fixup: Alloc endpoint tests

command/agent/alloc_endpoint_test.go

@@ -261,12 +261,11 @@ func TestHTTP_AllocQuery_Payload(t *testing.T) {
 	})
 }
 
-// TODO(dani): Add ACL Test
-
 func TestHTTP_AllocRestart(t *testing.T) {
 	t.Parallel()
 	require := require.New(t)
 
+	// Validates that all methods of forwarding the request are processed correctly
 	httpTest(t, nil, func(s *TestAgent) {
 		// Local node, local resp
 		{
@@ -330,6 +329,71 @@ func TestHTTP_AllocRestart(t *testing.T) {
 	})
 }
 
+func TestHTTP_AllocRestart_ACL(t *testing.T) {
+	t.Parallel()
+	require := require.New(t)
+
+	httpACLTest(t, nil, func(s *TestAgent) {
+		state := s.Agent.server.State()
+
+		// If there's no token, we expect the request to fail.
+		{
+			buf := encodeReq(map[string]string{})
+			req, err := http.NewRequest("GET", fmt.Sprintf("/v1/client/allocation/%s/restart", uuid.Generate()), buf)
+			require.NoError(err)
+
+			respW := httptest.NewRecorder()
+			_, err = s.Server.ClientAllocRequest(respW, req)
+			require.NotNil(err)
+			require.Equal(err.Error(), structs.ErrPermissionDenied.Error())
+		}
+
+		// Try request with an invalid token and expect it to fail
+		{
+			buf := encodeReq(map[string]string{})
+			req, err := http.NewRequest("GET", fmt.Sprintf("/v1/client/allocation/%s/restart", uuid.Generate()), buf)
+			require.NoError(err)
+
+			respW := httptest.NewRecorder()
+			token := mock.CreatePolicyAndToken(t, state, 1005, "invalid", mock.NodePolicy(acl.PolicyWrite))
+			setToken(req, token)
+			_, err = s.Server.ClientAllocRequest(respW, req)
+			require.NotNil(err)
+			require.Equal(err.Error(), structs.ErrPermissionDenied.Error())
+		}
+
+		// Try request with a valid token
+		// Still returns an error because the alloc does not exist
+		{
+			buf := encodeReq(map[string]string{})
+			req, err := http.NewRequest("GET", fmt.Sprintf("/v1/client/allocation/%s/restart", uuid.Generate()), buf)
+			require.NoError(err)
+
+			respW := httptest.NewRecorder()
+			policy := mock.NamespacePolicy(structs.DefaultNamespace, "", []string{acl.NamespaceCapabilityAllocLifecycle})
+			token := mock.CreatePolicyAndToken(t, state, 1007, "valid", policy)
+			setToken(req, token)
+			_, err = s.Server.ClientAllocRequest(respW, req)
+			require.NotNil(err)
+			require.True(structs.IsErrUnknownAllocation(err))
+		}
+
+		// Try request with a management token
+		// Still returns an error because the alloc does not exist
+		{
+			buf := encodeReq(map[string]string{})
+			req, err := http.NewRequest("GET", fmt.Sprintf("/v1/client/allocation/%s/restart", uuid.Generate()), buf)
+			require.NoError(err)
+
+			respW := httptest.NewRecorder()
+			setToken(req, s.RootToken)
+			_, err = s.Server.ClientAllocRequest(respW, req)
+			require.NotNil(err)
+			require.True(structs.IsErrUnknownAllocation(err))
+		}
+	})
+}
+
 func TestHTTP_AllocStats(t *testing.T) {
 	t.Parallel()
 	require := require.New(t)