148 lines
9.0 KiB
JavaScript
148 lines
9.0 KiB
JavaScript
import test from 'node:test';
|
|
import assert from 'node:assert/strict';
|
|
import { mkdtempSync, rmSync, readFileSync, readdirSync, writeFileSync } from 'node:fs';
|
|
import { join } from 'node:path';
|
|
import { tmpdir } from 'node:os';
|
|
import { connect } from 'node:net';
|
|
import { PROXY_PAGE_CODES } from '../src/proxy-page-vocabulary.mjs';
|
|
import { Broker, BusError } from '../src/broker.mjs';
|
|
import { REFUSALS, refusalGuidance } from '../src/refusals.mjs';
|
|
import { Store } from '../src/store.mjs';
|
|
import { busOrganization } from '../src/organization-context.mjs';
|
|
import { serve } from '../src/server.mjs';
|
|
import { Client } from '../src/client.mjs';
|
|
import { resolveInstance, validateBusinessDocument } from '../../organization/src/index.mjs';
|
|
import { businessDoc, REPO_ROLES, systemFor } from '../../organization/tests/helpers.mjs';
|
|
import { railsText } from '../../organization/src/rails.mjs';
|
|
import { GUARD_CODES } from '../../library/src/reply-protocol.mjs';
|
|
const SECRET = 'sk-test-NOT-A-SECRET-1234';
|
|
function fixture(t) {
|
|
const root = mkdtempSync(join(tmpdir(), 'rails-'));
|
|
const business = validateBusinessDocument(businessDoc(root), join(root, 'acme.json'), { rolesDir: REPO_ROLES });
|
|
const resolve = b => Object.fromEntries(Object.keys(b.roles).map(instance => [instance, resolveInstance({ system: systemFor(root), business: b, instance })]));
|
|
writeFileSync(business.roles.coder.credentials.gitea.file, SECRET);
|
|
const resolved = resolve(business), store = new Store(root);
|
|
const broker = new Broker({ store, businesses: { acme: busOrganization(business, resolved) } });
|
|
const cap = broker.bindLaunch({ business: 'acme', role: 'coder', run: 'coder-run', harness: 'pi' });
|
|
broker.request(cap, { verb: 'role.claim' });
|
|
t.after(() => { store.close(); rmSync(root, { recursive: true, force: true }); });
|
|
return { root, business, resolved, resolve, broker, store, cap };
|
|
}
|
|
|
|
test('my_rails equals the resolved prompt content, reads live narrowing, and writes/raises nothing', t => {
|
|
const f = fixture(t), call = args => f.broker.request(f.cap, { verb: 'my_rails', args });
|
|
const before = f.store.get('SELECT count(*) n FROM events').n;
|
|
assert.deepEqual(call({}), f.resolved.coder.rails);
|
|
const result = call({}); result.actions.length = 0;
|
|
assert.notEqual(call({}).actions.length, 0, 'returned rails do not mutate policy');
|
|
const business = structuredClone(f.business);
|
|
business.roles.coder.vars['limits.authority'] = ['message.send'];
|
|
const narrowed = f.resolve(business);
|
|
f.broker.reloadBusiness('acme', busOrganization(business, narrowed));
|
|
assert.deepEqual(call({}), narrowed.coder.rails);
|
|
assert.equal(f.store.get('SELECT count(*) n FROM events').n, before);
|
|
assert.equal(f.store.get('SELECT count(*) n FROM decisions').n, 0);
|
|
});
|
|
|
|
test('my_rails cannot select another identity or expose credential refs and file/call values', t => {
|
|
const f = fixture(t);
|
|
for (const args of [{ agent: 'cto' }, { role: 'cto' }, { instance: 'cto' }, { business: 'other' }, { token: SECRET }]) {
|
|
assert.throws(() => f.broker.request(f.cap, { verb: 'my_rails', args }), { code: 'invalid-request' });
|
|
}
|
|
const rails = f.broker.request(f.cap, { verb: 'my_rails' });
|
|
const text = JSON.stringify(rails) + railsText(rails);
|
|
for (const value of [SECRET, 'placeholder-not-a-token', f.resolved.coder.credentials.gitea.file, f.resolved.cto.credentials.gitea.file]) assert.ok(!text.includes(value), value);
|
|
const human = f.broker.bindHuman({ business: 'acme', human: 'jason', via: 'cli', outsideAgent: true });
|
|
assert.throws(() => f.broker.request(human, { verb: 'my_rails' }), { code: 'agent-required' });
|
|
});
|
|
|
|
function raw(path, request) {
|
|
return new Promise((resolve, reject) => {
|
|
const socket = connect(path); let out = '';
|
|
socket.on('error', reject);
|
|
socket.on('connect', () => socket.end(JSON.stringify(request) + '\n'));
|
|
socket.on('data', b => out += b);
|
|
socket.on('end', () => resolve(JSON.parse(out)));
|
|
});
|
|
}
|
|
test('cross-role refusal envelope names its rail and next step without changing code or outcome', async t => {
|
|
const f = fixture(t), path = join(f.root, 'bus.sock');
|
|
const server = await serve({ broker: f.broker, path }); t.after(() => server.close());
|
|
const request = { cap: f.cap, verb: 'decision.resolve', args: { id: 'missing', choice: SECRET } };
|
|
const refused = await raw(path, request);
|
|
assert.equal(refused.ok, false); assert.equal(refused.error, 'decision-not-found');
|
|
assert.deepEqual({ rail: refused.rail, nextStep: refused.nextStep }, REFUSALS['decision-not-found']);
|
|
assert.ok(!JSON.stringify(refused).includes(SECRET));
|
|
await assert.rejects(new Client({ path, cap: f.cap }).call('decision.resolve', request.args), e => {
|
|
assert.equal(e.code, 'decision-not-found'); assert.equal(e.nextStep, refused.nextStep); return true;
|
|
});
|
|
const decision = f.broker.request(f.cap, { verb: 'decision.raise', args: { action: 'task.scope.change', domain: 'delivery',
|
|
question: 'Scope?', options: [{ key: 'yes', text: 'Yes' }, { key: 'no', text: 'No' }], recommendation: 'no', blocking: false } });
|
|
const cross = await raw(path, { cap: f.cap, verb: 'decision.resolve', args: { id: decision.id, choice: 'yes' } });
|
|
assert.equal(cross.error, 'not-resolver'); assert.match(cross.rail, /resolve right/); assert.match(cross.nextStep, /routed resolver/);
|
|
assert.equal(f.store.get('SELECT count(*) n FROM decision_events WHERE decision=?', decision.id).n, 0);
|
|
// Exercise an actual cross-role action without its required decision, not just resolve.
|
|
const live = busOrganization(f.business, f.resolved);
|
|
live.roles.coder.authority.crossRole.push('role.end');
|
|
f.broker.reloadBusiness('acme', live);
|
|
const decisions = f.store.get('SELECT count(*) n FROM decisions').n;
|
|
const required = await raw(path, { cap: f.cap, verb: 'role.revoke', args: { role: 'reviewer', reason: SECRET } });
|
|
assert.equal(required.ok, false); assert.equal(required.error, 'decision-required');
|
|
assert.deepEqual({ rail: required.rail, nextStep: required.nextStep }, REFUSALS['decision-required']);
|
|
assert.ok(!JSON.stringify(required).includes(SECRET));
|
|
assert.equal(f.store.get('SELECT count(*) n FROM decisions').n, decisions);
|
|
});
|
|
|
|
test('every literal fail branch in broker has static guidance; guidance never contains payload values', () => {
|
|
const source = readFileSync(new URL('../src/broker.mjs', import.meta.url), 'utf8');
|
|
// Balance each call (including ternaries), so a following statement cannot masquerade
|
|
// as a fail code. Every literal branch, with either quote style, must be in the table.
|
|
for (const match of source.matchAll(/\bfail\s*\(/g)) {
|
|
let depth = 1, i = match.index + match[0].length;
|
|
while (depth && i < source.length) {
|
|
const char = source[i++];
|
|
if (char === "'" || char === '"') {
|
|
const start = i - 1;
|
|
let value = '';
|
|
while (i < source.length && source[i] !== char) {
|
|
if (source[i] === "\\") { i += 2; continue; }
|
|
value += source[i++];
|
|
}
|
|
i++;
|
|
if (/^[a-z][a-z0-9-]*$/.test(value) && (value.includes('-') || !source.slice(match.index + match[0].length, start).trim())) assert.ok(Object.hasOwn(REFUSALS, value), value);
|
|
} else if (char === '(') depth++;
|
|
else if (char === ')') depth--;
|
|
}
|
|
assert.equal(depth, 0, 'balanced fail call');
|
|
}
|
|
// Finite delegated fail(code) sources must be covered as well as literal branches.
|
|
for (const code of [...PROXY_PAGE_CODES, ...GUARD_CODES, 'project-busy', 'remote-host-mismatch', 'remote-not-fork',
|
|
'processing-control-unsafe', 'processing-uninitialized', 'processing-generation-changed']) {
|
|
assert.ok(Object.hasOwn(REFUSALS, code), code);
|
|
}
|
|
for (const [code, guidance] of Object.entries(REFUSALS)) {
|
|
assert.ok(guidance.rail.length > 0 && guidance.nextStep.length > 0, code);
|
|
assert.deepEqual({ rail: new BusError(code).rail, nextStep: new BusError(code).nextStep }, guidance);
|
|
assert.ok(!JSON.stringify(guidance).includes(SECRET));
|
|
}
|
|
assert.deepEqual(refusalGuidance(SECRET), refusalGuidance('unknown-external-code'));
|
|
});
|
|
|
|
test('finite forwarded project, library and request errors have static next steps', () => {
|
|
const modules = [
|
|
...['index', 'git', 'paths'].map(name => new URL(`../../project/src/${name}.mjs`, import.meta.url)),
|
|
...readdirSync(new URL('../../library/src/', import.meta.url)).filter(f => f.endsWith('.mjs'))
|
|
.map(name => new URL(`../../library/src/${name}`, import.meta.url)),
|
|
...['request-store', 'request-lifecycle'].map(name => new URL(`../src/${name}.mjs`, import.meta.url)),
|
|
];
|
|
for (const file of modules) {
|
|
const source = readFileSync(file, 'utf8');
|
|
for (const match of source.matchAll(/\b(?:new\s+(?:ProjectError|LibraryError|RequestError|GuardError)|raise|refuse|fail)\s*\(\s*['"]([a-z][a-z0-9-]*)['"]/g)) {
|
|
assert.ok(Object.hasOwn(REFUSALS, match[1]), `${file.pathname}: ${match[1]}`);
|
|
}
|
|
}
|
|
assert.doesNotMatch(REFUSALS['outcome-unknown'].nextStep, /confirmation|human/);
|
|
assert.doesNotMatch(REFUSALS['revision-conflict'].nextStep, /confirmation|human/);
|
|
assert.match(REFUSALS['task-required'].nextStep, /task_ref.*blocking false/);
|
|
});
|