@fulcrum-governance/sdk 0.1.1 → 0.1.3

package/dist/instrumentation/__tests__/autoGovern.test.js

@@ -0,0 +1,416 @@
+"use strict";
+/**
+ * Comprehensive unit tests for autoGovern module.
+ * Tests cover: activate/deactivate lifecycle, patching, metrics, fail-safe behavior.
+ * Target: >90% coverage
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const autoGovern = __importStar(require("../autoGovern"));
+// Mock console methods
+const consoleWarnSpy = jest.spyOn(console, 'warn').mockImplementation();
+const consoleInfoSpy = jest.spyOn(console, 'info').mockImplementation();
+const consoleDebugSpy = jest.spyOn(console, 'debug').mockImplementation();
+describe('autoGovern', () => {
+    beforeEach(() => {
+        jest.clearAllMocks();
+    });
+    afterEach(() => {
+        // Ensure deactivation after each test
+        if (autoGovern.isActive()) {
+            autoGovern.deactivate();
+        }
+    });
+    afterAll(() => {
+        consoleWarnSpy.mockRestore();
+        consoleInfoSpy.mockRestore();
+        consoleDebugSpy.mockRestore();
+    });
+    describe('activate', () => {
+        it('should activate governance', () => {
+            autoGovern.activate({ apiKey: 'test-key', tenantId: 'test-tenant' });
+            expect(autoGovern.isActive()).toBe(true);
+            expect(autoGovern.getEvaluator()).not.toBeNull();
+            expect(autoGovern.getConfig()).not.toBeNull();
+        });
+        it('should start the evaluator', () => {
+            autoGovern.activate({ apiKey: 'test-key', tenantId: 'test-tenant' });
+            const evaluator = autoGovern.getEvaluator();
+            expect(evaluator).not.toBeNull();
+            expect(evaluator.running).toBe(true);
+        });
+        it('should use default config when not provided', () => {
+            autoGovern.activate();
+            const config = autoGovern.getConfig();
+            expect(config).not.toBeNull();
+            expect(config.serverUrl).toBe('https://api.fulcrumlayer.io');
+        });
+        it('should merge user config with defaults', () => {
+            autoGovern.activate({
+                apiKey: 'custom-key',
+                tenantId: 'custom-tenant',
+                policySyncInterval: 60,
+            });
+            const config = autoGovern.getConfig();
+            expect(config.apiKey).toBe('custom-key');
+            expect(config.tenantId).toBe('custom-tenant');
+            expect(config.policySyncInterval).toBe(60);
+        });
+        it('should warn when already active', () => {
+            autoGovern.activate({ apiKey: 'test-key', tenantId: 'test-tenant' });
+            autoGovern.activate({ apiKey: 'test-key', tenantId: 'test-tenant' });
+            expect(consoleWarnSpy).toHaveBeenCalledWith(expect.stringContaining('already active'));
+        });
+        it('should warn when api key not set', () => {
+            autoGovern.activate({ tenantId: 'test-tenant' });
+            expect(consoleWarnSpy).toHaveBeenCalledWith(expect.stringContaining('api_key not set'));
+        });
+        it('should warn when tenant id not set', () => {
+            autoGovern.activate({ apiKey: 'test-key' });
+            expect(consoleWarnSpy).toHaveBeenCalledWith(expect.stringContaining('tenant_id not set'));
+        });
+        it('should log activation message', () => {
+            autoGovern.activate({ apiKey: 'test-key', tenantId: 'test-tenant' });
+            expect(consoleInfoSpy).toHaveBeenCalledWith(expect.stringContaining('Governance activated'));
+        });
+    });
+    describe('deactivate', () => {
+        it('should deactivate governance', () => {
+            autoGovern.activate({ apiKey: 'test-key', tenantId: 'test-tenant' });
+            autoGovern.deactivate();
+            expect(autoGovern.isActive()).toBe(false);
+            expect(autoGovern.getEvaluator()).toBeNull();
+            expect(autoGovern.getConfig()).toBeNull();
+        });
+        it('should stop the evaluator', () => {
+            autoGovern.activate({ apiKey: 'test-key', tenantId: 'test-tenant' });
+            const evaluator = autoGovern.getEvaluator();
+            autoGovern.deactivate();
+            expect(evaluator.running).toBe(false);
+        });
+        it('should be idempotent when not active', () => {
+            // Should not throw
+            expect(() => autoGovern.deactivate()).not.toThrow();
+        });
+        it('should log deactivation message', () => {
+            autoGovern.activate({ apiKey: 'test-key', tenantId: 'test-tenant' });
+            autoGovern.deactivate();
+            expect(consoleInfoSpy).toHaveBeenCalledWith(expect.stringContaining('Governance deactivated'));
+        });
+    });
+    describe('isActive', () => {
+        it('should return false initially', () => {
+            expect(autoGovern.isActive()).toBe(false);
+        });
+        it('should return true after activation', () => {
+            autoGovern.activate({ apiKey: 'test-key', tenantId: 'test-tenant' });
+            expect(autoGovern.isActive()).toBe(true);
+        });
+        it('should return false after deactivation', () => {
+            autoGovern.activate({ apiKey: 'test-key', tenantId: 'test-tenant' });
+            autoGovern.deactivate();
+            expect(autoGovern.isActive()).toBe(false);
+        });
+    });
+    describe('getEvaluator', () => {
+        it('should return null when not active', () => {
+            expect(autoGovern.getEvaluator()).toBeNull();
+        });
+        it('should return evaluator when active', () => {
+            autoGovern.activate({ apiKey: 'test-key', tenantId: 'test-tenant' });
+            expect(autoGovern.getEvaluator()).not.toBeNull();
+        });
+    });
+    describe('getConfig', () => {
+        it('should return null when not active', () => {
+            expect(autoGovern.getConfig()).toBeNull();
+        });
+        it('should return config when active', () => {
+            autoGovern.activate({ apiKey: 'test-key', tenantId: 'test-tenant' });
+            expect(autoGovern.getConfig()).not.toBeNull();
+        });
+    });
+    describe('metrics', () => {
+        it('should initialize metrics counters', () => {
+            const metrics = autoGovern.getMetrics();
+            expect(metrics.governedCalls).toBe(0);
+            expect(metrics.ungovernedCalls).toBe(0);
+            expect(metrics.deniedCalls).toBe(0);
+            expect(metrics.allowedCalls).toBe(0);
+            expect(metrics.patchFailures).toBe(0);
+        });
+        it('should record metrics', () => {
+            const before = autoGovern.getMetrics();
+            autoGovern.recordMetric('governedCalls', 5);
+            autoGovern.recordMetric('allowedCalls', 3);
+            const after = autoGovern.getMetrics();
+            expect(after.governedCalls).toBe(before.governedCalls + 5);
+            expect(after.allowedCalls).toBe(before.allowedCalls + 3);
+        });
+        it('should increment metrics by 1 when no increment specified', () => {
+            const before = autoGovern.getMetrics();
+            autoGovern.recordMetric('governedCalls');
+            const after = autoGovern.getMetrics();
+            expect(after.governedCalls).toBe(before.governedCalls + 1);
+        });
+        it('should return copy of metrics', () => {
+            const metrics1 = autoGovern.getMetrics();
+            const metrics2 = autoGovern.getMetrics();
+            expect(metrics1).not.toBe(metrics2);
+            expect(metrics1).toEqual(metrics2);
+        });
+    });
+    describe('evaluateCall', () => {
+        it('should allow when evaluator not initialized', () => {
+            const decision = autoGovern.evaluateCall('test_tool', 'test_action');
+            expect(decision.action).toBe('allow');
+            expect(decision.reason).toContain('not initialized');
+        });
+        it('should record ungoverned call metric when evaluator not initialized', () => {
+            const before = autoGovern.getMetrics();
+            autoGovern.evaluateCall('test_tool', 'test_action');
+            const after = autoGovern.getMetrics();
+            expect(after.ungovernedCalls).toBe(before.ungovernedCalls + 1);
+        });
+        it('should evaluate with active evaluator', () => {
+            autoGovern.activate({ apiKey: 'test-key', tenantId: 'test-tenant' });
+            const decision = autoGovern.evaluateCall('test_tool', 'test_action');
+            // Should allow by default (no policies)
+            expect(decision.action).toBe('allow');
+        });
+        it('should record governed call metrics', () => {
+            autoGovern.activate({ apiKey: 'test-key', tenantId: 'test-tenant' });
+            const before = autoGovern.getMetrics();
+            autoGovern.evaluateCall('test_tool', 'test_action');
+            const after = autoGovern.getMetrics();
+            expect(after.governedCalls).toBe(before.governedCalls + 1);
+        });
+        it('should record allowed call metrics', () => {
+            autoGovern.activate({ apiKey: 'test-key', tenantId: 'test-tenant' });
+            const before = autoGovern.getMetrics();
+            autoGovern.evaluateCall('test_tool', 'test_action');
+            const after = autoGovern.getMetrics();
+            expect(after.allowedCalls).toBe(before.allowedCalls + 1);
+        });
+        it('should record denied call metrics', () => {
+            autoGovern.activate({ apiKey: 'test-key', tenantId: 'test-tenant' });
+            // Add deny policy
+            const evaluator = autoGovern.getEvaluator();
+            evaluator.updatePolicies([
+                {
+                    policyId: 'policy-1',
+                    tenantId: 'test-tenant',
+                    priority: 100,
+                    status: 'active',
+                    scope: { applyToAll: true },
+                    rules: [
+                        {
+                            ruleId: 'rule-1',
+                            name: 'Deny all',
+                            enabled: true,
+                            priority: 100,
+                            conditions: [],
+                            actions: [{ actionType: 'deny' }],
+                        },
+                    ],
+                },
+            ]);
+            const before = autoGovern.getMetrics();
+            autoGovern.evaluateCall('test_tool', 'test_action');
+            const after = autoGovern.getMetrics();
+            expect(after.deniedCalls).toBe(before.deniedCalls + 1);
+        });
+        it('should pass all parameters to evaluator', () => {
+            autoGovern.activate({ apiKey: 'test-key', tenantId: 'test-tenant' });
+            const decision = autoGovern.evaluateCall('test_tool', 'test_action', '/test/resource', { arg1: 'value1' }, { meta1: 'metavalue1' });
+            expect(decision).toBeDefined();
+        });
+    });
+    describe('patching', () => {
+        // Note: Actual patching behavior is difficult to test in Jest
+        // without mocking Node.js internals. These tests verify the
+        // activation flow calls patching functions.
+        it('should apply patches on activation', () => {
+            const config = {
+                apiKey: 'test-key',
+                tenantId: 'test-tenant',
+                enabledPatches: new Set(['fetch']),
+            };
+            autoGovern.activate(config);
+            // Verify patches were attempted (via config)
+            const activeConfig = autoGovern.getConfig();
+            expect(activeConfig.enabledPatches.has('fetch')).toBe(true);
+        });
+        it('should restore originals on deactivation', () => {
+            autoGovern.activate({ apiKey: 'test-key', tenantId: 'test-tenant' });
+            autoGovern.deactivate();
+            // Should not throw - originals restored
+            expect(() => autoGovern.deactivate()).not.toThrow();
+        });
+    });
+    describe('fail-safe behavior', () => {
+        it('should not crash on patch failures', () => {
+            // This would require mocking fs or child_process to fail
+            // For now, verify activation doesn't throw
+            expect(() => {
+                autoGovern.activate({ apiKey: 'test-key', tenantId: 'test-tenant' });
+            }).not.toThrow();
+        });
+        it('should allow calls when evaluation fails', () => {
+            autoGovern.activate({ apiKey: 'test-key', tenantId: 'test-tenant' });
+            // Break the evaluator
+            const evaluator = autoGovern.getEvaluator();
+            evaluator.policies = ['invalid']; // Cause error
+            const decision = autoGovern.evaluateCall('test_tool', 'test_action');
+            // Should still allow (fail-open)
+            expect(decision.action).toBe('allow');
+        });
+    });
+});
+describe('autoGovern - fetch patching integration', () => {
+    let originalFetch;
+    beforeEach(() => {
+        // Store original fetch
+        originalFetch = globalThis.fetch;
+        consoleWarnSpy.mockClear();
+        consoleDebugSpy.mockClear();
+    });
+    afterEach(() => {
+        // Restore original fetch
+        globalThis.fetch = originalFetch;
+        if (autoGovern.isActive()) {
+            autoGovern.deactivate();
+        }
+    });
+    it('should patch global fetch when enabled', () => {
+        autoGovern.activate({
+            apiKey: 'test-key',
+            tenantId: 'test-tenant',
+            enabledPatches: new Set(['fetch']),
+        });
+        // fetch should be different from original
+        expect(globalThis.fetch).not.toBe(originalFetch);
+    });
+    it('should restore original fetch on deactivation', () => {
+        autoGovern.activate({
+            apiKey: 'test-key',
+            tenantId: 'test-tenant',
+            enabledPatches: new Set(['fetch']),
+        });
+        autoGovern.deactivate();
+        // fetch should be restored
+        expect(globalThis.fetch).toBe(originalFetch);
+    });
+    it('should evaluate fetch calls when patched', async () => {
+        // Mock fetch to avoid actual network calls
+        const mockFetch = jest.fn().mockResolvedValue({
+            ok: true,
+            status: 200,
+            json: async () => ({ data: 'test' }),
+        });
+        globalThis.fetch = mockFetch;
+        autoGovern.activate({
+            apiKey: 'test-key',
+            tenantId: 'test-tenant',
+            enabledPatches: new Set(['fetch']),
+        });
+        const beforeGoverned = autoGovern.getMetrics().governedCalls;
+        try {
+            await globalThis.fetch('https://example.com/api');
+        }
+        catch (e) {
+            // Expected - governance wraps fetch
+        }
+        const afterGoverned = autoGovern.getMetrics().governedCalls;
+        // Should have evaluated the call
+        expect(afterGoverned).toBeGreaterThan(beforeGoverned);
+    });
+    it('should block fetch when policy denies', async () => {
+        // Mock fetch
+        const mockFetch = jest.fn();
+        globalThis.fetch = mockFetch;
+        autoGovern.activate({
+            apiKey: 'test-key',
+            tenantId: 'test-tenant',
+            enabledPatches: new Set(['fetch']),
+        });
+        // Add deny policy
+        const evaluator = autoGovern.getEvaluator();
+        evaluator.updatePolicies([
+            {
+                policyId: 'policy-1',
+                tenantId: 'test-tenant',
+                priority: 100,
+                status: 'active',
+                scope: { applyToAll: true },
+                rules: [
+                    {
+                        ruleId: 'rule-1',
+                        name: 'Deny all HTTP requests',
+                        enabled: true,
+                        priority: 100,
+                        conditions: [
+                            {
+                                field: 'action_type',
+                                operator: 'equals',
+                                value: 'http_request',
+                            },
+                        ],
+                        actions: [{ actionType: 'deny' }],
+                    },
+                ],
+            },
+        ]);
+        await expect(globalThis.fetch('https://example.com/api')).rejects.toThrow(/blocked by Fulcrum policy/);
+        // Original fetch should not have been called
+        expect(mockFetch).not.toHaveBeenCalled();
+    });
+    it('should allow fetch when policy allows', async () => {
+        // Mock fetch
+        const mockFetch = jest.fn().mockResolvedValue({
+            ok: true,
+            status: 200,
+        });
+        globalThis.fetch = mockFetch;
+        autoGovern.activate({
+            apiKey: 'test-key',
+            tenantId: 'test-tenant',
+            enabledPatches: new Set(['fetch']),
+        });
+        await globalThis.fetch('https://example.com/api');
+        // Original fetch should have been called
+        expect(mockFetch).toHaveBeenCalledWith('https://example.com/api', undefined);
+    });
+});

package/dist/instrumentation/__tests__/evaluator.test.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Comprehensive unit tests for PolicyEvaluator.
+ * Tests cover: policy evaluation logic, condition matching, fail-safe behavior.
+ * Target: >90% coverage
+ */
+export {};