Merged in feature/chatbot-limits (pull request #228)

fix chatbot limits and test

* add tests

scripts/manual_tests/test_two_pool_auth.py

@@ -2,7 +2,7 @@
 """End-to-end manual test for the two-pool service-account auth path.
 
 Validates plans/api.key.support.cognito.two-pool.plan.3.claude.md
-against a localhost queryAPI configured with both pool A
+against a running queryAPI configured with both pool A
 (COGNITO_USER_POOL_ID) and pool B (COGNITO_SVC_USER_POOL_ID), and
 auth enabled.
 
@@ -14,38 +14,42 @@ What this script does (top to bottom):
   Step 3. Decode the AccessToken locally (no signature check) to
           confirm sub, iss, token_use match the values from the
           provisioning log.
-  Step 4. Call GET /admin/users with Authorization: Bearer
-          <access_token>. /admin/users is a super_admin-only
+  Step 4. Call GET /admin/eula with Authorization: Bearer
+          <access_token>. /admin/eula is a super_admin-only
           endpoint, so a 200 proves: (a) queryAPI's multi-issuer
           verifier accepted the pool B token; (b) the service
-          account was successfully registered in Permit with the
-          super_admin role; (c) the env-check dispatched to pool B.
-  Step 5. Call GET /admin/eula with the same token. Second
-          super_admin-only endpoint — covers the "pick at least 2"
-          requirement from the goal statement.
-  Step 6. Print a summary.
+          account has super_admin in Permit; (c) the env-check
+          dispatched to pool B.
+  Step 5. Call GET /admin/eula/agreements with the same token.
+          Second super_admin-only endpoint — covers the "pick at
+          least 2" requirement from the goal statement.
+  Step 6. Print PASS/FAIL summary.
 
 Zero third-party deps — stdlib only, like
 cmd/auth_related/service.accounts/test.scripts/test.service.account.auth.py.
 
 Prerequisites:
-  - queryAPI is running locally on http://localhost:8080.
+  - queryAPI is reachable at --base-url (default http://localhost:8080).
   - queryAPI was started with both COGNITO_USER_POOL_ID and
     COGNITO_SVC_USER_POOL_ID configured.
   - DISABLE_AUTH is NOT set (we want real Cognito JWT validation).
-  - The test service account has been registered in Permit.io and
-    assigned super_admin via:
-        ./cmd/auth_related/service.account.tool/run.tool.sh \
-            register-permit svc-test-admin-1 --roles super_admin
-  - SVC_TEST_PASSWORD is supplied via env (see .env.example). Any
-    .env between this file and the filesystem root is auto-loaded.
-    Everything else (pool ID, app client ID, username, sub, region)
-    is hardcoded below — public identifiers, not secrets — so the
-    script "just works" without further shell setup.
+  - The test service account already has super_admin in the Permit
+    instance backing the target queryAPI. This script does not
+    provision Permit — that is an environment-setup concern.
+  - SVC_TEST_PASSWORD is supplied via env (the repo-root .env.example
+    documents the variable). Any .env between this file and the
+    filesystem root is auto-loaded. Everything else (pool ID, app
+    client ID, username, sub, region) is hardcoded below — public
+    identifiers, not secrets — so the script "just works" without
+    further shell setup.
+  - INSECURE_TLS=1 disables queryAPI TLS cert verification (Cognito
+    is left alone). Needed when queryAPI is fronted by an ALB with
+    a self-signed cert. Off by default.
 
 Usage:
   python3 scripts/manual_tests/test_two_pool_auth.py
   python3 scripts/manual_tests/test_two_pool_auth.py --base-url http://localhost:8080
+  INSECURE_TLS=1 python3 scripts/manual_tests/test_two_pool_auth.py --base-url https://...
 """
 
 from __future__ import annotations
@@ -54,6 +58,7 @@ import argparse
 import base64
 import json
 import os
+import ssl
 import sys
 import urllib.error
 import urllib.request
@@ -122,6 +127,13 @@ for key in ("AWS_ENDPOINT_URL", "AWS_ENDPOINT_URL_COGNITO_IDP"):
 
 PASSWORD = _required("SVC_TEST_PASSWORD")
 
+# INSECURE_TLS=1 disables certificate verification for queryAPI calls
+# only (Cognito is left alone — its cert is real). Needed when queryAPI
+# is fronted by an ALB with a self-signed cert. Off by default so the
+# bypass cannot slip in silently.
+INSECURE_TLS = os.environ.get("INSECURE_TLS", "").strip().lower() in ("1", "true", "yes", "y")
+_TLS_CTX = ssl._create_unverified_context() if INSECURE_TLS else None
+
 ISSUER_URL = f"https://cognito-idp.{AWS_REGION}.amazonaws.com/{USER_POOL_ID}"
 COGNITO_IDP_URL = f"https://cognito-idp.{AWS_REGION}.amazonaws.com/"
 
@@ -180,7 +192,7 @@ def queryapi_get(base_url: str, path: str, access_token: str = "") -> tuple[int,
         headers["Authorization"] = "Bearer " + access_token
     req = urllib.request.Request(url, headers=headers, method="GET")
     try:
-        with urllib.request.urlopen(req, timeout=HTTP_TIMEOUT) as r:
+        with urllib.request.urlopen(req, timeout=HTTP_TIMEOUT, context=_TLS_CTX) as r:
             return r.status, r.read().decode("utf-8", errors="replace")
     except urllib.error.HTTPError as e:
         body = e.read().decode("utf-8", errors="replace")
@@ -193,6 +205,9 @@ def main() -> int:
     args = parser.parse_args()
     base = args.base_url
 
+    if INSECURE_TLS:
+        print("WARNING: INSECURE_TLS=1 — queryAPI TLS verification is DISABLED.")
+
     section("Step 1: queryAPI health")
     code, body = queryapi_get(base, "/health")
     print(f"GET {base}/health -> {code}")

scripts/manual_tests/test_two_pool_auth.sh

@@ -1,51 +1,47 @@
 #!/usr/bin/env bash
 # test_two_pool_auth.sh runs the end-to-end integration test for the
-# two-pool service-account auth path. It assumes the operator has:
-#  - AWS credentials with read access to the test pools
-#    (us-east-2_<pool-a>, us-east-2_Qom1i9qIG)
-#  - PERMIT_IO_API_KEY set in the environment
-#  - Docker running (for `task compose:refresh`)
+# two-pool service-account auth path against a running queryAPI.
 #
-# The script:
-#  1. Registers the pre-existing test service-account in Permit with
-#     super_admin (idempotent — re-running is safe).
-#  2. Reminds the operator to boot queryAPI with both pool A and B
-#     configured (compose:refresh by itself does not know about the
-#     new env vars; the operator must source the right .env).
-#  3. Runs scripts/manual_tests/test_two_pool_auth.py against the
-#     local queryAPI to validate the end-to-end flow.
+# The script assumes the target environment is already provisioned:
+#  - The test service account exists in the Cognito service pool
+#    (us-east-2_Qom1i9qIG).
+#  - It is already registered in the Permit instance backing the
+#    target queryAPI with the super_admin role. This script does NOT
+#    touch Permit — that is an environment-setup concern.
+#  - SVC_TEST_PASSWORD is available (in env or any .env walked up
+#    from this file to the filesystem root).
 #
 # Usage:
-#   PERMIT_IO_API_KEY=permit_key_... \
-#   AWS_PROFILE=aarete \
-#     ./scripts/manual_tests/test_two_pool_auth.sh
+#   ./scripts/manual_tests/test_two_pool_auth.sh
+#   BASE_URL=http://localhost:8080 ./scripts/manual_tests/test_two_pool_auth.sh
+#   INSECURE_TLS=0 ./scripts/manual_tests/test_two_pool_auth.sh   # require valid cert
 
 set -euo pipefail
 
-if [[ -z "${PERMIT_IO_API_KEY:-}" ]]; then
-  echo "ERROR: PERMIT_IO_API_KEY must be set" >&2
-  exit 1
-fi
+# ---------------------------------------------------------------------------
+# Target queryAPI to test against. Uncomment ONE line below.
+# Override at the CLI with: BASE_URL=https://... ./test_two_pool_auth.sh
+# ---------------------------------------------------------------------------
+: "${BASE_URL:=https://queryo-query-q0pz6j2syaox-1001614225.us-east-2.elb.amazonaws.com}"
+# : "${BASE_URL:=http://localhost:8080}"
+# ---------------------------------------------------------------------------
+
+# The default BASE_URL above is an ALB with a self-signed cert. Python's
+# urllib rejects that by default, so opt into the bypass here. Unset or
+# set to 0 if you point BASE_URL at a host with a real CA-issued cert.
+: "${INSECURE_TLS:=1}"
+export INSECURE_TLS
 
 REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 
-echo "Step 1/3: registering svc-test-admin-1 in Permit with super_admin..."
-pushd "$REPO_ROOT/cmd/auth_related/service.account.tool" >/dev/null
-COGNITO_REGION="us-east-2" \
-COGNITO_SVC_USER_POOL_ID="us-east-2_Qom1i9qIG" \
-COGNITO_SVC_APP_CLIENT_ID="6r7chkvjotgs2bsfbd5ibaaft7" \
-  go run ./... register-permit svc-test-admin-1 --roles super_admin
-popd >/dev/null
-
-echo
-echo "Step 2/3: confirm queryAPI is running locally with pool B enabled."
+echo "Step 1/2: confirm queryAPI is running with pool B enabled."
 echo "  - COGNITO_USER_POOL_ID     should be set (existing pool A)"
 echo "  - COGNITO_SVC_USER_POOL_ID should be us-east-2_Qom1i9qIG (pool B)"
 echo "  - DISABLE_AUTH             must be unset (we are testing real auth)"
-echo "  - queryAPI must be reachable at http://localhost:8080"
+echo "  - queryAPI must be reachable at ${BASE_URL}"
 echo
 read -rp "Press enter when queryAPI is up and configured..."
 
 echo
-echo "Step 3/3: running test_two_pool_auth.py against localhost..."
-python3 "$REPO_ROOT/scripts/manual_tests/test_two_pool_auth.py"
+echo "Step 2/2: running test_two_pool_auth.py against ${BASE_URL}..."
+python3 "$REPO_ROOT/scripts/manual_tests/test_two_pool_auth.py" --base-url "${BASE_URL}"