28 lines
1.9 KiB
JavaScript
28 lines
1.9 KiB
JavaScript
import test from 'node:test';
|
|
import assert from 'node:assert/strict';
|
|
import {generateKeyPairSync} from 'node:crypto';
|
|
import {createRequire} from 'node:module';
|
|
import {defaultPolicy,PolicySchema,signPolicy,verifyPolicy} from '../packages/core/policy.mjs';
|
|
import {AgentGrantSchema} from '../packages/core/security.mjs';
|
|
const {startAgentControl}=createRequire(import.meta.url)('../apps/browser/agent-control.cjs');
|
|
const {requestAgent}=createRequire(import.meta.url)('../apps/browser/agent-transport-client.cjs');
|
|
|
|
test('worker gate defaults off and survives signed policy verification',()=>{
|
|
const p=defaultPolicy();assert.equal(p.browser.allowAgentBackgroundWorkers,false);
|
|
delete p.browser.allowAgentBackgroundWorkers;
|
|
assert.equal(PolicySchema.parse(p).browser.allowAgentBackgroundWorkers,false);
|
|
p.browser.allowAgentBackgroundWorkers=true;
|
|
const {privateKey,publicKey}=generateKeyPairSync('ed25519',{privateKeyEncoding:{type:'pkcs8',format:'pem'},publicKeyEncoding:{type:'spki',format:'pem'}});
|
|
assert.equal(verifyPolicy(signPolicy(p,privateKey),publicKey).browser.allowAgentBackgroundWorkers,true);
|
|
assert.equal(PolicySchema.safeParse({...p,browser:{...p.browser,allowAgentBackgroundWorkers:'true'}}).success,false);
|
|
});
|
|
|
|
test('background permission cannot become an executable agent RPC',async t=>{
|
|
const grant=AgentGrantSchema.parse({id:'worker-agent',name:'Worker',enabled:true,expiresAt:'2099-12-31T23:59:59Z',scopes:['network:background'],allowedHosts:['company.example'],generation:1});
|
|
assert.deepEqual(grant.scopes,['network:background']);let executed=0;
|
|
const api=await startAgentControl({authorize:async()=>({allowed:true,role:'agent',scopes:['network:background']}),actions:{'network:background':async()=>{executed++;}},audit:async()=>{}});
|
|
t.after(()=>api.close());
|
|
assert.equal((await requestAgent(api,{action:'network:background',args:{}})).status,400);
|
|
assert.equal(executed,0);
|
|
});
|