test(06-14): regression coverage for surf and bouncer gap closure

bouncer/registry_test.go

@@ -245,3 +245,47 @@ func TestRegisterRejectsTypedNilGuard(t *testing.T) {
 type credPtrGuard struct{}
 
 func (*credPtrGuard) Authenticate(*http.Request) (*Principal, error) { return nil, nil }
+
+type nilFuncGuard func(*http.Request) (*Principal, error)
+
+func (f nilFuncGuard) Authenticate(r *http.Request) (*Principal, error) { return f(r) }
+
+type nilMapGuard map[string]string
+
+func (nilMapGuard) Authenticate(*http.Request) (*Principal, error) { return nil, nil }
+
+func TestRegisterRejectsTypedNilPointerFuncMapGuards(t *testing.T) {
+	var (
+		ptr *credPtrGuard
+		fn  nilFuncGuard
+		mp  nilMapGuard
+	)
+	for name, g := range map[string]any{"pointer": ptr, "func": fn, "map": mp} {
+		t.Run(name, func(t *testing.T) {
+			var reg Registry
+			err := reg.Register("golem15.p", "g", g)
+			if err == nil || !strings.Contains(err.Error(), "golem15.p") || !strings.Contains(err.Error(), `"g"`) {
+				t.Fatalf("typed-nil %s guard: err = %v", name, err)
+			}
+			if _, err := reg.Middleware("g"); err == nil {
+				t.Fatal("rejected guard must not be resolvable")
+			}
+		})
+	}
+}
+
+func TestRegisterAcceptsValidGuards(t *testing.T) {
+	var reg Registry
+	if err := reg.Register("p", "ptr", &credPtrGuard{}); err != nil {
+		t.Fatal(err)
+	}
+	if err := reg.Register("p", "fn", nilFuncGuard(func(*http.Request) (*Principal, error) { return nil, nil })); err != nil {
+		t.Fatal(err)
+	}
+	if err := reg.Register("p", "map", nilMapGuard{}); err != nil {
+		t.Fatal(err)
+	}
+	if err := reg.Register("p", "w", writerGuard{}); err != nil {
+		t.Fatal(err)
+	}
+}