registrystack / registrystack/registry-stack

BREG task grants: status client and authority refusal test coverage

Open
#1,033 0 comments 0 reactions 0 assignees View on GitHub
agent-ready area:breg criticality:p3
Dominant language
Rust
Stars
2
Forks
0
Avg merge
2h 55m
Merged PRs (30d)
130

Description

Follow-up to #1029.

Status client (`crates/registry-breg/src/task_grant/tests.rs`), no test today:

- [ ] 5xx, non-JSON content type, malformed body, body over 64 KiB, and request timeout map to Unavailable
- [ ] 401, 403 and 404 map to Refused
- [ ] `active: true` with a different grant id, through the HTTP path (the fake-checker test covers field mismatches only)

Task authority, no test today:

- [ ] `TaskGrantStatusRegistry::check` with an unmapped source issuer (#1039 keys the registry by source issuer alone; land it first)
- [ ] Startup refusal in `activate_task_status` of a task profile with no status mapping
- [ ] Grant bounds narrower than the profile, partial, of the wrong `type`, or on a different collection (only wider bounds are tested)
- [ ] Grant `client` different from the token client, and grant `resource` different from the BREG audience
- [ ] A task profile with mismatched `requesterClients` or `requiredPurposes`
- [ ] A grant token with no `identity`, with an `identity` missing a row claim, and with an `identity` over 32 members or holding non-scalar values
- [ ] A human token without a grant on a task profile (`task_grant_missing`)
- [ ] An agent token with an actor kind but no grant on an unbound profile (`actor_bound_profile_required`)
- [ ] The runtime direct-target guard in `execute_after_attempt`
- [ ] `stage_attachment` with a revoked grant, and with the authority unavailable
- [ ] `registry_grant_exp` in the past while the token `exp` is still in the future, at route level

Contributor guide

Open the contributing guide

Research direction

Start with crates/registry-breg/src/task_grant/tests.rs for the status-client cases, then inspect TaskGrantStatusRegistry::check, activate_task_status, execute_after_attempt, and stage_attachment for the authority and runtime cases. Land #1039 first, then add coverage for every listed refusal, malformed-input, bounds, identity, expiry, and unavailable-authority scenario; done means the full test suite passes.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
backend, testing
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.