22 lines
2.3 KiB
JavaScript
22 lines
2.3 KiB
JavaScript
|
import test from 'node:test';
|
||
|
|
import assert from 'node:assert/strict';
|
||
|
|
import vm from 'node:vm';
|
||
|
|
import {readFileSync} from 'node:fs';
|
||
|
|
import {createRequire} from 'node:module';
|
||
|
|
const require=createRequire(import.meta.url),source=readFileSync(new URL('../apps/browser/main.cjs',import.meta.url),'utf8');
|
||
|
|
const shipped=source.slice(source.indexOf('function auditAgent(event)'),source.indexOf('function applyPolicy(envelope)'));
|
||
|
|
function fixture(){const calls=[],context=vm.createContext({require:()=>require('../packages/core/agent-audit.cjs'),audit:(...args)=>calls.push(args)});vm.runInContext(shipped,context);return {run:context.auditAgent,calls};}
|
||
|
|
test('native agent audit preserves typed scope/session but never status, arguments or credentials',()=>{
|
||
|
|
const f=fixture(),sessionId='00000000-0000-4000-8000-000000000001';
|
||
|
|
f.run({action:'read',scope:'browser:read',outcome:'completed',sessionId,status:200,args:{password:'PRIVATE_ARGUMENT'},token:'PRIVATE_CAPABILITY'});
|
||
|
|
const [kind,rule,,,,,agent]=f.calls[0];assert.equal(kind,'agent.action');assert.equal(rule,'read:completed');assert.equal(agent.scope,'browser:read');assert.equal(agent.sessionId,sessionId);
|
||
|
|
assert.equal(JSON.stringify(f.calls).includes('PRIVATE_'),false);assert.deepEqual(Object.keys(agent).sort(),['action','outcome','scope','sessionId']);
|
||
|
|
});
|
||
|
|
test('failed and adapter-denied actions retain truthful outcomes and malformed sessions cannot suppress audit',()=>{
|
||
|
|
const f=fixture();f.run({action:'type',outcome:'failed',status:500,sessionId:'00000000-0000-f000-0000-000000000001'});
|
||
|
|
assert.equal(f.calls[0][0],'agent.denied');assert.equal(f.calls[0][6].outcome,'failed');assert.equal(f.calls[0][6].sessionId,undefined);
|
||
|
|
f.run({action:'agent.read',outcome:'blocked'});assert.equal(f.calls[1][6].action,'read');assert.equal(f.calls[1][6].outcome,'denied');
|
||
|
|
f.run({action:'agent-request',outcome:'denied',status:401});assert.equal(f.calls[2][6].scope,'agent:request');
|
||
|
|
});
|
||
|
|
|
||
|
|
test('browser retains authenticated individual actor without credential secrets',()=>{const f=fixture();f.run({action:'read',outcome:'completed',principalId:'security-agent',generation:3,token:'PRIVATE_TOKEN'});const agent=f.calls[0][6];assert.equal(agent.principalId,'security-agent');assert.equal(agent.credentialGeneration,3);assert.equal(JSON.stringify(f.calls).includes('PRIVATE_TOKEN'),false);});
|