@celilo/cli 0.1.0

package/src/capabilities/validation.test.ts

@@ -0,0 +1,613 @@
+import type { Database } from 'bun:sqlite';
+import { describe, expect, test } from 'bun:test';
+import type { ModuleManifest } from '../manifest/schema';
+import { checkAllowlist, getProviderManifest, validateCapabilityAccess } from './validation';
+
+describe('Capability Access Validation', () => {
+  describe('checkAllowlist', () => {
+    test('should return true when consumer provides capability in allowlist', () => {
+      const consumerCapabilities = ['public_web'];
+      const allowlist = ['public_web', 'api_gateway'];
+
+      const result = checkAllowlist(consumerCapabilities, allowlist);
+
+      expect(result).toBe(true);
+    });
+
+    test('should return true when consumer provides multiple capabilities and one matches', () => {
+      const consumerCapabilities = ['dns_internal', 'monitoring', 'public_web'];
+      const allowlist = ['public_web', 'api_gateway'];
+
+      const result = checkAllowlist(consumerCapabilities, allowlist);
+
+      expect(result).toBe(true);
+    });
+
+    test('should return false when consumer provides no matching capability', () => {
+      const consumerCapabilities = ['monitoring', 'logging'];
+      const allowlist = ['public_web', 'api_gateway'];
+
+      const result = checkAllowlist(consumerCapabilities, allowlist);
+
+      expect(result).toBe(false);
+    });
+
+    test('should return false when consumer provides no capabilities', () => {
+      const consumerCapabilities: string[] = [];
+      const allowlist = ['public_web', 'api_gateway'];
+
+      const result = checkAllowlist(consumerCapabilities, allowlist);
+
+      expect(result).toBe(false);
+    });
+
+    test('should return false when allowlist is empty', () => {
+      const consumerCapabilities = ['public_web'];
+      const allowlist: string[] = [];
+
+      const result = checkAllowlist(consumerCapabilities, allowlist);
+
+      expect(result).toBe(false);
+    });
+
+    test('should return false when both are empty', () => {
+      const consumerCapabilities: string[] = [];
+      const allowlist: string[] = [];
+
+      const result = checkAllowlist(consumerCapabilities, allowlist);
+
+      expect(result).toBe(false);
+    });
+
+    test('should match exact capability names', () => {
+      const consumerCapabilities = ['public_web_v2'];
+      const allowlist = ['public_web'];
+
+      const result = checkAllowlist(consumerCapabilities, allowlist);
+
+      expect(result).toBe(false);
+    });
+
+    test('should be case-sensitive', () => {
+      const consumerCapabilities = ['Public_Web'];
+      const allowlist = ['public_web'];
+
+      const result = checkAllowlist(consumerCapabilities, allowlist);
+
+      expect(result).toBe(false);
+    });
+  });
+
+  describe('getProviderManifest', () => {
+    test('should return manifest when capability exists', () => {
+      const mockManifest: ModuleManifest = {
+        celilo_contract: '1.0',
+        id: 'dns-external',
+        name: 'DNS External',
+        version: '1.0.0',
+        description: 'External DNS',
+        requires: { capabilities: [] },
+        provides: {
+          capabilities: [
+            {
+              name: 'dns_external',
+              version: '1.0.0',
+              data: {},
+              secrets: [
+                {
+                  name: 'tsig',
+                  type: 'string',
+                  description: 'TSIG secret',
+                  readable_by: ['public_web'],
+                },
+              ],
+            },
+          ],
+        },
+        variables: { owns: [], imports: [] },
+      };
+
+      const mockDb = {
+        prepare: (_query: string) => ({
+          get: (capabilityName: string) => {
+            if (capabilityName === 'dns_external') {
+              return {
+                manifest_data: JSON.stringify(mockManifest),
+              };
+            }
+            return undefined;
+          },
+        }),
+      } as unknown as Database;
+
+      const result = getProviderManifest('dns_external', mockDb);
+
+      expect(result).toEqual(mockManifest);
+    });
+
+    test('should return null when capability does not exist', () => {
+      const mockDb = {
+        prepare: () => ({
+          get: () => undefined,
+        }),
+      } as unknown as Database;
+
+      const result = getProviderManifest('unknown_capability', mockDb);
+
+      expect(result).toBeNull();
+    });
+
+    test('should parse JSON manifest correctly', () => {
+      const mockManifest: ModuleManifest = {
+        celilo_contract: '1.0',
+        id: 'test-module',
+        name: 'Test Module',
+        version: '1.0.0',
+        description: 'Test',
+        requires: { capabilities: [] },
+        provides: {
+          capabilities: [
+            {
+              name: 'test_capability',
+              version: '1.0.0',
+              data: { nested: { value: 'test' } },
+            },
+          ],
+        },
+        variables: { owns: [], imports: [] },
+      };
+
+      const mockDb = {
+        prepare: () => ({
+          get: () => ({
+            manifest_data: JSON.stringify(mockManifest),
+          }),
+        }),
+      } as unknown as Database;
+
+      const result = getProviderManifest('test_capability', mockDb);
+
+      expect(result?.provides?.capabilities?.[0]?.data).toEqual({
+        nested: { value: 'test' },
+      });
+    });
+  });
+
+  describe('validateCapabilityAccess', () => {
+    test('should return success when module does not require capabilities', async () => {
+      const manifest: ModuleManifest = {
+        celilo_contract: '1.0',
+        id: 'test-module',
+        name: 'Test Module',
+        version: '1.0.0',
+        description: 'Test',
+        requires: { capabilities: [] },
+        provides: { capabilities: [] },
+        variables: { owns: [], imports: [] },
+      };
+
+      const mockDb = {} as Database;
+
+      const result = await validateCapabilityAccess(manifest, mockDb);
+
+      expect(result.success).toBe(true);
+    });
+
+    test('should return success when module requires capabilities array is empty', async () => {
+      const manifest: ModuleManifest = {
+        celilo_contract: '1.0',
+        id: 'test-module',
+        name: 'Test Module',
+        version: '1.0.0',
+        description: 'Test',
+        requires: {
+          capabilities: [],
+        },
+        provides: { capabilities: [] },
+        variables: { owns: [], imports: [] },
+      };
+
+      const mockDb = {} as Database;
+
+      const result = await validateCapabilityAccess(manifest, mockDb);
+
+      expect(result.success).toBe(true);
+    });
+
+    test('should return error when required capability not found', async () => {
+      const manifest: ModuleManifest = {
+        celilo_contract: '1.0',
+        id: 'caddy',
+        name: 'Caddy',
+        version: '1.0.0',
+        description: 'Web server',
+        requires: {
+          capabilities: [{ name: 'dns_external', version: '1.0.0' }],
+        },
+        provides: { capabilities: [] },
+        variables: { owns: [], imports: [] },
+      };
+
+      const mockDb = {
+        prepare: () => ({
+          get: () => undefined,
+        }),
+      } as unknown as Database;
+
+      const result = await validateCapabilityAccess(manifest, mockDb);
+
+      expect(result.success).toBe(false);
+      expect(result.error).toContain("Required capability 'dns_external' not found");
+      expect(result.error).toContain('No module provides this capability');
+    });
+
+    test('should return success when capability has no secrets', async () => {
+      const manifest: ModuleManifest = {
+        celilo_contract: '1.0',
+        id: 'consumer',
+        name: 'Consumer',
+        version: '1.0.0',
+        description: 'Test',
+        requires: {
+          capabilities: [{ name: 'monitoring', version: '1.0.0' }],
+        },
+        provides: { capabilities: [] },
+        variables: { owns: [], imports: [] },
+      };
+
+      const providerManifest: ModuleManifest = {
+        celilo_contract: '1.0',
+        id: 'provider',
+        name: 'Provider',
+        version: '1.0.0',
+        description: 'Test',
+        requires: { capabilities: [] },
+        provides: {
+          capabilities: [
+            {
+              name: 'monitoring',
+              version: '1.0.0',
+              data: {},
+            },
+          ],
+        },
+        variables: { owns: [], imports: [] },
+      };
+
+      const mockDb = {
+        prepare: () => ({
+          get: () => ({
+            manifest_data: JSON.stringify(providerManifest),
+          }),
+        }),
+      } as unknown as Database;
+
+      const result = await validateCapabilityAccess(manifest, mockDb);
+
+      expect(result.success).toBe(true);
+    });
+
+    test('should return success when secret has no readable_by restriction', async () => {
+      const manifest: ModuleManifest = {
+        celilo_contract: '1.0',
+        id: 'consumer',
+        name: 'Consumer',
+        version: '1.0.0',
+        description: 'Test',
+        requires: {
+          capabilities: [{ name: 'dns_external', version: '1.0.0' }],
+        },
+        provides: { capabilities: [] },
+        variables: { owns: [], imports: [] },
+      };
+
+      const providerManifest: ModuleManifest = {
+        celilo_contract: '1.0',
+        id: 'dns-external',
+        name: 'DNS External',
+        version: '1.0.0',
+        description: 'Test',
+        requires: { capabilities: [] },
+        provides: {
+          capabilities: [
+            {
+              name: 'dns_external',
+              version: '1.0.0',
+              data: {},
+              secrets: [
+                {
+                  name: 'api_key',
+                  type: 'string',
+                  description: 'API key',
+                  // No readable_by - accessible to all
+                },
+              ],
+            },
+          ],
+        },
+        variables: { owns: [], imports: [] },
+      };
+
+      const mockDb = {
+        prepare: () => ({
+          get: () => ({
+            manifest_data: JSON.stringify(providerManifest),
+          }),
+        }),
+      } as unknown as Database;
+
+      const result = await validateCapabilityAccess(manifest, mockDb);
+
+      expect(result.success).toBe(true);
+    });
+
+    test('should return success when consumer matches allowlist', async () => {
+      const manifest: ModuleManifest = {
+        celilo_contract: '1.0',
+        id: 'caddy',
+        name: 'Caddy',
+        version: '1.0.0',
+        description: 'Web server',
+        requires: {
+          capabilities: [{ name: 'dns_external', version: '1.0.0' }],
+        },
+        provides: {
+          capabilities: [
+            {
+              name: 'public_web',
+              version: '1.0.0',
+              data: {},
+            },
+          ],
+        },
+        variables: { owns: [], imports: [] },
+      };
+
+      const providerManifest: ModuleManifest = {
+        celilo_contract: '1.0',
+        id: 'dns-external',
+        name: 'DNS External',
+        version: '1.0.0',
+        description: 'Test',
+        requires: { capabilities: [] },
+        provides: {
+          capabilities: [
+            {
+              name: 'dns_external',
+              version: '1.0.0',
+              data: {},
+              secrets: [
+                {
+                  name: 'tsig',
+                  type: 'string',
+                  description: 'TSIG secret',
+                  readable_by: ['public_web'],
+                },
+              ],
+            },
+          ],
+        },
+        variables: { owns: [], imports: [] },
+      };
+
+      const mockDb = {
+        prepare: () => ({
+          get: () => ({
+            manifest_data: JSON.stringify(providerManifest),
+          }),
+        }),
+      } as unknown as Database;
+
+      const result = await validateCapabilityAccess(manifest, mockDb);
+
+      expect(result.success).toBe(true);
+    });
+
+    test('should return error when consumer does not match allowlist', async () => {
+      const manifest: ModuleManifest = {
+        celilo_contract: '1.0',
+        id: 'some-app',
+        name: 'Some App',
+        version: '1.0.0',
+        description: 'Test',
+        requires: {
+          capabilities: [{ name: 'dns_external', version: '1.0.0' }],
+        },
+        provides: {
+          capabilities: [
+            {
+              name: 'monitoring',
+              version: '1.0.0',
+              data: {},
+            },
+          ],
+        },
+        variables: { owns: [], imports: [] },
+      };
+
+      const providerManifest: ModuleManifest = {
+        celilo_contract: '1.0',
+        id: 'dns-external',
+        name: 'DNS External',
+        version: '1.0.0',
+        description: 'Test',
+        requires: { capabilities: [] },
+        provides: {
+          capabilities: [
+            {
+              name: 'dns_external',
+              version: '1.0.0',
+              data: {},
+              secrets: [
+                {
+                  name: 'tsig',
+                  type: 'string',
+                  description: 'TSIG secret',
+                  readable_by: ['public_web'],
+                },
+              ],
+            },
+          ],
+        },
+        variables: { owns: [], imports: [] },
+      };
+
+      const mockDb = {
+        prepare: () => ({
+          get: () => ({
+            manifest_data: JSON.stringify(providerManifest),
+          }),
+        }),
+      } as unknown as Database;
+
+      const result = await validateCapabilityAccess(manifest, mockDb);
+
+      expect(result.success).toBe(false);
+      expect(result.error).toContain("Module 'some-app' cannot access secret 'tsig'");
+      expect(result.error).toContain("capability 'dns_external'");
+      expect(result.error).toContain('only allows access to modules that provide: public_web');
+      expect(result.error).toContain('This module provides: monitoring');
+    });
+
+    test('should return error when consumer provides no capabilities', async () => {
+      const manifest: ModuleManifest = {
+        celilo_contract: '1.0',
+        id: 'consumer',
+        name: 'Consumer',
+        version: '1.0.0',
+        description: 'Test',
+        requires: {
+          capabilities: [{ name: 'dns_external', version: '1.0.0' }],
+        },
+        provides: { capabilities: [] }, // No provides section - empty
+        variables: { owns: [], imports: [] },
+      };
+
+      const providerManifest: ModuleManifest = {
+        celilo_contract: '1.0',
+        id: 'dns-external',
+        name: 'DNS External',
+        version: '1.0.0',
+        description: 'Test',
+        requires: { capabilities: [] },
+        provides: {
+          capabilities: [
+            {
+              name: 'dns_external',
+              version: '1.0.0',
+              data: {},
+              secrets: [
+                {
+                  name: 'tsig',
+                  type: 'string',
+                  description: 'TSIG secret',
+                  readable_by: ['public_web'],
+                },
+              ],
+            },
+          ],
+        },
+        variables: { owns: [], imports: [] },
+      };
+
+      const mockDb = {
+        prepare: () => ({
+          get: () => ({
+            manifest_data: JSON.stringify(providerManifest),
+          }),
+        }),
+      } as unknown as Database;
+
+      const result = await validateCapabilityAccess(manifest, mockDb);
+
+      expect(result.success).toBe(false);
+      expect(result.error).toContain('This module provides: (none)');
+    });
+
+    test('should validate all required capabilities', async () => {
+      const manifest: ModuleManifest = {
+        celilo_contract: '1.0',
+        id: 'complex-app',
+        name: 'Complex App',
+        version: '1.0.0',
+        description: 'Test',
+        requires: {
+          capabilities: [
+            { name: 'dns_external', version: '1.0.0' },
+            { name: 'database', version: '1.0.0' },
+          ],
+        },
+        provides: {
+          capabilities: [
+            {
+              name: 'public_web',
+              version: '1.0.0',
+              data: {},
+            },
+          ],
+        },
+        variables: { owns: [], imports: [] },
+      };
+
+      let callCount = 0;
+      const mockDb = {
+        prepare: () => ({
+          get: (capabilityName: string) => {
+            callCount++;
+            if (capabilityName === 'dns_external') {
+              return {
+                manifest_data: JSON.stringify({
+                  id: 'dns-external',
+                  name: 'DNS',
+                  version: '1.0.0',
+                  description: 'Test',
+                  provides: {
+                    capabilities: [
+                      {
+                        name: 'dns_external',
+                        version: '1.0.0',
+                        data: {},
+                        secrets: [
+                          {
+                            name: 'tsig',
+                            type: 'string',
+                            readable_by: ['public_web'],
+                          },
+                        ],
+                      },
+                    ],
+                  },
+                }),
+              };
+            }
+            if (capabilityName === 'database') {
+              return {
+                manifest_data: JSON.stringify({
+                  id: 'postgres',
+                  name: 'PostgreSQL',
+                  version: '1.0.0',
+                  description: 'Test',
+                  provides: {
+                    capabilities: [
+                      {
+                        name: 'database',
+                        version: '1.0.0',
+                        data: {},
+                      },
+                    ],
+                  },
+                }),
+              };
+            }
+            return undefined;
+          },
+        }),
+      } as unknown as Database;
+
+      const result = await validateCapabilityAccess(manifest, mockDb);
+
+      expect(result.success).toBe(true);
+      expect(callCount).toBe(2); // Should query both capabilities
+    });
+  });
+});