karl/safetynet
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Capture guarded human gestures and verify agent administration

Browse Source
This commit is contained in:
Karl committed 2026-10-13 18:24:44 +02:00
1 parent 244f01630b
commit adf0940e5f
32 files changed
+523 -52
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

tests/admin-history-profile-review.test.mjs
+5
View File
@@ -22,3 +22,8 @@ for(const part of ['baseline','group','profile'])test(`truncated ${part} diff ne
});
test('missing user-profile diff fails closed rather than treating it as unchanged',async()=>{const comparison=empty();delete comparison.profileDiff;const f=fixture(comparison);await assert.rejects(f.review(),/Complete baseline, group and user-profile/);assert.equal(f.get('history-review').hidden,true);assert.equal(vm.runInContext('historyReview',f.context),null);});
test('profile values are rendered as literal text and read-only identities cannot approve',async()=>{const comparison=empty();comparison.profileDiff.changes=[{path:'/profiles/0/name',kind:'changed',before:'<img src=x onerror=alert(1)>',after:'Current'}];const f=fixture(comparison,['policy.read']);await f.review();assert.match(f.get('history-diff-list').children[0].children[1].textContent,/<img src=x onerror=alert\(1\)>/);assert.equal(f.get('history-approve').disabled,true);assert.equal(f.get('history-restore').disabled,true);});
for(const [part,path] of [['baseline','/agents/grants'],['group','/0/policy/agents/grants'],['profile','/profiles/0/policy/agents/grants']])test(`grant ${part} restoration explains persistent generation floors before confirmation`,async()=>{
const comparison=empty(),change={path,kind:'changed',before:[{id:'research-agent',generation:1}],after:[{id:'research-agent',generation:2}]};(part==='baseline'?comparison.changes:comparison[`${part}Diff`].changes).push(change);const f=fixture(comparison);await f.review();assert.match(f.get('history-review-summary').textContent,/highest observed credential generation/);assert.match(f.get('history-review-summary').textContent,/does not restore invalidated credentials/);assert.match(f.get('history-review-summary').textContent,/greater than every previously issued generation/);assert.equal(f.get('history-restore').disabled,true);
});
test('unrelated restoration does not imply a credential-generation change',async()=>{const comparison=empty();comparison.changes=[{path:'/brand/name',kind:'changed',before:'Previous',after:'Current'}];const f=fixture(comparison);await f.review();assert.doesNotMatch(f.get('history-review-summary').textContent,/Agent credential warning/);});