From 8e991c5acdacf9e6687bad18af880f32b809b21c Mon Sep 17 00:00:00 2001
From: Jess Sullivan <Jess@sulliwood.org>
Date: Mon, 2 Mar 2026 14:24:10 -0500
Subject: [PATCH] test:

---
 gateway/identity_test.go | 131 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 131 insertions(+)
 create mode 100644 gateway/identity_test.go

diff --git a/gateway/identity_test.go b/gateway/identity_test.go
new file mode 100644
index 0000000000..50af3038c5
--- /dev/null
+++ b/gateway/identity_test.go
@@ -0,0 +1,131 @@
+package main
+
+import (
+	"testing"
+)
+
+func TestParseCapabilities(t *testing.T) {
+	tests := []struct {
+		name     string
+		header   string
+		expected []string
+	}{
+		{
+			name:     "empty string",
+			header:   "",
+			expected: []string{},
+		},
+		{
+			name:     "single capability",
+			header:   "read",
+			expected: []string{"read"},
+		},
+		{
+			name:     "multiple capabilities",
+			header:   "read,write,admin",
+			expected: []string{"read", "write", "admin"},
+		},
+		{
+			name:     "capabilities with spaces",
+			header:   " read , write , admin ",
+			expected: []string{"read", "write", "admin"},
+		},
+		{
+			name:     "trailing comma",
+			header:   "read,write,",
+			expected: []string{"read", "write"},
+		},
+		{
+			name:     "extra commas and spaces",
+			header:   " read , , write , ,admin,",
+			expected: []string{"read", "write", "admin"},
+		},
+		{
+			name:     "only commas and spaces",
+			header:   " , , , ",
+			expected: []string{},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := parseCapabilities(tt.header)
+			if len(result) != len(tt.expected) {
+				t.Errorf("parseCapabilities(%q) returned %d capabilities, want %d", tt.header, len(result), len(tt.expected))
+				return
+			}
+			for i, cap := range result {
+				if cap != tt.expected[i] {
+					t.Errorf("parseCapabilities(%q)[%d] = %q, want %q", tt.header, i, cap, tt.expected[i])
+				}
+			}
+		})
+	}
+}
+
+func TestCallerIdentityHasCapability(t *testing.T) {
+	tests := []struct {
+		name         string
+		identity     CallerIdentity
+		capability   string
+		expected     bool
+	}{
+		{
+			name: "has capability",
+			identity: CallerIdentity{
+				Capabilities: []string{"read", "write", "admin"},
+			},
+			capability: "write",
+			expected:   true,
+		},
+		{
+			name: "missing capability",
+			identity: CallerIdentity{
+				Capabilities: []string{"read", "write"},
+			},
+			capability: "admin",
+			expected:   false,
+		},
+		{
+			name: "empty capabilities",
+			identity: CallerIdentity{
+				Capabilities: []string{},
+			},
+			capability: "read",
+			expected:   false,
+		},
+		{
+			name: "nil capabilities",
+			identity: CallerIdentity{
+				Capabilities: nil,
+			},
+			capability: "read",
+			expected:   false,
+		},
+		{
+			name: "check empty capability name",
+			identity: CallerIdentity{
+				Capabilities: []string{"read", "write"},
+			},
+			capability: "",
+			expected:   false,
+		},
+		{
+			name: "exact match required",
+			identity: CallerIdentity{
+				Capabilities: []string{"readonly"},
+			},
+			capability: "read",
+			expected:   false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := tt.identity.HasCapability(tt.capability)
+			if result != tt.expected {
+				t.Errorf("HasCapability(%q) = %v, want %v", tt.capability, result, tt.expected)
+			}
+		})
+	}
+}