test(auth): gate local and OIDC authentication release

2026-08-18 06:02:25 +02:00
parent 7cf7d9db6b
commit 8a3fa5031d
23 changed files with 1711 additions and 168 deletions
@@ -537,6 +537,33 @@ func TestCreateHonorsTheSharedInstallationLifecycleLock(t *testing.T) {
 	}
 }

+func TestCreateTransactionCapabilityRefusesUnlockedOrForeignInstallation(t *testing.T) {
+	fixture := newBackupFixture(t, "local")
+	runner := newBackupRunner(fixture.installation, false)
+	request := CreateRequest{Output: filepath.Join(t.TempDir(), "transaction.zip")}
+
+	if _, err := createWithDependenciesTransaction(context.Background(), nil, fixture.installation, request, testDependencies(t, runner)); !errors.Is(err, lifecycle.ErrTransactionInactive) {
+		t.Fatalf("nil transaction error = %v, want ErrTransactionInactive", err)
+	}
+	if len(runner.calls) != 0 {
+		t.Fatalf("Docker runner was called without a transaction capability: %v", runner.calls)
+	}
+
+	otherRoot := t.TempDir()
+	other := config.Installation{ProjectDirectory: otherRoot, Path: filepath.Join(otherRoot, "thothii-installation.yaml")}
+	transaction, err := lifecycle.AcquireTransaction(other)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = transaction.Release() })
+	if _, err := createWithDependenciesTransaction(context.Background(), transaction, fixture.installation, request, testDependencies(t, runner)); !errors.Is(err, lifecycle.ErrTransactionInstallation) {
+		t.Fatalf("foreign transaction error = %v, want ErrTransactionInstallation", err)
+	}
+	if len(runner.calls) != 0 {
+		t.Fatalf("Docker runner was called with a foreign transaction capability: %v", runner.calls)
+	}
+}
+
 func TestCreateRefusesMutableNonRunningServiceStates(t *testing.T) {
 	for _, state := range []string{"paused", "restarting", "created", "removing"} {
 		t.Run(state, func(t *testing.T) {