From 83311cdf8c3bc3bede71d11db0b6a756e7b838d3 Mon Sep 17 00:00:00 2001 From: rcourtman Date: Wed, 4 Feb 2026 10:48:56 +0000 Subject: [PATCH] test: require settings:write for ai patrol autonomy update --- internal/api/security_regression_test.go | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/internal/api/security_regression_test.go b/internal/api/security_regression_test.go index f85c42f990..acf179f7be 100644 --- a/internal/api/security_regression_test.go +++ b/internal/api/security_regression_test.go @@ -846,6 +846,24 @@ func TestAIPatrolAutonomyRequiresSettingsWriteScope(t *testing.T) { } } +func TestAIPatrolAutonomyUpdateRequiresSettingsWriteScope(t *testing.T) { + rawToken := "ai-patrol-autonomy-update-token-123.12345678" + record := newTokenRecord(t, rawToken, []string{config.ScopeSettingsRead}, nil) + cfg := newTestConfigWithTokens(t, record) + router := NewRouter(cfg, nil, nil, nil, nil, "1.0.0") + + req := httptest.NewRequest(http.MethodPut, "/api/ai/patrol/autonomy", strings.NewReader(`{}`)) + req.Header.Set("X-API-Token", rawToken) + rec := httptest.NewRecorder() + router.Handler().ServeHTTP(rec, req) + if rec.Code != http.StatusForbidden { + t.Fatalf("expected 403 for missing settings:write scope, got %d", rec.Code) + } + if !strings.Contains(rec.Body.String(), config.ScopeSettingsWrite) { + t.Fatalf("expected missing scope response to mention %q, got %q", config.ScopeSettingsWrite, rec.Body.String()) + } +} + func TestAIExecuteReadEndpointsRequireAIExecuteScope(t *testing.T) { rawToken := "ai-exec-read-token-123.12345678" record := newTokenRecord(t, rawToken, []string{config.ScopeAIChat}, nil)