Ilker ManapandClaude Opus 5.5
e493b2f53d
A member of an organization can be its manager (users join --org X --role manager, or the star on the people page). /org shows a manager their organization: usage over time by team, project or person, its teams and projects with limits and 30-day spend, and its members, each once with every place they belong. Read-only; administrators see every organization. Only what was spent in the organization's projects is shown — UsageBucketsIn filters by where a request was spent. Found on the way: - Usage by org, team and project, and the quotas page's spend, joined through api_keys and so dropped every chat-page request, which has no key row. They now read usage.project_id; keys no longer move between projects, so the two agree. - /org was not exempt from API-key auth and answered browsers with a JSON error. A router test now drives the session pages through the middleware; it fails without the fix. Membership queries, org-scoped usage and the reworked joins pass the PostgreSQL store tests on 16. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
32 lines
1.2 KiB
Go
32 lines
1.2 KiB
Go
package router
|
|
|
|
import (
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
// Every page a browser opens with a session must get past the API-key check
|
|
// and reach its own sign-in guard. One missing from the exempt list answers a
|
|
// signed-in person with {"error": "no api key was provided"} — which is what
|
|
// /org did, and which a test that mounts the page without the middleware
|
|
// cannot see.
|
|
func TestSessionPagesAreNotAskedForAnAPIKey(t *testing.T) {
|
|
rt, _ := chatRouter(t, "http://127.0.0.1:1")
|
|
h := rt.Handler()
|
|
// The /admin pages are mounted only with a cluster view, which this
|
|
// router has none of; these are the session pages it does mount.
|
|
for _, path := range []string{"/profile", "/chat", "/org", "/org/org-x"} {
|
|
w := httptest.NewRecorder()
|
|
h.ServeHTTP(w, httptest.NewRequest(http.MethodGet, path, nil))
|
|
if strings.Contains(w.Body.String(), "api key") {
|
|
t.Errorf("%s asked a browser for an API key: %d %s", path, w.Code, w.Body.String())
|
|
}
|
|
if w.Code != http.StatusSeeOther || w.Header().Get("Location") != "/login" {
|
|
t.Errorf("%s without a session: %d to %q, want a redirect to /login",
|
|
path, w.Code, w.Header().Get("Location"))
|
|
}
|
|
}
|
|
}
|