|
| 1 | +package cmd |
| 2 | + |
| 3 | +import ( |
| 4 | + "encoding/json" |
| 5 | + "slices" |
| 6 | + "strings" |
| 7 | + "testing" |
| 8 | +) |
| 9 | + |
| 10 | +func TestM365ReadOnlyPilotCommandsAreExposed(t *testing.T) { |
| 11 | + tests := []struct { |
| 12 | + name string |
| 13 | + args []string |
| 14 | + want string |
| 15 | + }{ |
| 16 | + { |
| 17 | + name: "outlook search", |
| 18 | + args: []string{"--json", "--read-only", "m365", "outlook", "search", "--query", "from:felipe"}, |
| 19 | + want: "m365.outlook.search", |
| 20 | + }, |
| 21 | + { |
| 22 | + name: "outlook message get", |
| 23 | + args: []string{"--json", "--read-only", "m365", "outlook", "message", "get", "AAMk-message-id"}, |
| 24 | + want: "m365.outlook.message.get", |
| 25 | + }, |
| 26 | + { |
| 27 | + name: "calendar events", |
| 28 | + args: []string{"--json", "--read-only", "m365", "calendar", "events", "--from", "2026-05-31T00:00:00Z", "--to", "2026-06-01T00:00:00Z"}, |
| 29 | + want: "m365.calendar.events", |
| 30 | + }, |
| 31 | + { |
| 32 | + name: "calendar freebusy", |
| 33 | + args: []string{"--json", "--read-only", "m365", "calendar", "freebusy", "--users", "bernardo@example.com,felipe@example.com"}, |
| 34 | + want: "m365.calendar.freebusy", |
| 35 | + }, |
| 36 | + { |
| 37 | + name: "calendar freebusy without users", |
| 38 | + args: []string{"--json", "--read-only", "m365", "calendar", "freebusy"}, |
| 39 | + want: "m365.calendar.freebusy", |
| 40 | + }, |
| 41 | + } |
| 42 | + |
| 43 | + for _, tt := range tests { |
| 44 | + t.Run(tt.name, func(t *testing.T) { |
| 45 | + out := captureStdout(t, func() { |
| 46 | + _ = captureStderr(t, func() { |
| 47 | + if err := Execute(tt.args); err != nil { |
| 48 | + t.Fatalf("Execute(%v): %v", tt.args, err) |
| 49 | + } |
| 50 | + }) |
| 51 | + }) |
| 52 | + |
| 53 | + var got map[string]any |
| 54 | + if err := json.Unmarshal([]byte(out), &got); err != nil { |
| 55 | + t.Fatalf("json output: %v\n%s", err, out) |
| 56 | + } |
| 57 | + if got["operation"] != tt.want { |
| 58 | + t.Fatalf("operation = %v, want %s; output=%s", got["operation"], tt.want, out) |
| 59 | + } |
| 60 | + if got["provider"] != "microsoft_graph" { |
| 61 | + t.Fatalf("provider = %v, want microsoft_graph; output=%s", got["provider"], out) |
| 62 | + } |
| 63 | + if got["mode"] != "read_only_pilot" { |
| 64 | + t.Fatalf("mode = %v, want read_only_pilot; output=%s", got["mode"], out) |
| 65 | + } |
| 66 | + if tt.name == "calendar freebusy without users" { |
| 67 | + request, ok := got["request"].(map[string]any) |
| 68 | + if !ok { |
| 69 | + t.Fatalf("request has type %T, want object; output=%s", got["request"], out) |
| 70 | + } |
| 71 | + users, ok := request["users"].([]any) |
| 72 | + if !ok { |
| 73 | + t.Fatalf("request.users has type %T, want empty array; output=%s", request["users"], out) |
| 74 | + } |
| 75 | + if len(users) != 0 { |
| 76 | + t.Fatalf("request.users = %#v, want empty array", users) |
| 77 | + } |
| 78 | + } |
| 79 | + }) |
| 80 | + } |
| 81 | +} |
| 82 | + |
| 83 | +func TestM365PilotCommandsRequireExplicitReadOnlyFlag(t *testing.T) { |
| 84 | + _ = captureStderr(t, func() { |
| 85 | + err := Execute([]string{"--json", "m365", "outlook", "search", "--query", "from:felipe"}) |
| 86 | + if err == nil { |
| 87 | + t.Fatal("expected m365 pilot command without --read-only to fail closed") |
| 88 | + } |
| 89 | + if !strings.Contains(err.Error(), "--read-only") { |
| 90 | + t.Fatalf("expected --read-only error, got: %v", err) |
| 91 | + } |
| 92 | + }) |
| 93 | +} |
| 94 | + |
| 95 | +func TestAuthServicesJSONIncludesM365PilotReadOnlyScopes(t *testing.T) { |
| 96 | + out := captureStdout(t, func() { |
| 97 | + _ = captureStderr(t, func() { |
| 98 | + if err := Execute([]string{"--json", "auth", "services"}); err != nil { |
| 99 | + t.Fatalf("auth services: %v", err) |
| 100 | + } |
| 101 | + }) |
| 102 | + }) |
| 103 | + |
| 104 | + var payload struct { |
| 105 | + Services []struct { |
| 106 | + Service string `json:"service"` |
| 107 | + Scopes []string `json:"scopes"` |
| 108 | + } `json:"services"` |
| 109 | + } |
| 110 | + if err := json.Unmarshal([]byte(out), &payload); err != nil { |
| 111 | + t.Fatalf("json output: %v\n%s", err, out) |
| 112 | + } |
| 113 | + |
| 114 | + var scopes []string |
| 115 | + for _, service := range payload.Services { |
| 116 | + if service.Service == "m365" { |
| 117 | + scopes = service.Scopes |
| 118 | + break |
| 119 | + } |
| 120 | + } |
| 121 | + if len(scopes) == 0 { |
| 122 | + t.Fatalf("auth services missing m365 service: %s", out) |
| 123 | + } |
| 124 | + for _, scope := range []string{"User.Read", "Mail.Read", "Calendars.Read"} { |
| 125 | + if !slices.Contains(scopes, scope) { |
| 126 | + t.Fatalf("m365 auth services missing %s: %#v", scope, scopes) |
| 127 | + } |
| 128 | + } |
| 129 | + for _, forbidden := range []string{"Mail.Send", "Calendars.ReadWrite"} { |
| 130 | + if slices.Contains(scopes, forbidden) { |
| 131 | + t.Fatalf("m365 auth services exposed write scope %s: %#v", forbidden, scopes) |
| 132 | + } |
| 133 | + } |
| 134 | +} |
0 commit comments