Harden Windows DLP enforcement and Electron runtime packaging

tests/inspect-text-representations.test.mjs

@@ -0,0 +1,25 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {createRequire} from 'node:module';
+import {defaultPolicy} from '../packages/core/policy.mjs';
+const {inspectTextRepresentations}=createRequire(import.meta.url)('../apps/browser/inspect-text-representations.cjs');
+test('decoded representations reach semantic scanner separately and block before external release',async()=>{
+ const policy=defaultPolicy();policy.dlp.semantic.enabled=true;let calls=0,external=0;
+ const secret='Synthetic confidential paraphrase';
+ const result=await inspectTextRepresentations({bytes:Buffer.from(Buffer.from(secret).toString('base64')),policy,isCurrent:()=>true,inspectLocal:async data=>{calls++;return data.toString()===secret?{decision:'block',ruleId:'semantic-secret'}:{decision:'allow',coverage:{complete:true}};},inspectEnterprise:async()=>{external++;return {decision:'allow',coverage:{complete:true}};}});
+ assert.equal(result.ruleId,'semantic-secret');assert.equal(calls,2);assert.equal(external,1);
+});
+test('policy changes and incomplete scanner coverage fail closed',async()=>{
+ const policy=defaultPolicy();policy.dlp.semantic.enabled=true;
+ let current=true,external=0;
+ const result=await inspectTextRepresentations({bytes:Buffer.from('Public text'),policy,isCurrent:()=>current,inspectLocal:async()=>{current=false;return {decision:'allow',coverage:{complete:true}};},inspectEnterprise:async()=>{external++;}});
+ assert.equal(result.ruleId,'inspection-context-changed');assert.equal(external,0);
+ const incomplete=await inspectTextRepresentations({bytes:Buffer.from('Public text'),policy,isCurrent:()=>true,inspectLocal:async()=>({decision:'allow'})});
+ assert.equal(incomplete.ruleId,'inspection-incomplete');
+});
+
+test('configured enterprise scanner cannot be silently omitted',async()=>{
+ const policy=defaultPolicy();policy.enterprise.icap.enabled=true;
+ const result=await inspectTextRepresentations({bytes:Buffer.from('Public text'),policy,isCurrent:()=>true});
+ assert.equal(result.decision,'block');assert.equal(result.ruleId,'icap-unavailable');
+});