package coderd_test

import (

"context"

"sync/atomic"

"testing"

"github.com/google/uuid"

"github.com/prometheus/client_golang/prometheus"

"github.com/stretchr/testify/require"

"google.golang.org/protobuf/types/known/timestamppb"

agentproto "github.com/coder/coder/v2/agent/proto"

"github.com/coder/coder/v2/coderd/coderdtest"

"github.com/coder/coder/v2/coderd/database"

"github.com/coder/coder/v2/coderd/database/dbauthz"

"github.com/coder/coder/v2/coderd/database/dbfake"

"github.com/coder/coder/v2/coderd/database/dbtestutil"

"github.com/coder/coder/v2/coderd/database/dbtime"

"github.com/coder/coder/v2/coderd/rbac"

"github.com/coder/coder/v2/codersdk/agentsdk"

"github.com/coder/coder/v2/testutil"

)

// TestReportBoundaryLogsAgentRBAC guards against regressions where

// a pre-insert read (e.g. GetBoundarySessionByID) would be silently denied for

// agents and prevent session creation.

func TestReportBoundaryLogsAgentRBAC(t *testing.T) {

t.Parallel()

store, ps := dbtestutil.NewDB(t)

client := coderdtest.New(t, &coderdtest.Options{Database: store, Pubsub: ps})

user := coderdtest.CreateFirstUser(t, client)

r := dbfake.WorkspaceBuild(t, store, database.WorkspaceTable{

OrganizationID: user.OrganizationID,

OwnerID: user.UserID,

}).WithAgent().Do()

ctx := testutil.Context(t, testutil.WaitLong)

// Connect as a real workspace agent.

ac := agentsdk.New(client.URL, agentsdk.WithFixedToken(r.AgentToken))

conn, err := ac.ConnectRPC(ctx)

require.NoError(t, err)

defer conn.Close()

agentClient := agentproto.NewDRPCAgentClient(conn)

sessionID := uuid.New()

_, err = agentClient.ReportBoundaryLogs(ctx, &agentproto.ReportBoundaryLogsRequest{

SessionId: sessionID.String(),

ConfinedProcessName: "claude-code",

Logs: []*agentproto.BoundaryLog{

{

Allowed: true,

Time: timestamppb.New(dbtime.Now()),

SequenceNumber: 0,

Resource: &agentproto.BoundaryLog_HttpRequest_{

HttpRequest: &agentproto.BoundaryLog_HttpRequest{

Method: "GET",

Url: "https://example.com",

MatchedRule: "domain=example.com",

},

},

},

},

})

require.NoError(t, err)

// Verify persistence via the raw store: because ReportBoundaryLogs swallows

// DB errors and returns success regardless, only a direct read proves the

// session and log were actually persisted under agent RBAC.

sess, err := store.GetBoundarySessionByID(ctx, sessionID)

require.NoError(t, err, "session must be persisted")

require.Equal(t, r.Agents[0].ID, sess.WorkspaceAgentID)

logs, err := store.ListBoundaryLogsBySessionID(ctx, database.ListBoundaryLogsBySessionIDParams{

SessionID: sessionID,

})

require.NoError(t, err)

require.Len(t, logs, 1, "log must be persisted")

// Assert that the agent subject cannot read boundary sessions.

memberRole, err := rbac.RoleByName(rbac.RoleMember())

require.NoError(t, err)

agentSubject := rbac.Subject{

ID: r.Workspace.OwnerID.String(),

Roles: rbac.Roles{memberRole},

Scope: rbac.WorkspaceAgentScope(rbac.WorkspaceAgentScopeParams{

WorkspaceID: r.Workspace.ID,

OwnerID: r.Workspace.OwnerID,

TemplateID: r.Workspace.TemplateID,

VersionID: r.Build.TemplateVersionID,

}),

}.WithCachedASTValue()

auth := rbac.NewStrictCachingAuthorizer(prometheus.NewRegistry())

acsPtr := &atomic.Pointer[dbauthz.AccessControlStore]{}

var acs dbauthz.AccessControlStore = dbauthz.AGPLTemplateAccessControlStore{}

acsPtr.Store(&acs)

authzStore := dbauthz.New(store, auth, testutil.Logger(t), acsPtr)

agentCtx := dbauthz.As(context.Background(), agentSubject)

_, err = authzStore.GetBoundarySessionByID(agentCtx, sessionID)

require.True(t, dbauthz.IsNotAuthorizedError(err),

"agents must not be able to read boundary sessions, got: %v", err)

}