Implement managed browser security, individual agents and observability

tests/evidence-policy-admin.test.mjs

@@ -0,0 +1,27 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import vm from 'node:vm';
+import {readFileSync} from 'node:fs';
+function fixture({evidence,review=true}={}){
+ const fields=new Map(),get=id=>{if(!fields.has(id))fields.set(id,{checked:false,disabled:false,addEventListener(kind,fn){this[kind]=fn;}});return fields.get(id);};
+ let changes=0;
+ const context=vm.createContext({$:get,policy:{evidence},currentPrincipal:null,independentApprovalRequired:review,fill(){},draft:()=>({version:4,brand:{name:'Company'}}),applyOperatorPermissions(){},updateDraftStatus(){changes++;}});
+ vm.runInContext(readFileSync(new URL('../apps/server/public/evidence-policy-admin.js',import.meta.url),'utf8'),context);
+ return {context,get,changes:()=>changes};
+}
+test('evidence controls default off and preserve unrelated draft fields',()=>{
+ const {context,get}=fixture();assert.equal(get('evidence-policy-enabled').checked,false);assert.equal(get('evidence-policy-downloads').checked,false);
+ assert.equal(get('evidence-policy-enabled').disabled,true);assert.equal(get('evidence-policy-downloads').disabled,true);
+ const draft=context.draft();assert.equal(draft.version,4);assert.equal(draft.brand.name,'Company');assert.equal(draft.evidence.enabled,false);assert.equal(draft.evidence.captureDownloads,false);
+});
+test('independent preparation permission enables draft controls; global off disables child control',()=>{
+ const {context,get,changes}=fixture({evidence:{enabled:true,captureDownloads:true}});
+ context.applyOperatorPermissions({permissions:['policy.read']});assert.equal(get('evidence-policy-enabled').disabled,true);
+ context.applyOperatorPermissions({permissions:['policy.prepare']});assert.equal(get('evidence-policy-enabled').disabled,false);assert.equal(get('evidence-policy-downloads').disabled,false);
+ get('evidence-policy-enabled').checked=false;get('evidence-policy-enabled').change();assert.equal(get('evidence-policy-downloads').disabled,true);assert.equal(context.draft().evidence.enabled,false);assert.equal(changes(),1);
+ context.fill({evidence:{enabled:true,captureDownloads:false}});assert.equal(get('evidence-policy-downloads').checked,false);assert.equal(get('evidence-policy-downloads').disabled,false);
+});
+test('direct publication mode requires policy.write rather than preparation permission',()=>{
+ const {context,get}=fixture({review:false});context.applyOperatorPermissions({permissions:['policy.prepare']});assert.equal(get('evidence-policy-enabled').disabled,true);
+ context.applyOperatorPermissions({permissions:['policy.write']});assert.equal(get('evidence-policy-enabled').disabled,false);
+});