@bongos/core 1.21.177 → 1.21.179

package/tests/gate_review.mjs

@@ -1,152 +0,0 @@
-// tests/gate_review.mjs
-//
-// Unit tests for the automatic gate-surface gatekeeper classifier (ADR 0058,
-// task 1139). classifyChanges is PURE (diff-as-data in, verdict out) so the whole
-// policy — including every red-team evasion the design workflow surfaced — is a
-// regression case here. DB-free / network-free → runs in the unit gate.
-//
-// Verdicts: pass (auto-merge) | needs_trust (Metic+ auto / else escalate) | escalate
-// (hard floor — rank-independent, always pings the owner).
-//
-// Run:  node tests/gate_review.mjs
-
-import { strict as assert } from 'node:assert';
-import { createRequire } from 'node:module';
-
-const require = createRequire(import.meta.url);
-const gk = require('../scripts/bongos/gate-review.js');
-const permPath = require('../src/bongos/permission-path-check.js');
-
-let passed = 0, failed = 0;
-function test(name, fn) {
-  try { fn(); passed++; console.log(`  ok  ${name}`); }
-  catch (e) { failed++; console.log(`  FAIL ${name}\n     ${e.message}`); }
-}
-
-// Build a classifyChanges call from a compact spec.
-//   files: [{path, mode?, deleted?}]   blobs: { 'base:path':..., 'head:path':... }
-function classify(files, blobs = {}, diffBytes = 0) {
-  const blobAt = (which, p) => (Object.prototype.hasOwnProperty.call(blobs, `${which}:${p}`) ? blobs[`${which}:${p}`] : null);
-  return gk.classifyChanges({ files: files.map((f) => ({ mode: '100644', deleted: false, ...f })), blobAt, diffBytes });
-}
-const verdictOf = (...a) => classify(...a).verdict;
-
-// --- PASS: no gate surface / pure-narrowing AUTO -------------------------------------
-test('no gate surface (game/art/docs) → pass', () => {
-  assert.equal(verdictOf([{ path: 'public/game/main.js' }, { path: 'docs/foo.md' }, { path: 'art/x.png' }]), 'pass');
-});
-test('adding a new test file → pass', () => {
-  assert.equal(verdictOf([{ path: 'tests/new_thing.mjs' }], { 'head:tests/new_thing.mjs': 'test(...)' }), 'pass');
-});
-test('run-unit-tests.js REMOVING from INTEGRATION (un-mute) → pass (AUTO)', () => {
-  const base = `const INTEGRATION = new Set(['a','b']);\nconst KNOWN_FAILING = new Set(['x']);\nconst Z=1;`;
-  const head = `const INTEGRATION = new Set(['a']);\nconst KNOWN_FAILING = new Set(['x']);\nconst Z=1;`;
-  const r = classify([{ path: 'scripts/bongos/run-unit-tests.js' }], { 'base:scripts/bongos/run-unit-tests.js': base, 'head:scripts/bongos/run-unit-tests.js': head });
-  assert.equal(r.verdict, 'pass');
-  assert.deepEqual(r.autoPassed, ['scripts/bongos/run-unit-tests.js']);
-});
-test('secrets-allowlist.txt REMOVING a line (narrow) → pass (AUTO)', () => {
-  const r = classify([{ path: '.husky/secrets-allowlist.txt' }], { 'base:.husky/secrets-allowlist.txt': 'aaa\nbbb\n', 'head:.husky/secrets-allowlist.txt': 'aaa\n' });
-  assert.equal(r.verdict, 'pass');
-});
-
-// --- NEEDS_TRUST: sensitive-but-routine (rank-trustable) -----------------------------
-test('new migration → needs_trust', () => assert.equal(verdictOf([{ path: 'migrations/120_thing.sql' }]), 'needs_trust'));
-test('package.json bump → needs_trust', () => assert.equal(verdictOf([{ path: 'package.json' }]), 'needs_trust'));
-test('a route file → needs_trust', () => assert.equal(verdictOf([{ path: 'src/bongos/routes/tasks.js' }]), 'needs_trust'));
-test('server.js → needs_trust', () => assert.equal(verdictOf([{ path: 'server.js' }]), 'needs_trust'));
-test('ship.js → needs_trust', () => assert.equal(verdictOf([{ path: 'scripts/bongos/ship.js' }]), 'needs_trust'));
-test('db.js change OUTSIDE the rank-tier region → needs_trust', () => {
-  const base = `const REQUIRES_RANK_TIER = { foo: 1 };\nfunction q(){ return 1 }`;
-  const head = `const REQUIRES_RANK_TIER = { foo: 1 };\nfunction q(){ return 2 }`;
-  assert.equal(verdictOf([{ path: 'src/bongos/db.js' }], { 'base:src/bongos/db.js': base, 'head:src/bongos/db.js': head }), 'needs_trust');
-});
-test('deleting a test file → needs_trust', () => assert.equal(verdictOf([{ path: 'tests/route_rank.mjs', deleted: true }]), 'needs_trust'));
-test('shrinking a test file → needs_trust', () => {
-  assert.equal(verdictOf([{ path: 'tests/route_rank.mjs' }], { 'base:tests/route_rank.mjs': 'x'.repeat(500), 'head:tests/route_rank.mjs': 'x'.repeat(50) }), 'needs_trust');
-});
-
-// --- ESCALATE: HARD FLOOR (rank-independent) -----------------------------------------
-for (const p of [
-  'scripts/bongos/gate-review.js', 'src/bongos/permission-path-check.js', 'src/bongos/auth.js',
-  'src/bongos/route-rank-check.js', 'modules/grading/grader.js', 'modules/grading/grader-workers/narc.js',
-  'scripts/bongos/main-audit.js', 'scripts/migrate.sh', 'scripts/deploy/deploy-prod.sh',
-  'config/deploy.json', 'infra/branch-protection.json', '.github/workflows/gate-review.yml',
-  'CODEOWNERS', '.husky/pre-push', '.claude/hooks/stop-sound.js', '.claude/settings.json',
-]) {
-  test(`hard floor: ${p} → escalate`, () => assert.equal(verdictOf([{ path: p }]), 'escalate'));
-}
-test('db.js with the rank-tier region CHANGED → escalate', () => {
-  const base = `const REQUIRES_RANK_TIER = { foo: 1 };\nfunction q(){}`;
-  const head = `const REQUIRES_RANK_TIER = { foo: 4, bar: 1 };\nfunction q(){}`;
-  assert.equal(verdictOf([{ path: 'src/bongos/db.js' }], { 'base:src/bongos/db.js': base, 'head:src/bongos/db.js': head }), 'escalate');
-});
-
-// --- ESCALATE: red-team evasions -----------------------------------------------------
-test('Hole(mute): run-unit-tests.js ADDING to KNOWN_FAILING → escalate (AUTO cert fails → floor)', () => {
-  const base = `const INTEGRATION = new Set(['a']);\nconst KNOWN_FAILING = new Set(['x']);`;
-  const head = `const INTEGRATION = new Set(['a']);\nconst KNOWN_FAILING = new Set(['x','grader_panel']);`;
-  assert.equal(verdictOf([{ path: 'scripts/bongos/run-unit-tests.js' }], { 'base:scripts/bongos/run-unit-tests.js': base, 'head:scripts/bongos/run-unit-tests.js': head }), 'escalate');
-});
-test('Hole(mute): run-unit-tests.js non-set code changed → escalate', () => {
-  const base = `const INTEGRATION = new Set(['a']);\nconst KNOWN_FAILING = new Set([]);\nconst TIMEOUT=90000;`;
-  const head = `const INTEGRATION = new Set(['a']);\nconst KNOWN_FAILING = new Set([]);\nconst TIMEOUT=1;`;
-  assert.equal(verdictOf([{ path: 'scripts/bongos/run-unit-tests.js' }], { 'base:scripts/bongos/run-unit-tests.js': base, 'head:scripts/bongos/run-unit-tests.js': head }), 'escalate');
-});
-test('Hole(allowlist): secrets-allowlist.txt ADDING a broadening line → escalate', () => {
-  assert.equal(verdictOf([{ path: '.husky/secrets-allowlist.txt' }], { 'base:.husky/secrets-allowlist.txt': 'aaa\n', 'head:.husky/secrets-allowlist.txt': 'aaa\nLEAKED_KEY=.*\n' }), 'escalate');
-});
-test('Hole8: a symlink in the diff → escalate (alias evasion)', () => {
-  assert.equal(verdictOf([{ path: 'src/bongos/routes/x.js', mode: '120000' }]), 'escalate');
-});
-test('Hole6/8: a non-ASCII/homoglyph path → escalate', () => {
-  assert.equal(verdictOf([{ path: 'src/bongos/аuth.js' /* cyrillic a */ }]), 'escalate');
-});
-test('Hole10: oversize diff → escalate', () => {
-  assert.equal(verdictOf([{ path: 'public/game/main.js' }], {}, 9 * 1024 * 1024), 'escalate');
-});
-test('Hole2: editing gate-review.yml (self-neuter) → escalate', () => {
-  assert.equal(verdictOf([{ path: '.github/workflows/gate-review.yml' }]), 'escalate');
-});
-test('Hole4: adding a new middleware + editing routes.js → escalate (auth.js floor) / needs_trust (routes)', () => {
-  // routes.js is needs_trust; but pairing with a hard-floor file makes the PR escalate.
-  assert.equal(verdictOf([{ path: 'src/bongos/routes.js' }, { path: 'src/bongos/auth.js' }]), 'escalate');
-});
-
-// --- DRIFT GUARD: no PROTECTED_GLOBS entry is silently un-routed (never pass) ---------
-test('drift guard: every PROTECTED_GLOBS entry routes to escalate or needs_trust (never pass)', () => {
-  for (const glob of permPath.PROTECTED_GLOBS) {
-    // Synthesize a representative path under each glob.
-    const sample = glob.endsWith('/') ? `${glob}__sample__.js` : glob;
-    // db.js needs blobs to classify; give it a no-op (region unchanged) → needs_trust (still not pass).
-    const blobs = sample === 'src/bongos/db.js'
-      ? { 'base:src/bongos/db.js': 'const REQUIRES_RANK_TIER = {};\nx', 'head:src/bongos/db.js': 'const REQUIRES_RANK_TIER = {};\ny' }
-      : {};
-    const v = verdictOf([{ path: sample }], blobs);
-    assert.notEqual(v, 'pass', `PROTECTED glob ${glob} (sample ${sample}) classified as PASS — gate-surface leak`);
-  }
-});
-test('drift guard: every HARD_FLOOR glob is also covered by PROTECTED_GLOBS (sub-Metic floor protects the gate machinery)', () => {
-  for (const g of gk.HARD_FLOOR_GLOBS) {
-    // a floor glob must be matched by SOME protected glob (subtree-aware): a file under it is protected.
-    const sample = g.endsWith('/') ? `${g}__s__` : g;
-    assert.equal(permPath.matchProtected([sample]).length > 0, true, `hard-floor ${g} is not in PROTECTED_GLOBS`);
-  }
-});
-
-// --- resolveAction: rank clears needs_trust; ONLY an owner review clears the hard floor (task 1142) ---
-const RA = (verdict, trusted, ownerApproved) => gk.resolveAction({ verdict, trusted, ownerApproved });
-test('resolveAction: pass → pass regardless of trust', () => {
-  assert.equal(RA('pass', false, false), 'pass');
-});
-test('resolveAction: needs_trust + Metic+ attestation → pass', () => assert.equal(RA('needs_trust', true, false), 'pass'));
-test('resolveAction: needs_trust + untrusted + no approval → block', () => assert.equal(RA('needs_trust', false, false), 'block'));
-test('resolveAction: needs_trust + owner approval (untrusted) → pass', () => assert.equal(RA('needs_trust', false, true), 'pass'));
-test('resolveAction: escalate + trusted but NOT owner-approved → block (rank never clears the hard floor)', () => {
-  assert.equal(RA('escalate', true, false), 'block');
-});
-test('resolveAction: escalate + owner approval → pass (only the owner clears the floor)', () => assert.equal(RA('escalate', false, true), 'pass'));
-test('resolveAction: escalate + nothing → block', () => assert.equal(RA('escalate', false, false), 'block'));
-
-console.log(`\ngate-review (task 1139) tests: ${passed} passed, ${failed} failed`);
-process.exit(failed > 0 ? 1 : 0);