@avi770/testteam 1.2.0

package/agents/__tests__/19-tenant-isolation-auditor.test.ts

@@ -0,0 +1,400 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import type { ValidatedConfig } from '../../core/config';
+import type { Phase } from '../../core/types';
+
+// ---------------------------------------------------------------------------
+// Stub config helpers
+// ---------------------------------------------------------------------------
+
+function makeConfig(overrides: Partial<ValidatedConfig> = {}): ValidatedConfig {
+  return {
+    schemaVersion: 1,
+    name: 'test',
+    auth: {
+      loginUrl: 'http://localhost/login',
+      credentials: {
+        admin: { email: 'admin@firma.com', password: 'secret' },
+      },
+    },
+    modules: [{ id: 'dashboard', route: '/dashboard', sidebarIcon: true }],
+    environments: {
+      beta: { baseUrl: 'http://localhost:3000', seed: false },
+    },
+    portals: [],
+    breakpoints: [],
+    integrations: [],
+    workers: [],
+    workflows: [],
+    accuracy: { enabled: false, decimalPrecision: 2, currencySymbol: '$', timezone: 'UTC' },
+    tenancy: {
+      enabled: true,
+      isolationField: 'firmId',
+      testFirms: ['firm-a', 'firm-b'],
+    },
+    costBudget: { maxPerRun: 100, maxPerAgent: 10, alertThreshold: 0.8, onExceeded: 'abort' },
+    agentClassification: { blocking: [], advisory: [] },
+    thresholds: {
+      unitCoverage: { lines: 80, functions: 80, branches: 80, statements: 80 },
+      lighthouse: { accessibility: 90, performance: 90, bestPractices: 90, seo: 90 },
+      apiResponseTime: 2000,
+      bundleSizeLimit: 500000,
+      maxConsoleErrors: 0,
+    },
+    disabledAgents: [],
+    disabledAgentSet: new Set<number>(),
+    ...overrides,
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Mock ApiClient
+// ---------------------------------------------------------------------------
+
+const apiClientGetMock = vi.fn();
+const apiClientPostMock = vi.fn();
+const createAuthenticatedMock = vi.fn();
+
+vi.mock('../../helpers/api-client', () => ({
+  ApiClient: class MockApiClient {
+    static createAuthenticated(...args: unknown[]) {
+      return createAuthenticatedMock(...args);
+    }
+    get(...args: unknown[]) {
+      return apiClientGetMock(...args);
+    }
+    post(...args: unknown[]) {
+      return apiClientPostMock(...args);
+    }
+  },
+}));
+
+// ---------------------------------------------------------------------------
+// Import after mocks
+// ---------------------------------------------------------------------------
+
+const { TenantIsolationAuditorAgent } = await import('../19-tenant-isolation-auditor');
+
+function createAgent(
+  config: ValidatedConfig = makeConfig(),
+  phase: Phase = 'beta',
+): InstanceType<typeof TenantIsolationAuditorAgent> {
+  return new TenantIsolationAuditorAgent(config, phase, '/tmp/test-run');
+}
+
+// Default happy-path mock responses (403 for tampering attempts)
+function mockForbiddenResponses(): void {
+  createAuthenticatedMock.mockResolvedValue({
+    get: apiClientGetMock,
+    post: apiClientPostMock,
+  });
+  apiClientGetMock.mockResolvedValue({ status: 403, body: null });
+  apiClientPostMock.mockResolvedValue({ status: 403, body: null });
+}
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+describe('TenantIsolationAuditorAgent', () => {
+  beforeEach(() => {
+    vi.resetAllMocks();
+    mockForbiddenResponses();
+  });
+
+  it('has agentId 19 and agentName "Tenant Isolation Auditor"', () => {
+    const agent = createAgent();
+    expect(agent.agentId).toBe(19);
+    expect(agent.agentName).toBe('Tenant Isolation Auditor');
+  });
+
+  // -------------------------------------------------------------------------
+  // preFlight()
+  // -------------------------------------------------------------------------
+
+  describe('preFlight()', () => {
+    it('throws when tenancy is disabled', async () => {
+      const config = makeConfig({
+        tenancy: { enabled: false, isolationField: 'firmId', testFirms: ['firm-a'] },
+      });
+      const agent = createAgent(config);
+      const result = await agent.run();
+
+      expect(result.status).toBe('failed');
+      expect(result.findings[0].description).toContain('tenancy.enabled');
+    });
+
+    it('throws when no test firms are configured', async () => {
+      const config = makeConfig({
+        tenancy: { enabled: true, isolationField: 'firmId', testFirms: [] },
+      });
+      const agent = createAgent(config);
+      const result = await agent.run();
+
+      expect(result.status).toBe('failed');
+      expect(result.findings[0].description).toContain('testFirms');
+    });
+
+    it('passes when tenancy is enabled and at least one firm is configured', async () => {
+      const agent = createAgent();
+      const result = await agent.run();
+
+      expect(result.findings.some((f) => f.description.includes('tenancy.enabled'))).toBe(false);
+    });
+  });
+
+  // -------------------------------------------------------------------------
+  // execute() — 403 responses (correct behaviour)
+  // -------------------------------------------------------------------------
+
+  describe('execute() — 403 on tampering (correct behaviour)', () => {
+    it('creates no finding when all tamper attempts return 403', async () => {
+      apiClientGetMock.mockResolvedValue({ status: 403, body: null });
+      apiClientPostMock.mockResolvedValue({ status: 403, body: null });
+
+      const agent = createAgent();
+      const result = await agent.run();
+
+      const securityFindings = result.findings.filter((f) => f.type === 'code-bug-security');
+      expect(securityFindings).toHaveLength(0);
+    });
+  });
+
+  // -------------------------------------------------------------------------
+  // execute() — URL tampering data leak
+  // -------------------------------------------------------------------------
+
+  describe('execute() — URL tampering data leak', () => {
+    it('creates a critical finding when a URL-tampered GET returns 200 with data', async () => {
+      // GET returns data for wrong firm — data leak
+      apiClientGetMock.mockResolvedValue({
+        status: 200,
+        body: [{ id: '1', firmId: 'firm-b', name: 'Firm B Client' }],
+      });
+      apiClientPostMock.mockResolvedValue({ status: 403, body: null });
+
+      const agent = createAgent();
+      const result = await agent.run();
+
+      const urlTamperFinding = result.findings.find(
+        (f) => f.id.includes('url-tamper') && f.type === 'code-bug-security',
+      );
+      expect(urlTamperFinding).toBeDefined();
+      expect(urlTamperFinding!.severity).toBe('critical');
+    });
+
+    it('creates no finding when URL-tampered GET returns 200 with empty array', async () => {
+      // Empty array — no data leak
+      apiClientGetMock.mockResolvedValue({ status: 200, body: [] });
+      apiClientPostMock.mockResolvedValue({ status: 403, body: null });
+
+      const agent = createAgent();
+      const result = await agent.run();
+
+      const urlTamperFinding = result.findings.find((f) => f.id.includes('url-tamper'));
+      expect(urlTamperFinding).toBeUndefined();
+    });
+  });
+
+  // -------------------------------------------------------------------------
+  // execute() — API parameter tampering data leak
+  // -------------------------------------------------------------------------
+
+  describe('execute() — API parameter tampering', () => {
+    it('creates a critical finding when POST with wrong firmId returns 200 with data', async () => {
+      apiClientGetMock.mockResolvedValue({ status: 403, body: null });
+      // POST returns data — data leak via parameter tampering
+      apiClientPostMock.mockResolvedValue({
+        status: 200,
+        body: [{ id: '2', firmId: 'firm-b', name: 'Invoice B' }],
+      });
+
+      const agent = createAgent();
+      const result = await agent.run();
+
+      const paramTamperFinding = result.findings.find(
+        (f) => f.id.includes('param-tamper') && f.type === 'code-bug-security',
+      );
+      expect(paramTamperFinding).toBeDefined();
+      expect(paramTamperFinding!.severity).toBe('critical');
+    });
+  });
+
+  // -------------------------------------------------------------------------
+  // execute() — search isolation
+  // -------------------------------------------------------------------------
+
+  describe('execute() — search isolation', () => {
+    it('creates a critical finding when a search for firm-b returns results while logged in as firm-a', async () => {
+      apiClientGetMock.mockResolvedValue({ status: 403, body: null });
+      // search returns results for firm-b
+      apiClientPostMock.mockImplementation(async (path: string) => {
+        if (path.includes('search')) {
+          return { status: 200, body: [{ id: '3', firmId: 'firm-b', name: 'Leaked Client' }] };
+        }
+        return { status: 403, body: null };
+      });
+
+      const agent = createAgent();
+      const result = await agent.run();
+
+      const searchFinding = result.findings.find(
+        (f) => f.id.includes('search-isolation') && f.type === 'code-bug-security',
+      );
+      expect(searchFinding).toBeDefined();
+      expect(searchFinding!.severity).toBe('critical');
+    });
+
+    it('creates no search isolation finding when search returns 0 results', async () => {
+      apiClientGetMock.mockResolvedValue({ status: 403, body: null });
+      apiClientPostMock.mockResolvedValue({ status: 200, body: [] });
+
+      const agent = createAgent();
+      const result = await agent.run();
+
+      const searchFinding = result.findings.find((f) => f.id.includes('search-isolation'));
+      expect(searchFinding).toBeUndefined();
+    });
+  });
+
+  // -------------------------------------------------------------------------
+  // execute() — auth failure
+  // -------------------------------------------------------------------------
+
+  describe('execute() — auth failure', () => {
+    it('creates a medium finding when authentication fails', async () => {
+      createAuthenticatedMock.mockRejectedValue(new Error('Invalid credentials'));
+
+      const agent = createAgent();
+      const result = await agent.run();
+
+      const authFinding = result.findings.find((f) => f.id.includes('auth-failed'));
+      expect(authFinding).toBeDefined();
+      expect(authFinding!.severity).toBe('medium');
+    });
+  });
+
+  // -------------------------------------------------------------------------
+  // No environment configured
+  // -------------------------------------------------------------------------
+
+  describe('execute() — no environment', () => {
+    it('fails or produces critical finding when no environment is configured', async () => {
+      const config = makeConfig({ environments: {} });
+      const agent = createAgent(config);
+      const result = await agent.run();
+
+      // resolveEnvironment may provide a fallback or the agent may find no env
+      expect(
+        result.status === 'failed' ||
+        result.findings.some(f => f.severity === 'critical'),
+      ).toBe(true);
+    });
+  });
+
+  // -------------------------------------------------------------------------
+  // No credentials configured
+  // -------------------------------------------------------------------------
+
+  describe('execute() — no credentials', () => {
+    it('creates a critical finding when no credentials are configured', async () => {
+      const config = makeConfig({
+        auth: { loginUrl: 'http://localhost/login', credentials: {} },
+      });
+      const agent = createAgent(config);
+      const result = await agent.run();
+
+      const finding = result.findings.find(f => f.id.includes('no-credentials'));
+      expect(finding).toBeDefined();
+      expect(finding!.severity).toBe('critical');
+    });
+  });
+
+  // -------------------------------------------------------------------------
+  // Single test firm (no firmB) — uses synthetic wrong firm
+  // -------------------------------------------------------------------------
+
+  describe('execute() — single firm config', () => {
+    it('uses synthetic wrong firm when only one test firm is configured', async () => {
+      const config = makeConfig({
+        tenancy: { enabled: true, isolationField: 'firmId', testFirms: ['firm-a'] },
+      });
+      apiClientGetMock.mockResolvedValue({ status: 403, body: null });
+      apiClientPostMock.mockResolvedValue({ status: 403, body: null });
+
+      const agent = createAgent(config);
+      const result = await agent.run();
+
+      // Should complete without findings (all tamper attempts return 403)
+      const securityFindings = result.findings.filter(f => f.type === 'code-bug-security');
+      expect(securityFindings).toHaveLength(0);
+    });
+
+    it('skips search isolation test when only one firm is configured', async () => {
+      const config = makeConfig({
+        tenancy: { enabled: true, isolationField: 'firmId', testFirms: ['firm-a'] },
+      });
+      apiClientGetMock.mockResolvedValue({ status: 403, body: null });
+      apiClientPostMock.mockResolvedValue({ status: 403, body: null });
+
+      const agent = createAgent(config);
+      const result = await agent.run();
+
+      const searchFindings = result.findings.filter(f => f.id.includes('search-isolation'));
+      expect(searchFindings).toHaveLength(0);
+    });
+  });
+
+  // -------------------------------------------------------------------------
+  // URL tampering — GET returns 200 with empty object (no data leak)
+  // -------------------------------------------------------------------------
+
+  describe('execute() — URL tampering with 200 but null body', () => {
+    it('creates no finding when URL-tampered GET returns 200 with null body', async () => {
+      apiClientGetMock.mockResolvedValue({ status: 200, body: null });
+      apiClientPostMock.mockResolvedValue({ status: 403, body: null });
+
+      const agent = createAgent();
+      const result = await agent.run();
+
+      const urlTamperFindings = result.findings.filter(f => f.id.includes('url-tamper'));
+      expect(urlTamperFindings).toHaveLength(0);
+    });
+  });
+
+  // -------------------------------------------------------------------------
+  // Network failure on tamper request — skips
+  // -------------------------------------------------------------------------
+
+  describe('execute() — network errors', () => {
+    it('skips tamper checks when API call throws', async () => {
+      apiClientGetMock.mockRejectedValue(new Error('Network error'));
+      apiClientPostMock.mockRejectedValue(new Error('Network error'));
+
+      const agent = createAgent();
+      const result = await agent.run();
+
+      const securityFindings = result.findings.filter(f => f.type === 'code-bug-security');
+      expect(securityFindings).toHaveLength(0);
+    });
+  });
+
+  // -------------------------------------------------------------------------
+  // Parameter tampering — POST returns 200 with non-array object data
+  // -------------------------------------------------------------------------
+
+  describe('execute() — parameter tampering with object body', () => {
+    it('creates a finding when POST returns 200 with object body (non-null)', async () => {
+      apiClientGetMock.mockResolvedValue({ status: 403, body: null });
+      apiClientPostMock.mockResolvedValue({
+        status: 200,
+        body: { id: '1', name: 'leaked data' },
+      });
+
+      const agent = createAgent();
+      const result = await agent.run();
+
+      const paramFindings = result.findings.filter(f => f.id.includes('param-tamper'));
+      expect(paramFindings.length).toBeGreaterThan(0);
+    });
+  });
+});