From 4c280432e464e876bd61b0937bc5cc2837adc2d1 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Wed, 7 Oct 2026 13:07:22 +0000
Subject: [PATCH] Add test for std.http.listen capability denial

Co-authored-by: Tcode-Motion <188012755+Tcode-Motion@users.noreply.github.com>
---
 stdlib/src/http.rs | 37 +++++++++++++++++++++++++++++++++++++
 1 file changed, 37 insertions(+)

diff --git a/stdlib/src/http.rs b/stdlib/src/http.rs
index 203c2a4b..c55a727c 100644
--- a/stdlib/src/http.rs
+++ b/stdlib/src/http.rs
@@ -186,3 +186,40 @@ impl StdlibRegistry {
         );
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use techscript_runtime::context::{RuntimeConfig, RuntimeContext};
+    use techscript_runtime::value::RuntimeValue;
+
+    #[test]
+    fn test_http_listen_capability_denied() {
+        let mut registry = StdlibRegistry::new();
+        registry.register_http();
+
+        let mut config = RuntimeConfig::default();
+        config.capabilities.remove(&Capability::Network); // Ensure network is disabled
+        let mut ctx = RuntimeContext::new(config);
+
+        let module = registry.get_module("std.http").unwrap();
+        let listen_func = module.exports.get("listen").unwrap();
+
+        let port_val = RuntimeValue::Int(8080);
+        let callback = RuntimeValue::Function(Rc::new(crate::StdFunction {
+            name: "dummy".to_string(),
+            arity: 1,
+            callback: |_, _| Ok(RuntimeValue::Null),
+        }));
+
+        let result = listen_func.call(&mut ctx, vec![port_val, callback]);
+
+        assert!(result.is_err());
+        let err = result.unwrap_err();
+        if let RuntimeErrorKind::InvalidOperation(msg) = err.kind {
+            assert!(msg.contains("Security policy violation: Network capability is denied"));
+        } else {
+            panic!("Expected InvalidOperation error");
+        }
+    }
+}