50 lines
5.1 KiB
JavaScript
50 lines
5.1 KiB
JavaScript
import test from 'node:test';
|
|
import assert from 'node:assert/strict';
|
|
import {createHash} from 'node:crypto';
|
|
import inspection from '../apps/browser/enterprise-inspection.cjs';
|
|
const bytes=Buffer.from('public test document'),digest=createHash('sha256').update(bytes).digest('hex');
|
|
const policy={enterprise:{icap:{enabled:true,scanUploads:true,scanDownloads:true,scanClipboard:true,scanAI:true}},security:{yara:{enabled:false}}};
|
|
const allow=()=>({decision:'allow',ruleId:'icap-clean',engine:'icap',sha256:digest,bytes:bytes.length,coverage:{complete:true}});
|
|
test('selected channels require exact complete scanner approval and preserve immutable source bytes',async()=>{
|
|
for(const channel of ['upload','download','clipboard','ai']){
|
|
const source=Buffer.from(bytes);let snapshot;
|
|
const result=await inspection.scanEnterprise(source,policy,channel,async value=>{snapshot=value;assert.notEqual(value,source);assert.deepEqual(value,source);return allow();});
|
|
assert.equal(result.decision,'allow');assert.deepEqual(source,bytes);assert.ok(snapshot.every(value=>value===0));
|
|
for(const broken of [{...allow(),sha256:'wrong'},{...allow(),bytes:0},{...allow(),coverage:{complete:false}},{decision:'block',ruleId:'RAW COMPANY CONTENT'}])assert.equal((await inspection.scanEnterprise(source,policy,channel,async()=>broken)).decision,'block');
|
|
}
|
|
const result=await inspection.scanEnterprise(bytes,policy,'upload',async value=>{value.fill(120);return allow();});assert.equal(result.decision,'block');
|
|
});
|
|
test('disabled channel never calls external services and configured outages cannot fail open',async()=>{
|
|
const disabled={...policy,enterprise:{icap:{...policy.enterprise.icap,scanClipboard:false}}};
|
|
assert.equal((await inspection.scanEnterprise(bytes,disabled,'clipboard',()=>assert.fail())).decision,'allow');
|
|
assert.equal((await inspection.scanEnterprise(bytes,policy,'clipboard',async()=>{throw Error('private scanner detail');})).ruleId,'icap-unavailable');
|
|
assert.throws(()=>inspection.icapRequired(policy,'unsupported'));
|
|
});
|
|
test('external antivirus can scan downloads alone; every enabled scanner stays mandatory',async()=>{
|
|
const dlp={inspect:async()=>({decision:'allow',coverage:{complete:true}})};
|
|
assert.equal((await inspection.scanDownloadEnterprise(bytes,policy,dlp,async()=>allow())).decision,'allow');
|
|
const both={...policy,security:{yara:{enabled:true}}};
|
|
assert.equal((await inspection.scanDownloadEnterprise(bytes,both,null,()=>assert.fail())).decision,'block');
|
|
const scanner={...dlp,scanDownload:async()=>({...allow(),engine:'yara'})};assert.equal((await inspection.scanDownloadEnterprise(bytes,both,scanner,async()=>allow())).decision,'allow');
|
|
assert.equal((await inspection.scanDownloadEnterprise(bytes,both,scanner,async()=>({decision:'block',ruleId:'icap-threat'}))).ruleId,'icap-threat');
|
|
assert.equal((await inspection.scanDownloadEnterprise(bytes,both,{...dlp,scanDownload:async()=>({...allow(),sha256:'wrong'})},()=>assert.fail())).ruleId,'yara-inspection-incomplete');
|
|
assert.equal((await inspection.scanDownloadEnterprise(bytes,{...policy,enterprise:{icap:{enabled:false}}},null)).ruleId,'malware-scanner-required');
|
|
});
|
|
test('explicit no antivirus mode still requires complete DLP and never substitutes for an enabled failed scanner',async()=>{
|
|
const p={...policy,enterprise:{icap:{enabled:false}},fileTransfers:{download:{allowWithoutMalwareScanner:true}}};
|
|
assert.equal((await inspection.scanDownloadEnterprise(bytes,p,null)).ruleId,'download-dlp-unavailable');
|
|
assert.equal((await inspection.scanDownloadEnterprise(bytes,p,{inspect:async()=>({decision:'allow'})})).ruleId,'download-dlp-incomplete');
|
|
assert.equal((await inspection.scanDownloadEnterprise(bytes,p,{inspect:async()=>({decision:'block',ruleId:'company-secret'})})).ruleId,'company-secret');
|
|
assert.equal((await inspection.scanDownloadEnterprise(bytes,p,{inspect:async()=>({decision:'allow',coverage:{complete:true}})})).decision,'allow');
|
|
const mandatory={...p,security:{yara:{enabled:true}}};assert.equal((await inspection.scanDownloadEnterprise(bytes,mandatory,{inspect:async()=>({decision:'allow',coverage:{complete:true}})})).ruleId,'yara-unavailable');
|
|
});
|
|
|
|
test('incoming document DLP can be explicitly disabled only while malware scanning remains mandatory',async()=>{
|
|
const p={...policy,fileTransfers:{download:{requireDocumentDlp:false}}};
|
|
assert.equal((await inspection.scanDownloadEnterprise(bytes,p,null,async()=>allow())).decision,'allow');
|
|
assert.equal((await inspection.scanDownloadEnterprise(bytes,p,null,async()=>({decision:'block',ruleId:'icap-malicious-macro'}))).ruleId,'icap-malicious-macro');
|
|
const disabled={...p,enterprise:{icap:{enabled:false}}};assert.equal((await inspection.scanDownloadEnterprise(bytes,disabled,null)).ruleId,'malware-scanner-required');
|
|
disabled.fileTransfers.download.allowWithoutMalwareScanner=true;assert.equal((await inspection.scanDownloadEnterprise(bytes,disabled,null)).ruleId,'download-dlp-unavailable');
|
|
const both={...p,security:{yara:{enabled:true}}};assert.equal((await inspection.scanDownloadEnterprise(bytes,both,null,async()=>allow())).ruleId,'yara-unavailable');
|
|
});
|