registrystack / registrystack/registry-stack
BREG task grants: status client and authority refusal test coverage
- Dominant language
- Rust
- Stars
- 2
- Forks
- 0
- Avg merge
- 2h 55m
- Merged PRs (30d)
- 130
Description
Follow-up to #1029.
Status client (`crates/registry-breg/src/task_grant/tests.rs`), no test today:
- [ ] 5xx, non-JSON content type, malformed body, body over 64 KiB, and request timeout map to Unavailable
- [ ] 401, 403 and 404 map to Refused
- [ ] `active: true` with a different grant id, through the HTTP path (the fake-checker test covers field mismatches only)
Task authority, no test today:
- [ ] `TaskGrantStatusRegistry::check` with an unmapped source issuer (#1039 keys the registry by source issuer alone; land it first)
- [ ] Startup refusal in `activate_task_status` of a task profile with no status mapping
- [ ] Grant bounds narrower than the profile, partial, of the wrong `type`, or on a different collection (only wider bounds are tested)
- [ ] Grant `client` different from the token client, and grant `resource` different from the BREG audience
- [ ] A task profile with mismatched `requesterClients` or `requiredPurposes`
- [ ] A grant token with no `identity`, with an `identity` missing a row claim, and with an `identity` over 32 members or holding non-scalar values
- [ ] A human token without a grant on a task profile (`task_grant_missing`)
- [ ] An agent token with an actor kind but no grant on an unbound profile (`actor_bound_profile_required`)
- [ ] The runtime direct-target guard in `execute_after_attempt`
- [ ] `stage_attachment` with a revoked grant, and with the authority unavailable
- [ ] `registry_grant_exp` in the past while the token `exp` is still in the future, at route level
Contributor guide
Research direction
Start with crates/registry-breg/src/task_grant/tests.rs for the status-client cases, then inspect TaskGrantStatusRegistry::check, activate_task_status, execute_after_attempt, and stage_attachment for the authority and runtime cases. Land #1039 first, then add coverage for every listed refusal, malformed-input, bounds, identity, expiry, and unavailable-authority scenario; done means the full test suite passes.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- backend, testing
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 52/100