9 lines
2.3 KiB
JavaScript
9 lines
2.3 KiB
JavaScript
|
import test from 'node:test';
|
||
|
|
import assert from 'node:assert/strict';
|
||
|
|
import {AgentsSchema,AgentGrantSchema} from '../packages/core/security.mjs';
|
||
|
|
import {defaultPolicy,PolicySchema} from '../packages/core/policy.mjs';
|
||
|
|
import {applyPolicyGroups} from '../packages/core/policy-groups.mjs';
|
||
|
|
import {applyUserProfiles} from '../packages/core/user-profiles.mjs';
|
||
|
|
const grant=()=>({id:'research-agent',name:'Research agent',enabled:true,expiresAt:'2099-12-31T23:59:59Z',scopes:['sessions','read'],allowedHosts:['*.company.example'],generation:1});
|
||
|
|
test('individual agent grants are explicit bounded unique and secret free',()=>{assert.equal(AgentsSchema.parse({}).identityMode,'legacy');assert.deepEqual(AgentsSchema.parse({}).grants,[]);const a=AgentsSchema.parse({identityMode:'individual',grants:[grant()]});assert.equal(a.identityMode,'individual');assert.deepEqual(a.grants[0],grant());for(const change of [{id:'bad id'},{generation:0},{generation:1.5},{expiresAt:'invalid'},{scopes:['not-a-scope']},{scopes:['read','read']},{privateKey:'secret'},{token:'secret'},{name:''}])assert.equal(AgentGrantSchema.safeParse({...grant(),...change}).success,false);assert.equal(AgentsSchema.safeParse({grants:[grant(),grant()]}).success,false);assert.equal(AgentsSchema.safeParse({grants:Array.from({length:33},(_,i)=>({...grant(),id:`a${i}`}))}).success,false);assert.deepEqual(AgentGrantSchema.parse({...grant(),scopes:[]}).scopes,[]);});
|
||
|
|
test('signed policy schema preserves individual grants through restrictive group and profile assignment',()=>{const p=defaultPolicy();p.agents=AgentsSchema.parse({enabled:true,identityMode:'individual',grants:[grant()]});const parsed=PolicySchema.parse(p);assert.deepEqual(parsed.agents.grants,[grant()]);const grouped=applyPolicyGroups(parsed,[{id:'locked',name:'Locked',memberDeviceIds:['one'],restrictions:{disableAgents:true},rollout:{stage:'all',deviceIds:[]}}],'one');assert.equal(grouped.agents.enabled,false);assert.equal(grouped.agents.identityMode,'individual');assert.deepEqual(grouped.agents.grants,[grant()]);const profiled=applyUserProfiles(parsed,{profiles:[{id:'restricted',name:'Restricted',deviceIds:['one'],features:{agents:'deny'}}]}, {id:'one'});assert.equal(profiled.agents.enabled,false);assert.deepEqual(profiled.agents.grants,[grant()]);assert.equal(p.agents.enabled,true);});
|