feat(protocol): add gateway provider session work

2026-07-29 11:10:32 +07:00
parent 4a2772c053
commit 357e5e0dbc
8 changed files with 493 additions and 4 deletions
@@ -112,3 +112,13 @@ func TestSessionAuthorityRejectsProviderRoute(t *testing.T) {
 		t.Fatal("session authority accepted a provider route")
 	}
 }
+
+func TestProviderSessionWorkIsStrictAndSessionBound(t *testing.T) {
+	valid := `{"version":"1","session_id":"session-1","gateway_id":"gateway-1","reconnect_sequence":0,"expires_at":"2099-01-01T00:00:00Z","provider_profile":"apollo","provider_identity":"provider-1","policy_version_id":"policy-1","application_id":"42","management_host":"apollo.test","management_port":47990,"stream_host":"apollo.test","stream_port":47984,"client_certificate_pem":"certificate","client_private_key_pem":"private-key","server_certificate_pem":"server-certificate"}`
+	if _, err := protocol.DecodeProviderSessionWork([]byte(valid)); err != nil {
+		t.Fatalf("valid provider work rejected: %v", err)
+	}
+	if _, err := protocol.DecodeProviderSessionWork([]byte(strings.Replace(valid, `"application_id":"42"`, `"application_id":"42","management_password":"forbidden"`, 1))); err == nil {
+		t.Fatal("provider work accepted a management credential")
+	}
+}