decision_agent 0.1.3 → 0.1.6

data/spec/auth/session_manager_spec.rb

@@ -0,0 +1,172 @@
+require "spec_helper"
+
+RSpec.describe DecisionAgent::Auth::SessionManager do
+  let(:manager) { DecisionAgent::Auth::SessionManager.new }
+
+  describe "#initialize" do
+    it "initializes with empty sessions" do
+      expect(manager.count).to eq(0)
+    end
+  end
+
+  describe "#create_session" do
+    it "creates a new session" do
+      session = manager.create_session("user123")
+      expect(session).to be_a(DecisionAgent::Auth::Session)
+      expect(session.user_id).to eq("user123")
+    end
+
+    it "stores the session" do
+      session = manager.create_session("user123")
+      retrieved = manager.get_session(session.token)
+      expect(retrieved).to eq(session)
+    end
+
+    it "accepts custom expiration time" do
+      session = manager.create_session("user123", expires_in: 7200)
+      expect(session.expires_at).to be > Time.now.utc + 7100
+    end
+  end
+
+  describe "#get_session" do
+    it "returns session for valid token" do
+      session = manager.create_session("user123")
+      retrieved = manager.get_session(session.token)
+      expect(retrieved).to eq(session)
+    end
+
+    it "returns nil for invalid token" do
+      expect(manager.get_session("invalid_token")).to be_nil
+    end
+
+    it "returns nil for expired session" do
+      session = manager.create_session("user123", expires_in: -1)
+      expect(manager.get_session(session.token)).to be_nil
+    end
+  end
+
+  describe "#delete_session" do
+    it "deletes a session" do
+      session = manager.create_session("user123")
+      manager.delete_session(session.token)
+      expect(manager.get_session(session.token)).to be_nil
+    end
+
+    it "does not raise error for non-existent session" do
+      expect { manager.delete_session("nonexistent") }.not_to raise_error
+    end
+  end
+
+  describe "#delete_user_sessions" do
+    it "deletes all sessions for a user" do
+      session1 = manager.create_session("user123")
+      session2 = manager.create_session("user123")
+      session3 = manager.create_session("user456")
+
+      manager.delete_user_sessions("user123")
+
+      expect(manager.get_session(session1.token)).to be_nil
+      expect(manager.get_session(session2.token)).to be_nil
+      expect(manager.get_session(session3.token)).to eq(session3) # Other user's session still exists
+    end
+
+    it "does not raise error for user with no sessions" do
+      expect { manager.delete_user_sessions("nonexistent") }.not_to raise_error
+    end
+  end
+
+  describe "#cleanup_expired_sessions" do
+    it "removes expired sessions" do
+      # Create expired session
+      expired_session = manager.create_session("user123", expires_in: -1)
+      # Create valid session
+      valid_session = manager.create_session("user456", expires_in: 3600)
+
+      expect(manager.count).to eq(2)
+
+      # Force cleanup by setting last_cleanup far in the past and creating another session
+      manager.instance_variable_set(:@last_cleanup, Time.now - 400) # More than 300 seconds
+      manager.create_session("user789", expires_in: 3600)
+
+      # Expired session should be cleaned up
+      expect(manager.get_session(expired_session.token)).to be_nil
+      expect(manager.get_session(valid_session.token)).to eq(valid_session)
+    end
+
+    it "only runs cleanup after cleanup_interval" do
+      manager = DecisionAgent::Auth::SessionManager.new
+
+      # Create an expired session
+      expired_session = manager.create_session("user123", expires_in: -1)
+      expect(manager.count).to eq(1)
+
+      # The cleanup_expired_sessions is called during create_session, but it checks the interval
+      # Let's test by manually setting last_cleanup to far in the past
+      manager.instance_variable_set(:@last_cleanup, Time.now - 400) # More than 300 seconds
+      manager.create_session("user456", expires_in: 3600)
+
+      # The expired session should be cleaned up now
+      expect(manager.get_session(expired_session.token)).to be_nil
+    end
+  end
+
+  describe "#count" do
+    it "returns zero initially" do
+      expect(manager.count).to eq(0)
+    end
+
+    it "returns correct count after creating sessions" do
+      manager.create_session("user123")
+      expect(manager.count).to eq(1)
+
+      manager.create_session("user123")
+      expect(manager.count).to eq(2)
+
+      manager.create_session("user456")
+      expect(manager.count).to eq(3)
+    end
+
+    it "reflects deletions" do
+      session1 = manager.create_session("user123")
+      manager.create_session("user123")
+      expect(manager.count).to eq(2)
+
+      manager.delete_session(session1.token)
+      expect(manager.count).to eq(1)
+
+      manager.delete_user_sessions("user123")
+      expect(manager.count).to eq(0)
+    end
+
+    it "does not count expired sessions" do
+      manager.create_session("user123", expires_in: -1)
+      # Expired sessions are not counted when retrieved, but are still in storage until cleanup
+      # So count will include them until cleanup runs
+      expect(manager.count).to eq(1)
+
+      # After cleanup
+      manager.instance_variable_set(:@last_cleanup, Time.now - 400)
+      manager.create_session("user456", expires_in: 3600)
+      # Now expired session should be cleaned up
+      expect(manager.count).to eq(1)
+    end
+  end
+
+  describe "thread safety" do
+    it "handles concurrent access safely" do
+      threads = []
+      10.times do
+        threads << Thread.new do
+          10.times do
+            session = manager.create_session("user#{rand(100)}")
+            manager.get_session(session.token)
+            manager.count
+          end
+        end
+      end
+
+      threads.each(&:join)
+      expect(manager.count).to eq(100)
+    end
+  end
+end

data/spec/auth/session_spec.rb

@@ -0,0 +1,112 @@
+require "spec_helper"
+
+RSpec.describe DecisionAgent::Auth::Session do
+  describe "#initialize" do
+    it "creates a session with user_id" do
+      session = DecisionAgent::Auth::Session.new(user_id: "user123")
+      expect(session.user_id).to eq("user123")
+      expect(session.token).to be_a(String)
+      expect(session.token.length).to eq(64) # 32 bytes hex = 64 chars
+    end
+
+    it "sets expiration time" do
+      session = DecisionAgent::Auth::Session.new(user_id: "user123", expires_in: 1800)
+      expect(session.expires_at).to be > Time.now.utc
+      expect(session.expires_at).to be <= Time.now.utc + 1801
+    end
+
+    it "uses default expiration of 3600 seconds" do
+      session = DecisionAgent::Auth::Session.new(user_id: "user123")
+      expected_expiry = session.created_at + 3600
+      expect(session.expires_at).to be_within(1).of(expected_expiry)
+    end
+  end
+
+  describe "#expired?" do
+    it "returns false for valid session" do
+      session = DecisionAgent::Auth::Session.new(user_id: "user123", expires_in: 3600)
+      expect(session.expired?).to be false
+    end
+
+    it "returns true for expired session" do
+      session = DecisionAgent::Auth::Session.new(user_id: "user123", expires_in: -1)
+      expect(session.expired?).to be true
+    end
+  end
+
+  describe "#valid?" do
+    it "returns true for non-expired session" do
+      session = DecisionAgent::Auth::Session.new(user_id: "user123", expires_in: 3600)
+      expect(session.valid?).to be true
+    end
+
+    it "returns false for expired session" do
+      session = DecisionAgent::Auth::Session.new(user_id: "user123", expires_in: -1)
+      expect(session.valid?).to be false
+    end
+
+    it "returns false when expired? returns true" do
+      session = DecisionAgent::Auth::Session.new(user_id: "user123", expires_in: -1)
+      expect(session.expired?).to be true
+      expect(session.valid?).to be false
+    end
+
+    it "returns true when expired? returns false" do
+      session = DecisionAgent::Auth::Session.new(user_id: "user123", expires_in: 3600)
+      expect(session.expired?).to be false
+      expect(session.valid?).to be true
+    end
+  end
+
+  describe "#to_h" do
+    it "returns hash with all session attributes" do
+      session = DecisionAgent::Auth::Session.new(user_id: "user123", expires_in: 3600)
+      hash = session.to_h
+
+      expect(hash).to be_a(Hash)
+      expect(hash[:token]).to eq(session.token)
+      expect(hash[:user_id]).to eq("user123")
+      expect(hash[:created_at]).to be_a(String)
+      expect(hash[:expires_at]).to be_a(String)
+    end
+
+    it "serializes timestamps as ISO8601 strings" do
+      session = DecisionAgent::Auth::Session.new(user_id: "user123")
+      hash = session.to_h
+
+      expect { Time.iso8601(hash[:created_at]) }.not_to raise_error
+      expect { Time.iso8601(hash[:expires_at]) }.not_to raise_error
+    end
+
+    it "includes correct user_id" do
+      session = DecisionAgent::Auth::Session.new(user_id: "user456")
+      hash = session.to_h
+      expect(hash[:user_id]).to eq("user456")
+    end
+
+    it "includes correct token" do
+      session = DecisionAgent::Auth::Session.new(user_id: "user123")
+      hash = session.to_h
+      expect(hash[:token]).to eq(session.token)
+    end
+  end
+
+  describe "#created_at" do
+    it "is set to current UTC time" do
+      before = Time.now.utc
+      session = DecisionAgent::Auth::Session.new(user_id: "user123")
+      after = Time.now.utc
+
+      expect(session.created_at).to be >= before
+      expect(session.created_at).to be <= after
+    end
+  end
+
+  describe "#expires_at" do
+    it "is set based on expires_in parameter" do
+      session = DecisionAgent::Auth::Session.new(user_id: "user123", expires_in: 7200)
+      expected = session.created_at + 7200
+      expect(session.expires_at).to be_within(1).of(expected)
+    end
+  end
+end

data/spec/auth/user_spec.rb

@@ -0,0 +1,130 @@
+require "spec_helper"
+
+RSpec.describe DecisionAgent::Auth::User do
+  describe "#initialize" do
+    it "creates a user with email and password" do
+      user = DecisionAgent::Auth::User.new(
+        email: "test@example.com",
+        password: "password123"
+      )
+
+      expect(user.email).to eq("test@example.com")
+      expect(user.id).to be_a(String)
+      expect(user.active).to be true
+      expect(user.roles).to eq([])
+    end
+
+    it "creates a user with roles" do
+      user = DecisionAgent::Auth::User.new(
+        email: "admin@example.com",
+        password: "password123",
+        roles: %i[admin editor]
+      )
+
+      expect(user.roles).to include(:admin, :editor)
+    end
+
+    it "raises error if neither password nor password_hash provided" do
+      expect do
+        DecisionAgent::Auth::User.new(email: "test@example.com")
+      end.to raise_error(ArgumentError, /password/)
+    end
+  end
+
+  describe "#authenticate" do
+    it "returns true for correct password" do
+      user = DecisionAgent::Auth::User.new(
+        email: "test@example.com",
+        password: "password123"
+      )
+
+      expect(user.authenticate("password123")).to be true
+    end
+
+    it "returns false for incorrect password" do
+      user = DecisionAgent::Auth::User.new(
+        email: "test@example.com",
+        password: "password123"
+      )
+
+      expect(user.authenticate("wrongpassword")).to be false
+    end
+
+    it "returns false for inactive user" do
+      user = DecisionAgent::Auth::User.new(
+        email: "test@example.com",
+        password: "password123",
+        active: false
+      )
+
+      expect(user.authenticate("password123")).to be false
+    end
+  end
+
+  describe "#assign_role" do
+    it "adds a role to the user" do
+      user = DecisionAgent::Auth::User.new(
+        email: "test@example.com",
+        password: "password123"
+      )
+
+      user.assign_role(:editor)
+      expect(user.roles).to include(:editor)
+    end
+
+    it "does not add duplicate roles" do
+      user = DecisionAgent::Auth::User.new(
+        email: "test@example.com",
+        password: "password123"
+      )
+
+      user.assign_role(:editor)
+      user.assign_role(:editor)
+
+      expect(user.roles.count(:editor)).to eq(1)
+    end
+  end
+
+  describe "#remove_role" do
+    it "removes a role from the user" do
+      user = DecisionAgent::Auth::User.new(
+        email: "test@example.com",
+        password: "password123",
+        roles: %i[editor viewer]
+      )
+
+      user.remove_role(:editor)
+      expect(user.roles).not_to include(:editor)
+      expect(user.roles).to include(:viewer)
+    end
+  end
+
+  describe "#has_role?" do
+    it "returns true if user has the role" do
+      user = DecisionAgent::Auth::User.new(
+        email: "test@example.com",
+        password: "password123",
+        roles: [:editor]
+      )
+
+      expect(user.has_role?(:editor)).to be true
+      expect(user.has_role?(:admin)).to be false
+    end
+  end
+
+  describe "#to_h" do
+    it "returns a hash representation of the user" do
+      user = DecisionAgent::Auth::User.new(
+        email: "test@example.com",
+        password: "password123",
+        roles: [:editor]
+      )
+
+      hash = user.to_h
+      expect(hash[:email]).to eq("test@example.com")
+      expect(hash[:roles]).to eq(["editor"])
+      expect(hash[:active]).to be true
+      expect(hash[:id]).to be_a(String)
+    end
+  end
+end

data/spec/context_spec.rb

@@ -22,6 +22,49 @@ RSpec.describe DecisionAgent::Context do
       expect(context.to_h[:user]).to be_frozen
       expect(context.to_h[:user][:roles]).to be_frozen
     end
+
+    it "creates a copy before freezing to avoid mutating original data" do
+      original_data = { user: { name: "alice", roles: ["admin"] } }
+      original_data_id = original_data.object_id
+
+      context = DecisionAgent::Context.new(original_data)
+
+      # Should create a copy (different object_id) to avoid mutating original
+      expect(context.to_h.object_id).not_to eq(original_data_id)
+      expect(context.to_h).to be_frozen
+      expect(context.to_h[:user]).to be_frozen
+      # Original data should not be frozen
+      expect(original_data).not_to be_frozen
+    end
+
+    it "skips already frozen objects in deep_freeze" do
+      frozen_data = { user: { name: "alice", roles: ["admin"] } }
+      frozen_data.freeze
+      frozen_data[:user].freeze
+
+      context = DecisionAgent::Context.new(frozen_data)
+
+      expect(context.to_h).to be_frozen
+      expect(context.to_h[:user]).to be_frozen
+    end
+
+    it "does not freeze hash keys unnecessarily" do
+      key_symbol = :test_key
+      key_string = "test_key"
+      data = {
+        key_symbol => "value1",
+        key_string => "value2"
+      }
+
+      context = DecisionAgent::Context.new(data)
+
+      # Keys should not be frozen (they're typically symbols/strings that don't need freezing)
+      expect(context.to_h.keys.first).to eq(key_symbol)
+      expect(context.to_h.keys.last).to eq(key_string)
+      # Values should be frozen
+      expect(context.to_h[key_symbol]).to be_frozen
+      expect(context.to_h[key_string]).to be_frozen
+    end
   end
 
   describe "#[]" do

data/spec/decision_agent_spec.rb

@@ -0,0 +1,96 @@
+require "spec_helper"
+
+RSpec.describe DecisionAgent do
+  before do
+    # Reset permission_checker between tests to avoid leakage
+    DecisionAgent.permission_checker = nil
+  end
+
+  describe ".rbac_config" do
+    it "returns the global RBAC configuration" do
+      expect(DecisionAgent.rbac_config).to be_a(DecisionAgent::Auth::RbacConfig)
+    end
+  end
+
+  describe ".configure_rbac" do
+    context "with adapter_type and options" do
+      it "configures RBAC with adapter type" do
+        result = DecisionAgent.configure_rbac(:default)
+        expect(result).to be_a(DecisionAgent::Auth::RbacConfig)
+        expect(DecisionAgent.rbac_config.adapter).to be_a(DecisionAgent::Auth::RbacAdapter)
+      end
+
+      it "configures RBAC with custom options" do
+        result = DecisionAgent.configure_rbac(:custom,
+                                              can_proc: ->(_user, _permission, _resource) { true },
+                                              has_role_proc: ->(_user, _role) { false },
+                                              active_proc: ->(_user) { true })
+        expect(result).to be_a(DecisionAgent::Auth::RbacConfig)
+      end
+    end
+
+    context "with block" do
+      it "yields the config block" do
+        # Now test setting a custom adapter via block
+        custom_adapter = DecisionAgent::Auth::DefaultAdapter.new
+        result = DecisionAgent.configure_rbac do |config|
+          config.adapter = custom_adapter
+        end
+
+        expect(result).to be_a(DecisionAgent::Auth::RbacConfig)
+        expect(DecisionAgent.rbac_config.adapter).to eq(custom_adapter)
+      end
+    end
+
+    context "with no arguments" do
+      it "returns the rbac_config" do
+        result = DecisionAgent.configure_rbac
+        expect(result).to be_a(DecisionAgent::Auth::RbacConfig)
+      end
+    end
+  end
+
+  describe ".permission_checker" do
+    it "returns a PermissionChecker instance" do
+      checker = DecisionAgent.permission_checker
+      expect(checker).to be_a(DecisionAgent::Auth::PermissionChecker)
+    end
+
+    it "creates a new PermissionChecker if not set" do
+      # Reset permission_checker
+      DecisionAgent.permission_checker = nil
+      checker = DecisionAgent.permission_checker
+      expect(checker).to be_a(DecisionAgent::Auth::PermissionChecker)
+    end
+
+    it "returns the same instance on subsequent calls" do
+      checker1 = DecisionAgent.permission_checker
+      checker2 = DecisionAgent.permission_checker
+      expect(checker1).to eq(checker2)
+    end
+
+    it "uses the rbac_config adapter" do
+      DecisionAgent.configure_rbac(:default)
+      checker = DecisionAgent.permission_checker
+      adapter = checker.instance_variable_get(:@adapter)
+      expect(adapter).to be_a(DecisionAgent::Auth::RbacAdapter)
+      expect(DecisionAgent.rbac_config.adapter).to be_a(DecisionAgent::Auth::RbacAdapter)
+    end
+  end
+
+  describe ".permission_checker=" do
+    it "sets a custom permission checker" do
+      custom_checker = double("CustomChecker")
+      DecisionAgent.permission_checker = custom_checker
+      expect(DecisionAgent.permission_checker).to eq(custom_checker)
+    end
+
+    it "overrides the default permission checker" do
+      original_checker = DecisionAgent.permission_checker
+      custom_checker = double("CustomChecker")
+      DecisionAgent.permission_checker = custom_checker
+      expect(DecisionAgent.permission_checker).not_to eq(original_checker)
+      expect(DecisionAgent.permission_checker).to eq(custom_checker)
+    end
+  end
+end