safetynet/tests/evidence-key.test.mjs

import test from 'node:test';import assert from 'node:assert/strict';import {mkdtempSync,writeFileSync,rmSync} from 'node:fs';import {join,resolve,sep} from 'node:path';import {tmpdir} from 'node:os';import {randomBytes} from 'node:crypto';import {assertPrivateEvidenceKey} from '../apps/server/evidence-key.mjs';import {normalizePrincipal,principalForGroups} from '../apps/server/admin-access.mjs';
test('analyst identity grants evidence/triage but no policy or fleet administration',()=>{const p=normalizePrincipal({sub:'soc',role:'analyst'});assert.ok(p.permissions.includes('evidence.read'));for(const permission of ['policy.write','devices.manage','sessions.manage','integrations.manage'])assert.equal(p.permissions.includes(permission),false);assert.equal(principalForGroups({sub:'soc'},['soc-team'],{oidcAdminGroup:'admins',oidcAnalystGroup:'soc-team'}).role,'analyst');});
// eslint-disable-next-line no-unsafe-finally -- Cleanup failure must fail closed rather than report successful protected cleanup.
test('Windows evidence key rejects inherited shared read permissions',{skip:process.platform!=='win32'},t=>{const dir=mkdtempSync(join(tmpdir(),'safetynet-evidence-acl-')),file=join(dir,'evidence.key');try{writeFileSync(file,randomBytes(32));let rejected=false;try{assertPrivateEvidenceKey(file);}catch{rejected=true;}if(!rejected){t.skip('This Windows temp directory already supplies private inherited ACLs');return;}assert.equal(rejected,true);}finally{if(!resolve(dir).startsWith(resolve(tmpdir())+sep))throw Error('Unsafe cleanup');rmSync(dir,{recursive:true,force:true});}});