@claude-flow/security 3.0.0-alpha.1 → 3.0.0-alpha.11

package/__tests__/authorization-propagator.test.ts

@@ -0,0 +1,155 @@
+/**
+ * Tests for AgentAuthorizationPropagator (ADR-144 P1, ruvnet/ruflo#2248).
+ *
+ * Covers the load-bearing invariants of the action-layer security model:
+ *  - wrapOutbound monotonically reduces scope (cannot grant more than holder)
+ *  - delegationDepth decrements by ≥ 1 every hop; depth-0 cannot delegate
+ *  - expired scopes are rejected at wrap and at check
+ *  - checkToolCall returns stable, telemetry-friendly reasons
+ *  - verifyServerAuth rejects empty / nullish credentials
+ *  - provenance buffer ring-bound at the configured max
+ *  - legacy permissive scope (the migration shim) allows everything
+ */
+
+import { describe, it, expect } from 'vitest';
+import {
+  AgentAuthorizationPropagator,
+  AuthorizationPropagationError,
+  makeLegacyPermissiveScope,
+  type AuthScope,
+} from '../src/authorization/propagator.js';
+
+const FAR_FUTURE = Date.now() + 60 * 60 * 1000; // 1 hour from now
+
+function scope(overrides: Partial<AuthScope> = {}): AuthScope {
+  return {
+    principalId: 'principal-A',
+    grantedTools: ['memory_store', 'memory_search'],
+    grantedServers: ['server-1'],
+    delegationDepth: 3,
+    expiresAt: FAR_FUTURE,
+    ...overrides,
+  };
+}
+
+describe('wrapOutbound — scope reduction invariants', () => {
+  const prop = new AgentAuthorizationPropagator();
+
+  it('decrements delegationDepth by exactly 1', () => {
+    const env = prop.wrapOutbound({ msg: 'hi' }, scope({ delegationDepth: 3 }));
+    expect(env.scope.delegationDepth).toBe(2);
+  });
+
+  it('refuses to delegate when depth has been exhausted', () => {
+    expect(() =>
+      prop.wrapOutbound({ msg: 'hi' }, scope({ delegationDepth: 0 })),
+    ).toThrow(AuthorizationPropagationError);
+  });
+
+  it('refuses to grant a tool not held by the parent scope', () => {
+    expect(() =>
+      prop.wrapOutbound({}, scope(), { tools: ['memory_store', 'task_create'] }),
+    ).toThrow(/cannot grant tools 'task_create'/);
+  });
+
+  it('allows a strict subset of the parent tool set', () => {
+    const env = prop.wrapOutbound({}, scope(), { tools: ['memory_store'] });
+    expect(env.scope.grantedTools).toEqual(['memory_store']);
+  });
+
+  it('preserves principalId across the hop', () => {
+    const env = prop.wrapOutbound({}, scope({ principalId: 'principal-X' }));
+    expect(env.scope.principalId).toBe('principal-X');
+  });
+
+  it('rejects an expired holder scope', () => {
+    expect(() =>
+      prop.wrapOutbound({}, scope({ expiresAt: 1 })),
+    ).toThrow(/scope expired/);
+  });
+
+  it('passes the payload through untouched', () => {
+    const payload = { kind: 'design', body: { topic: 'auth' } };
+    const env = prop.wrapOutbound(payload, scope());
+    expect(env.payload).toBe(payload);
+  });
+
+  it('a wildcard parent scope can grant any specific tool', () => {
+    const env = prop.wrapOutbound({}, makeLegacyPermissiveScope(), {
+      tools: ['memory_store', 'task_create'],
+    });
+    expect(env.scope.grantedTools).toEqual(['memory_store', 'task_create']);
+  });
+});
+
+describe('checkToolCall — typed decisions', () => {
+  const prop = new AgentAuthorizationPropagator();
+
+  it('allows a tool that is in scope', () => {
+    expect(prop.checkToolCall('memory_store', scope())).toEqual({ allowed: true });
+  });
+
+  it('denies a tool not in scope with stable reason', () => {
+    expect(prop.checkToolCall('shell_exec', scope())).toEqual({
+      allowed: false,
+      reason: 'tool-not-in-scope',
+    });
+  });
+
+  it('denies when the named server is not in scope', () => {
+    expect(
+      prop.checkToolCall('memory_store', scope(), { serverId: 'untrusted' }),
+    ).toEqual({ allowed: false, reason: 'server-not-in-scope' });
+  });
+
+  it('denies an expired scope deterministically (fixed-now)', () => {
+    const expired = scope({ expiresAt: 1000 });
+    expect(prop.checkToolCall('memory_store', expired, { now: 2000 })).toEqual({
+      allowed: false,
+      reason: 'scope-expired',
+    });
+  });
+});
+
+describe('verifyServerAuth — fail-closed on missing credentials', () => {
+  const prop = new AgentAuthorizationPropagator();
+
+  it('rejects missing credential', () => {
+    expect(prop.verifyServerAuth('s1', null)).toBe(false);
+    expect(prop.verifyServerAuth('s1', undefined)).toBe(false);
+  });
+
+  it('rejects empty-string credential', () => {
+    expect(prop.verifyServerAuth('s1', '')).toBe(false);
+    expect(prop.verifyServerAuth('s1', '   ')).toBe(false);
+  });
+
+  it('rejects missing serverId', () => {
+    expect(prop.verifyServerAuth('', 'token')).toBe(false);
+  });
+
+  it('accepts a non-empty credential (P1 permissive default)', () => {
+    expect(prop.verifyServerAuth('s1', 'oauth-token-xyz')).toBe(true);
+  });
+});
+
+describe('provenance buffer', () => {
+  it('retains recorded actions in insertion order', () => {
+    const p = new AgentAuthorizationPropagator();
+    p.recordAction('agent-A', 'memory_store', scope(), 'allowed');
+    p.recordAction('agent-B', 'shell_exec', scope(), 'denied', 'tool-not-in-scope');
+    const log = p.getProvenance();
+    expect(log).toHaveLength(2);
+    expect(log[0]?.outcome).toBe('allowed');
+    expect(log[1]?.reason).toBe('tool-not-in-scope');
+  });
+
+  it('ring-bounds at the configured max', () => {
+    const p = new AgentAuthorizationPropagator({ provenanceBufferMax: 3 });
+    for (let i = 0; i < 5; i++) p.recordAction('a', 't', scope(), 'allowed', `i=${i}`);
+    const log = p.getProvenance();
+    expect(log).toHaveLength(3);
+    expect(log[0]?.reason).toBe('i=2');
+    expect(log[2]?.reason).toBe('i=4');
+  });
+});