safetynet/tests/enterprise-inspection.test.mjs

import test from 'node:test';
import assert from 'node:assert/strict';
import {createHash} from 'node:crypto';
import inspection from '../apps/browser/enterprise-inspection.cjs';
const bytes=Buffer.from('public test document'),digest=createHash('sha256').update(bytes).digest('hex');
const policy={enterprise:{icap:{enabled:true,scanUploads:true,scanDownloads:true,scanClipboard:true,scanAI:true}},security:{yara:{enabled:false}}};
const allow=()=>({decision:'allow',ruleId:'icap-clean',engine:'icap',sha256:digest,bytes:bytes.length,coverage:{complete:true}});
test('selected channels require exact complete scanner approval and preserve immutable source bytes',async()=>{
  for(const channel of ['upload','download','clipboard','ai']){
    const source=Buffer.from(bytes);let snapshot;
    const result=await inspection.scanEnterprise(source,policy,channel,async value=>{snapshot=value;assert.notEqual(value,source);assert.deepEqual(value,source);return allow();});
    assert.equal(result.decision,'allow');assert.deepEqual(source,bytes);assert.ok(snapshot.every(value=>value===0));
    for(const broken of [{...allow(),sha256:'wrong'},{...allow(),bytes:0},{...allow(),coverage:{complete:false}},{decision:'block',ruleId:'RAW COMPANY CONTENT'}])assert.equal((await inspection.scanEnterprise(source,policy,channel,async()=>broken)).decision,'block');
  }
  const result=await inspection.scanEnterprise(bytes,policy,'upload',async value=>{value.fill(120);return allow();});assert.equal(result.decision,'block');
});
test('disabled channel never calls external services and configured outages cannot fail open',async()=>{
  const disabled={...policy,enterprise:{icap:{...policy.enterprise.icap,scanClipboard:false}}};
  assert.equal((await inspection.scanEnterprise(bytes,disabled,'clipboard',()=>assert.fail())).decision,'allow');
  assert.equal((await inspection.scanEnterprise(bytes,policy,'clipboard',async()=>{throw Error('private scanner detail');})).ruleId,'icap-unavailable');
  assert.throws(()=>inspection.icapRequired(policy,'unsupported'));
});
test('external antivirus can scan downloads alone; every enabled scanner stays mandatory',async()=>{
  const dlp={inspect:async()=>({decision:'allow',coverage:{complete:true}})};
  assert.equal((await inspection.scanDownloadEnterprise(bytes,policy,dlp,async()=>allow())).decision,'allow');
  const both={...policy,security:{yara:{enabled:true}}};
  assert.equal((await inspection.scanDownloadEnterprise(bytes,both,null,()=>assert.fail())).decision,'block');
  const scanner={...dlp,scanDownload:async()=>({...allow(),engine:'yara'})};assert.equal((await inspection.scanDownloadEnterprise(bytes,both,scanner,async()=>allow())).decision,'allow');
  assert.equal((await inspection.scanDownloadEnterprise(bytes,both,scanner,async()=>({decision:'block',ruleId:'icap-threat'}))).ruleId,'icap-threat');
  assert.equal((await inspection.scanDownloadEnterprise(bytes,both,{...dlp,scanDownload:async()=>({...allow(),sha256:'wrong'})},()=>assert.fail())).ruleId,'yara-inspection-incomplete');
  assert.equal((await inspection.scanDownloadEnterprise(bytes,{...policy,enterprise:{icap:{enabled:false}}},null)).ruleId,'malware-scanner-required');
});
test('explicit no antivirus mode still requires complete DLP and never substitutes for an enabled failed scanner',async()=>{
 const p={...policy,enterprise:{icap:{enabled:false}},fileTransfers:{download:{allowWithoutMalwareScanner:true}}};
 assert.equal((await inspection.scanDownloadEnterprise(bytes,p,null)).ruleId,'download-dlp-unavailable');
 assert.equal((await inspection.scanDownloadEnterprise(bytes,p,{inspect:async()=>({decision:'allow'})})).ruleId,'download-dlp-incomplete');
 assert.equal((await inspection.scanDownloadEnterprise(bytes,p,{inspect:async()=>({decision:'block',ruleId:'company-secret'})})).ruleId,'company-secret');
 assert.equal((await inspection.scanDownloadEnterprise(bytes,p,{inspect:async()=>({decision:'allow',coverage:{complete:true}})})).decision,'allow');
 const mandatory={...p,security:{yara:{enabled:true}}};assert.equal((await inspection.scanDownloadEnterprise(bytes,mandatory,{inspect:async()=>({decision:'allow',coverage:{complete:true}})})).ruleId,'yara-unavailable');
});

test('incoming document DLP can be explicitly disabled only while malware scanning remains mandatory',async()=>{
 const p={...policy,fileTransfers:{download:{requireDocumentDlp:false}}};
 assert.equal((await inspection.scanDownloadEnterprise(bytes,p,null,async()=>allow())).decision,'allow');
 assert.equal((await inspection.scanDownloadEnterprise(bytes,p,null,async()=>({decision:'block',ruleId:'icap-malicious-macro'}))).ruleId,'icap-malicious-macro');
 const disabled={...p,enterprise:{icap:{enabled:false}}};assert.equal((await inspection.scanDownloadEnterprise(bytes,disabled,null)).ruleId,'malware-scanner-required');
 disabled.fileTransfers.download.allowWithoutMalwareScanner=true;assert.equal((await inspection.scanDownloadEnterprise(bytes,disabled,null)).ruleId,'download-dlp-unavailable');
 const both={...p,security:{yara:{enabled:true}}};assert.equal((await inspection.scanDownloadEnterprise(bytes,both,null,async()=>allow())).ruleId,'yara-unavailable');
});