:  1,
+		})
+		if err == nil || !strings.Contains(err.Error(), "plan approval runtime port is unavailable") {
+			t.Fatalf("ApprovePlan error = %v, want unsupported plan approval", err)
+		}
+	})
+}
+
 func TestMultiWorkspaceRuntime_CreatePersistsIndex(t *testing.T) {
 	idx, alpha, _ := setupIndex(t)
 	builder := newTestBuilder()

internal/gateway/validate_test.go

@@ -184,6 +184,76 @@ func TestValidateFrame_BasicRules(t *testing.T) {
 			},
 			wantCode: ErrorCodeInvalidAction.String(),
 		},
+		{
+			name: "approve_plan valid payload",
+			frame: MessageFrame{
+				Type:   FrameTypeRequest,
+				Action: FrameActionApprovePlan,
+				Payload: map[string]any{
+					"session_id": "session-1",
+					"plan_id":    "plan-1",
+					"revision":   1,
+				},
+			},
+			wantNil: true,
+		},
+		{
+			name: "approve_plan missing payload",
+			frame: MessageFrame{
+				Type:   FrameTypeRequest,
+				Action: FrameActionApprovePlan,
+			},
+			wantCode:  ErrorCodeMissingRequiredField.String(),
+			wantField: "payload",
+		},
+		{
+			name: "approve_plan missing session_id",
+			frame: MessageFrame{
+				Type:   FrameTypeRequest,
+				Action: FrameActionApprovePlan,
+				Payload: map[string]any{
+					"plan_id":  "plan-1",
+					"revision": 1,
+				},
+			},
+			wantCode:  ErrorCodeMissingRequiredField.String(),
+			wantField: "payload.session_id",
+		},
+		{
+			name: "approve_plan missing plan_id",
+			frame: MessageFrame{
+				Type:   FrameTypeRequest,
+				Action: FrameActionApprovePlan,
+				Payload: map[string]any{
+					"session_id": "session-1",
+					"revision":   1,
+				},
+			},
+			wantCode:  ErrorCodeMissingRequiredField.String(),
+			wantField: "payload.plan_id",
+		},
+		{
+			name: "approve_plan invalid revision",
+			frame: MessageFrame{
+				Type:   FrameTypeRequest,
+				Action: FrameActionApprovePlan,
+				Payload: map[string]any{
+					"session_id": "session-1",
+					"plan_id":    "plan-1",
+					"revision":   0,
+				},
+			},
+			wantCode: ErrorCodeInvalidAction.String(),
+		},
+		{
+			name: "approve_plan invalid payload shape",
+			frame: MessageFrame{
+				Type:    FrameTypeRequest,
+				Action:  FrameActionApprovePlan,
+				Payload: "bad-payload",
+			},
+			wantCode: ErrorCodeInvalidFrame.String(),
+		},
 		{
 			name: "event frame allows empty action",
 			frame: MessageFrame{