safetynet/tests/admin-history-profile-review.test.mjs

import test from 'node:test';
import assert from 'node:assert/strict';
import vm from 'node:vm';
import {readFileSync} from 'node:fs';
// Execute the shipped history review code against a minimal DOM, not a duplicate implementation.
const source=readFileSync(new URL('../apps/server/public/admin.js',import.meta.url),'utf8');
const history=source.slice(source.indexOf('let historyNextBefore='),source.indexOf("$('history-load').onclick="));
function fixture(comparison,permissions=['policy.write']){
 const fields=new Map(),element=()=>({children:[],hidden:false,checked:false,disabled:false,textContent:'',append(...items){this.children.push(...items);},replaceChildren(...items){this.children=items;},scrollIntoView(){}}),get=id=>{if(!fields.has(id))fields.set(id,element());return fields.get(id);};
 const context=vm.createContext({$:get,document:{createElement:element},publishedSnapshot:{version:5},operatorPermissions:new Set(permissions),independentApprovalRequired:false,api:async path=>path.startsWith('/api/admin/policy/diff')?comparison:{currentVersion:5},cell(){},task:fn=>fn});
 vm.runInContext(history,context);
 return {context,get,review:()=>context.reviewHistory(3)};
}
const empty=()=>({changes:[],truncated:false,groupDiff:{changes:[],truncated:false},profileDiff:{changes:[],truncated:false}});
test('profile-only restore displays assignments, grants and categories even when baseline/groups unchanged',async()=>{
 const comparison=empty();comparison.profileDiff.changes=[{path:'/profiles/0/subjects',kind:'changed',before:['verified-admin'],after:['verified-user']},{path:'/profiles/0/deviceIds',kind:'changed',before:['one'],after:['two']},{path:'/profiles/0/features/devTools',kind:'changed',before:'allow',after:'deny'},{path:'/categories/0/hosts',kind:'changed',before:['*.company.example'],after:['wiki.company.example']}];
 const f=fixture(comparison);await f.review();const rows=f.get('history-diff-list').children;
 assert.equal(rows.length,4);assert.match(rows[0].children[0].textContent,/^\/userProfiles\/profiles\/0\/subjects/);assert.match(rows[0].children[1].textContent,/Selected version:.*verified-admin/);assert.match(rows[2].children[1].textContent,/Selected version: "allow"/);assert.match(f.get('history-review-summary').textContent,/0 baseline paths, 0 group paths and 4 user-profile/);assert.match(f.get('history-review-summary').textContent,/developer-tool grants/);assert.equal(f.get('history-review').hidden,false);assert.equal(f.get('history-approve').disabled,false);assert.equal(f.get('history-restore').disabled,true);
});
for(const part of ['baseline','group','profile'])test(`truncated ${part} diff never arms restoration`,async()=>{
 const comparison=empty();if(part==='baseline')comparison.truncated=true;else comparison[`${part}Diff`].truncated=true;const f=fixture(comparison);await assert.rejects(f.review(),/supported review size/);assert.equal(f.get('history-review').hidden,true);assert.equal(f.get('history-restore').disabled,true);assert.equal(vm.runInContext('historyReview',f.context),null);
});
test('missing user-profile diff fails closed rather than treating it as unchanged',async()=>{const comparison=empty();delete comparison.profileDiff;const f=fixture(comparison);await assert.rejects(f.review(),/Complete baseline, group and user-profile/);assert.equal(f.get('history-review').hidden,true);assert.equal(vm.runInContext('historyReview',f.context),null);});
test('profile values are rendered as literal text and read-only identities cannot approve',async()=>{const comparison=empty();comparison.profileDiff.changes=[{path:'/profiles/0/name',kind:'changed',before:'<img src=x onerror=alert(1)>',after:'Current'}];const f=fixture(comparison,['policy.read']);await f.review();assert.match(f.get('history-diff-list').children[0].children[1].textContent,/<img src=x onerror=alert\(1\)>/);assert.equal(f.get('history-approve').disabled,true);assert.equal(f.get('history-restore').disabled,true);});

for(const [part,path] of [['baseline','/agents/grants'],['group','/0/policy/agents/grants'],['profile','/profiles/0/policy/agents/grants']])test(`grant ${part} restoration explains persistent generation floors before confirmation`,async()=>{
 const comparison=empty(),change={path,kind:'changed',before:[{id:'research-agent',generation:1}],after:[{id:'research-agent',generation:2}]};(part==='baseline'?comparison.changes:comparison[`${part}Diff`].changes).push(change);const f=fixture(comparison);await f.review();assert.match(f.get('history-review-summary').textContent,/highest observed credential generation/);assert.match(f.get('history-review-summary').textContent,/does not restore invalidated credentials/);assert.match(f.get('history-review-summary').textContent,/greater than every previously issued generation/);assert.equal(f.get('history-restore').disabled,true);
});
test('unrelated restoration does not imply a credential-generation change',async()=>{const comparison=empty();comparison.changes=[{path:'/brand/name',kind:'changed',before:'Previous',after:'Current'}];const f=fixture(comparison);await f.review();assert.doesNotMatch(f.get('history-review-summary').textContent,/Agent credential warning/);});