@andares/pi-toolkits 0.7.3 → 0.9.0

package/src/features/permission/units.test.ts

@@ -0,0 +1,205 @@
+/**
+ * Bash decomposition: segments, wrappers, substitution, cd folding, redirects,
+ * read/write classification, and the fail-closed cases.
+ */
+import { homedir } from "node:os";
+import { describe, expect, it } from "vitest";
+import { parseCommandUnits, stripHeredocs, type CommandUnit } from "./units.js";
+
+const CWD = "/proj";
+const HOME = homedir();
+
+function summary(command: string) {
+	return parseCommandUnits(command, CWD).map((unit) => ({
+		command: unit.command,
+		head: unit.headWord,
+		effect: unit.effect,
+		opaque: unit.opaque,
+		base: unit.base,
+		targets: unit.targets.map((target) => `${target.effect}:${target.path}`),
+	}));
+}
+
+function first(command: string): CommandUnit {
+	return parseCommandUnits(command, CWD)[0];
+}
+
+describe("segments and cd folding", () => {
+	it("splits on && and folds cd into the following command", () => {
+		const units = summary("cd /tmp && rm x");
+		expect(units).toHaveLength(2);
+		expect(units[0]).toMatchObject({ command: "cd", base: CWD, targets: ["read:/tmp"] });
+		expect(units[1]).toMatchObject({ command: "rm", base: "/tmp", targets: ["write:/tmp/x"] });
+	});
+
+	it("splits pipelines and keeps quoted operators as data", () => {
+		expect(summary("cat a | grep x")).toHaveLength(2);
+		expect(summary('echo "a && b"')).toHaveLength(1);
+	});
+
+	it("strips leading VAR=value assignments", () => {
+		expect(first("FOO=bar rm x").command).toBe("rm");
+		expect(first("FOO=bar rm x").headWord).toBe("rm");
+	});
+
+	it("returns no units for an empty command", () => {
+		expect(parseCommandUnits("   ", CWD)).toEqual([]);
+	});
+});
+
+describe("wrappers and nested execution", () => {
+	it("peels sudo and keeps the wrapper visible", () => {
+		const unit = first("sudo -u root rm -rf /");
+		expect(unit).toMatchObject({ command: "rm", headWord: "sudo" });
+		expect(unit.targets).toEqual([{ path: "/", effect: "write", source: "operand" }]);
+	});
+
+	it("peels xargs and env", () => {
+		expect(first("xargs -I{} rm {}").command).toBe("rm");
+		expect(first("env FOO=bar rm x").command).toBe("rm");
+	});
+
+	it("recurses into bash -c payloads", () => {
+		const unit = first("bash -c 'rm -rf /tmp/x'");
+		expect(unit).toMatchObject({ command: "rm", opaque: false });
+		expect(unit.targets[0]?.path).toBe("/tmp/x");
+	});
+
+	it("finds a substitution inside a quoted word", () => {
+		const units = summary('echo "x$(rm y)"');
+		expect(units[0]).toMatchObject({ command: "rm", targets: ["write:/proj/y"] });
+		expect(units[1]?.command).toBe("echo");
+	});
+
+	it("recurses into command substitution", () => {
+		const units = summary("echo $(rm -rf /tmp/x)");
+		expect(units[0]).toMatchObject({
+			command: "rm",
+			effect: "write",
+			targets: ["write:/tmp/x"],
+		});
+		expect(units[1]).toMatchObject({ command: "echo", effect: "read" });
+	});
+
+	it("recurses into find -exec", () => {
+		const units = summary("find . -name x -exec rm {} \\;");
+		expect(units.map((unit) => unit.command)).toContain("rm");
+	});
+});
+
+describe("redirects and heredocs", () => {
+	it("classifies redirect targets and ignores /dev/null", () => {
+		expect(summary("ls 2>/dev/null")[0]?.targets).toEqual([]);
+		expect(summary("echo hi > /tmp/x")[0]?.targets).toEqual(["write:/tmp/x"]);
+		expect(summary("cat < input > output")[0]?.targets).toEqual([
+			"read:/proj/input",
+			"write:/proj/output",
+		]);
+	});
+
+	it("treats a redirect to a credential path as a write to it", () => {
+		expect(summary("echo a > ~/.ssh/authorized_keys")[0]?.targets).toEqual([
+			`write:${HOME}/.ssh/authorized_keys`,
+		]);
+	});
+
+	it("keeps the redirect target as the target, not the command name", () => {
+		expect(summary("ls > out.txt")[0]?.targets).toEqual(["write:/proj/out.txt"]);
+		expect(summary("ls >> out.txt")[0]?.targets).toEqual(["write:/proj/out.txt"]);
+		expect(summary("ls 2> err.txt")[0]?.targets).toEqual(["write:/proj/err.txt"]);
+	});
+
+	it("strips heredoc bodies and keeps the redirect", () => {
+		const unit = first("cat > f <<EOF\nhello\nEOF");
+		expect(unit).toMatchObject({ command: "cat", effect: "write" });
+		expect(unit.targets).toEqual([{ path: "/proj/f", effect: "write", source: "redirect" }]);
+	});
+
+	it("marks an unterminated heredoc opaque", () => {
+		expect(stripHeredocs("cat <<EOF\nunterminated")).toBeUndefined();
+		expect(first("cat <<EOF\nunterminated").opaque).toBe(true);
+	});
+});
+
+describe("read/write classification", () => {
+	it("knows read and write commands", () => {
+		expect(first("git log").effect).toBe("read");
+		expect(first("git push").effect).toBe("write");
+		expect(first("pnpm view react").effect).toBe("read");
+		expect(first("pnpm install").effect).toBe("write");
+		expect(first("cat notes.txt").effect).toBe("read");
+	});
+
+	it("withdraws a read claim for write-capable options", () => {
+		const sed = first("sed -i s/a/b/ f.txt");
+		expect(sed.effect).toBe("write");
+		expect(sed.targets).toEqual([
+			{ path: "/proj/f.txt", effect: "write", source: "operand" },
+		]);
+		expect(first("sort -o out.txt f").targets).toEqual([
+			{ path: "/proj/out.txt", effect: "write", source: "operand" },
+		]);
+	});
+
+	it("treats unknown commands as writes", () => {
+		expect(first("frobnicate x").effect).toBe("write");
+	});
+});
+
+describe("paths", () => {
+	it("treats rm/mv/cp operands as targets even when bare", () => {
+		expect(summary("rm notes.txt")[0]?.targets).toEqual(["write:/proj/notes.txt"]);
+		expect(summary("cp a b")[0]?.targets).toEqual(["write:/proj/a", "write:/proj/b"]);
+	});
+
+	it("resolves git -C against the -C directory, not the base", () => {
+		expect(summary("git -C ../other log")[0]?.targets).toEqual([
+			"read:/other",
+		]);
+		expect(summary("git -C /tmp log")[0]?.targets).toEqual(["read:/tmp"]);
+		expect(summary("git -C \"$DIR\" log")[0]?.opaque).toBe(true);
+	});
+
+	it("collapses a glob to the directory it expands in", () => {
+		expect(summary("rm -rf *")[0]?.targets).toEqual([`write:${CWD}`]);
+	});
+
+	it("does not treat URLs as paths", () => {
+		expect(summary("curl -o /tmp/x https://example.com/a")[0]?.targets).toEqual([
+			"write:/tmp/x",
+		]);
+	});
+
+	it("expands ~ while parsing", () => {
+		expect(summary("tee ~/x")[0]?.targets).toEqual([`write:${HOME}/x`]);
+	});
+});
+
+describe("fail closed", () => {
+	it("marks an unresolved variable in a path position opaque", () => {
+		expect(summary("echo $UNKNOWN/x")).toEqual([
+			expect.objectContaining({ opaque: true, targets: [] }),
+		]);
+	});
+
+	it("marks a non-literal cd and its following relative command opaque", () => {
+		const units = summary('cd "$DIR" && rm x');
+		expect(units[0]?.opaque).toBe(true);
+		expect(units[1]?.opaque).toBe(true);
+		expect(units[1]?.base).toBeNull();
+	});
+
+	it("ignores comments, including apostrophes inside them", () => {
+		expect(first("echo hi # it's fine").opaque).toBe(false);
+		expect(first("echo hi # a 'quote").opaque).toBe(false);
+		expect(first("echo hi # x '").targets).toEqual([]);
+	});
+
+	it("marks unbalanced quoting opaque", () => {
+		expect(first('echo "unclosed').opaque).toBe(true);
+	});
+
+	it("marks a non-literal shell payload opaque", () => {
+		expect(first('bash -c "$CMD"').opaque).toBe(true);
+	});
+});