25 lines
927 B
Go
25 lines
927 B
Go
package mcp_test
|
|
|
|
import (
|
|
"context"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
|
|
"github.com/mathiasbq/hyperguild/ingestion/internal/mcp"
|
|
"github.com/mathiasbq/hyperguild/ingestion/internal/pipeline"
|
|
)
|
|
|
|
// hyperguild#149: brain_ingest's `path` read any file the pod could read and
|
|
// ingested it into the brain, where brain_query reads it back out.
|
|
func TestBrainIngestRefusesAPathOutsideTheRawInbox(t *testing.T) {
|
|
stub := pipeline.Config{Complete: func(context.Context, string, string) (string, error) {
|
|
return `[{"title":"Leak","type":"concept","content":"x"}]`, nil
|
|
}}
|
|
srv := mcp.NewServer(newBrainRepo(t), &stub, nil, nil)
|
|
resp := authCall(t, srv, "", "brain_ingest", map[string]any{"path": "/etc/hostname"})
|
|
require.NotNil(t, resp["error"], "a path outside brain/raw/ must be refused")
|
|
assert.Contains(t, resp["error"].(map[string]any)["message"], "brain/raw/")
|
|
}
|