ACP / MCP 完善

internal/acp/permission_service_internal_test.go

@@ -0,0 +1,28 @@
+package acp
+
+import "testing"
+
+// TestAllowlistHit 覆盖白名单匹配的边界：空 toolName 一律不放行（含 "*"），
+// 白名单中的空串条目不误匹配。
+func TestAllowlistHit(t *testing.T) {
+	cases := []struct {
+		name      string
+		allowlist []string
+		toolName  string
+		want      bool
+	}{
+		{"精确命中", []string{"safe.tool"}, "safe.tool", true},
+		{"未命中", []string{"safe.tool"}, "other.tool", false},
+		{"通配符放行可识别工具", []string{"*"}, "any.tool", true},
+		{"通配符不放行空名", []string{"*"}, "", false},
+		{"空名不匹配空串条目", []string{""}, "", false},
+		{"空白名单", nil, "any.tool", false},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			if got := allowlistHit(c.allowlist, c.toolName); got != c.want {
+				t.Fatalf("allowlistHit(%v, %q) = %v, want %v", c.allowlist, c.toolName, got, c.want)
+			}
+		})
+	}
+}