From 2b04cda3ff8c4375ca4206f6ae751a6221db0483 Mon Sep 17 00:00:00 2001 From: Jakub Zych Date: Mon, 5 Oct 2026 15:46:52 +0200 Subject: [PATCH] test: T-12.1-24 also marshals a user with last_seen and permissions The removal check for the json tag of users.last_seen showed that the subtest read the user API payloads only, which are built field by field. It now marshals the model as well, so a tag that would expose an admin column fails it. --- phase121_security_test.go | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/phase121_security_test.go b/phase121_security_test.go index 211cb92..3a698bd 100644 --- a/phase121_security_test.go +++ b/phase121_security_test.go @@ -381,6 +381,22 @@ func TestPhase121Threats(t *testing.T) { t.Fatalf("%s payload groups = %v, want an empty list", name, payload["groups"]) } } + // A user model marshalled as it is (another plugin's payload, a log + // line) carries none of the admin columns either. + loaded := env.reload(t, user.ID) + if loaded == nil || loaded.LastSeen == nil || loaded.Permissions["payload."+stamp] != 1 || loaded.CreatedAt.IsZero() { + t.Fatalf("the admin columns were not loaded: %+v", loaded) + } + marshalled, err := json.Marshal(loaded) + if err != nil { + t.Fatal(err) + } + lower := strings.ToLower(string(marshalled)) + for _, key := range []string{"last_seen", "lastseen", "created_at", "createdat", "updated_at", "updatedat", "permissions", "payload." + stamp} { + if strings.Contains(lower, key) { + t.Fatalf("a marshalled user carries %s: %s", key, marshalled) + } + } }) // T-12.1-25: a failing last_seen write never fails authentication.