From e5251ae5f69f2eaf93f26debef6b9c3b35a5e320 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Tue, 6 Oct 2026 07:55:13 +0000
Subject: [PATCH] Add test for std.http capability denied error path

Co-authored-by: Tcode-Motion <188012755+Tcode-Motion@users.noreply.github.com>
---
 stdlib/tests/stdlib_tests.rs | 32 +++++++++++++++++++++++++++++++-
 1 file changed, 31 insertions(+), 1 deletion(-)

diff --git a/stdlib/tests/stdlib_tests.rs b/stdlib/tests/stdlib_tests.rs
index 0572b5d1..675bfd05 100644
--- a/stdlib/tests/stdlib_tests.rs
+++ b/stdlib/tests/stdlib_tests.rs
@@ -1,7 +1,10 @@
 use std::cell::RefCell;
 use std::collections::HashSet;
 use std::rc::Rc;
-use techscript_runtime::{context::Capability, value::RuntimeValue, RuntimeConfig, RuntimeContext};
+use techscript_runtime::{
+    context::Capability, error::RuntimeErrorKind, value::RuntimeValue, RuntimeConfig,
+    RuntimeContext,
+};
 use techscript_stdlib::StdlibRegistry;
 
 #[test]
@@ -472,6 +475,33 @@ fn test_web_module() {
     let _ = stop.call(&mut ctx, vec![]).unwrap();
 }
 
+#[test]
+fn test_http_module_capability_denied() {
+    let registry = StdlibRegistry::new();
+    let http = registry.get_module("std.http").unwrap();
+
+    let mut config_unprivileged = RuntimeConfig::default();
+    config_unprivileged
+        .capabilities
+        .remove(&Capability::Network);
+    let mut ctx_unprivileged = RuntimeContext::new(config_unprivileged);
+
+    let get = http.exports.get("get").unwrap();
+    let res = get.call(
+        &mut ctx_unprivileged,
+        vec![RuntimeValue::Str("http://example.com".to_string())],
+    );
+
+    assert!(res.is_err());
+    let err = res.unwrap_err();
+    match err.kind {
+        RuntimeErrorKind::InvalidOperation(msg) => {
+            assert!(msg.contains("Security policy violation: Network capability is denied"));
+        }
+        _ => panic!("Expected InvalidOperation error"),
+    }
+}
+
 #[test]
 fn test_http_module() {
     use std::io::{Read, Write};