26 lines
2.0 KiB
JavaScript
26 lines
2.0 KiB
JavaScript
import test from 'node:test';
|
|
import assert from 'node:assert/strict';
|
|
import {createRequire} from 'node:module';
|
|
import {defaultPolicy} from '../packages/core/policy.mjs';
|
|
const {inspectTextRepresentations}=createRequire(import.meta.url)('../apps/browser/inspect-text-representations.cjs');
|
|
test('decoded representations reach semantic scanner separately and block before external release',async()=>{
|
|
const policy=defaultPolicy();policy.dlp.semantic.enabled=true;let calls=0,external=0;
|
|
const secret='Synthetic confidential paraphrase';
|
|
const result=await inspectTextRepresentations({bytes:Buffer.from(Buffer.from(secret).toString('base64')),policy,isCurrent:()=>true,inspectLocal:async data=>{calls++;return data.toString()===secret?{decision:'block',ruleId:'semantic-secret'}:{decision:'allow',coverage:{complete:true}};},inspectEnterprise:async()=>{external++;return {decision:'allow',coverage:{complete:true}};}});
|
|
assert.equal(result.ruleId,'semantic-secret');assert.equal(calls,2);assert.equal(external,1);
|
|
});
|
|
test('policy changes and incomplete scanner coverage fail closed',async()=>{
|
|
const policy=defaultPolicy();policy.dlp.semantic.enabled=true;
|
|
let current=true,external=0;
|
|
const result=await inspectTextRepresentations({bytes:Buffer.from('Public text'),policy,isCurrent:()=>current,inspectLocal:async()=>{current=false;return {decision:'allow',coverage:{complete:true}};},inspectEnterprise:async()=>{external++;}});
|
|
assert.equal(result.ruleId,'inspection-context-changed');assert.equal(external,0);
|
|
const incomplete=await inspectTextRepresentations({bytes:Buffer.from('Public text'),policy,isCurrent:()=>true,inspectLocal:async()=>({decision:'allow'})});
|
|
assert.equal(incomplete.ruleId,'inspection-incomplete');
|
|
});
|
|
|
|
test('configured enterprise scanner cannot be silently omitted',async()=>{
|
|
const policy=defaultPolicy();policy.enterprise.icap.enabled=true;
|
|
const result=await inspectTextRepresentations({bytes:Buffer.from('Public text'),policy,isCurrent:()=>true});
|
|
assert.equal(result.decision,'block');assert.equal(result.ruleId,'icap-unavailable');
|
|
});
|