From 484d5d789e1094a0d464bc48b69fd5819f038935 Mon Sep 17 00:00:00 2001
From: cyberguru1 <hamzacypher34@gmail.com>
Date: Sun, 31 May 2026 16:27:46 -0500
Subject: [PATCH] itest: add custom permissions integration tests

Add a new sub-test case to verify that custom `entity:action`
permissions are correctly handled and enforced for LNC custom
sessions. The test uses the `info:read` permission to
assert that the connection can only query LND's GetInfo endpoint
and is blocked on other endpoints. Tests are added for both
integrated mode and remote mode suites.
---
 itest/litd_mode_integrated_test.go | 49 ++++++++++++++++++++++++++++++
 itest/litd_mode_remote_test.go     | 49 ++++++++++++++++++++++++++++++
 2 files changed, 98 insertions(+)

diff --git a/itest/litd_mode_integrated_test.go b/itest/litd_mode_integrated_test.go
index 9cce6bf8..889fca0b 100644
--- a/itest/litd_mode_integrated_test.go
+++ b/itest/litd_mode_integrated_test.go
@@ -692,6 +692,55 @@ func integratedTestSuite(ctx context.Context, net *NetworkHarness, t *testing.T,
 			})
 		}
 	})
+
+	t.Run("lnc auth custom entity action perms", func(tt *testing.T) {
+		cfg := net.Alice.Cfg
+
+		ctx := context.Background()
+		ctxt, cancel := context.WithTimeout(ctx, defaultTimeout)
+		defer cancel()
+
+		customPerms := []*litrpc.MacaroonPermission{
+			{
+				Entity: "info",
+				Action: "read",
+			},
+		}
+
+		rawLNCConn := setUpLNCConn(
+			ctxt, t, cfg.LitAddr(), cfg.LitTLSCertPath,
+			cfg.LitMacPath,
+			litrpc.SessionType_TYPE_MACAROON_CUSTOM,
+			customPerms,
+		)
+		defer rawLNCConn.Close()
+
+		for _, endpoint := range endpoints {
+			endpoint := endpoint
+			endpointDisabled := subServersDisabled &&
+				endpoint.canDisable
+
+			expectedErr := "permission denied"
+			if endpoint.noAuth {
+				expectedErr = "unknown service"
+			}
+
+			tt.Run(endpoint.name+" lit port", func(ttt *testing.T) {
+				// Only lnrpc (GetInfo) is allowed, as we
+				// only granted the "info:read" permission.
+				allowed := endpoint.name == "lnrpc"
+
+				runLNCAuthTest(
+					ttt, rawLNCConn, endpoint.requestFn,
+					endpoint.successPattern,
+					allowed, expectedErr,
+					endpointDisabled,
+					endpoint.disabledPattern,
+					endpoint.noAuth,
+				)
+			})
+		}
+	})
 }
 
 func uiPasswordAuthCheck(t *testing.T, cfg *LitNodeConfig, subServersDisabled,
diff --git a/itest/litd_mode_remote_test.go b/itest/litd_mode_remote_test.go
index 35df9048..1ba6303f 100644
--- a/itest/litd_mode_remote_test.go
+++ b/itest/litd_mode_remote_test.go
@@ -259,6 +259,55 @@ func remoteTestSuite(ctx context.Context, net *NetworkHarness, t *testing.T,
 		}
 	})
 
+	t.Run("lnc auth custom entity action perms", func(tt *testing.T) {
+		cfg := net.Bob.Cfg
+
+		ctx := context.Background()
+		ctxt, cancel := context.WithTimeout(ctx, defaultTimeout)
+		defer cancel()
+
+		customPerms := []*litrpc.MacaroonPermission{
+			{
+				Entity: "info",
+				Action: "read",
+			},
+		}
+
+		rawLNCConn := setUpLNCConn(
+			ctxt, tt, cfg.LitAddr(), cfg.LitTLSCertPath,
+			cfg.LitMacPath,
+			litrpc.SessionType_TYPE_MACAROON_CUSTOM,
+			customPerms,
+		)
+		defer rawLNCConn.Close()
+
+		for _, endpoint := range endpoints {
+			endpoint := endpoint
+			endpointDisabled := subServersDisabled &&
+				endpoint.canDisable
+
+			expectedErr := "permission denied"
+			if endpoint.noAuth {
+				expectedErr = "unknown service"
+			}
+
+			tt.Run(endpoint.name+" lit port", func(ttt *testing.T) {
+				// Only lnrpc (GetInfo) is allowed, as we
+				// only granted the "info:read" permission.
+				allowed := endpoint.name == "lnrpc"
+
+				runLNCAuthTest(
+					ttt, rawLNCConn, endpoint.requestFn,
+					endpoint.successPattern,
+					allowed, expectedErr,
+					endpointDisabled,
+					endpoint.disabledPattern,
+					endpoint.noAuth,
+				)
+			})
+		}
+	})
+
 	t.Run("gRPC super macaroon account system test", func(tt *testing.T) {
 		cfg := net.Bob.Cfg