@fulcrum-governance/sdk 0.1.1 → 0.1.3

package/dist/instrumentation/__tests__/evaluator.test.js

@@ -0,0 +1,712 @@
+"use strict";
+/**
+ * Comprehensive unit tests for PolicyEvaluator.
+ * Tests cover: policy evaluation logic, condition matching, fail-safe behavior.
+ * Target: >90% coverage
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+const evaluator_1 = require("../evaluator");
+describe('PolicyEvaluator', () => {
+    describe('initialization', () => {
+        it('should initialize with default config', () => {
+            const evaluator = new evaluator_1.PolicyEvaluator();
+            expect(evaluator).toBeDefined();
+            expect(evaluator.policyCount).toBe(0);
+        });
+        it('should initialize with custom config', () => {
+            const config = {
+                apiKey: 'test-key',
+                tenantId: 'test-tenant',
+                policySyncInterval: 60,
+            };
+            const evaluator = new evaluator_1.PolicyEvaluator(config);
+            expect(evaluator).toBeDefined();
+        });
+        it('should not be running initially', () => {
+            const evaluator = new evaluator_1.PolicyEvaluator();
+            expect(evaluator.running).toBe(false);
+        });
+    });
+    describe('start and stop', () => {
+        it('should start the evaluator', () => {
+            const evaluator = new evaluator_1.PolicyEvaluator();
+            evaluator.start();
+            expect(evaluator.running).toBe(true);
+            expect(evaluator.syncInterval).not.toBeNull();
+            evaluator.stop();
+        });
+        it('should stop the evaluator', () => {
+            const evaluator = new evaluator_1.PolicyEvaluator();
+            evaluator.start();
+            evaluator.stop();
+            expect(evaluator.running).toBe(false);
+            expect(evaluator.syncInterval).toBeNull();
+        });
+        it('should be idempotent when starting multiple times', () => {
+            const evaluator = new evaluator_1.PolicyEvaluator();
+            evaluator.start();
+            const interval1 = evaluator.syncInterval;
+            evaluator.start(); // Should be no-op
+            const interval2 = evaluator.syncInterval;
+            expect(interval1).toBe(interval2);
+            evaluator.stop();
+        });
+        it('should be idempotent when stopping multiple times', () => {
+            const evaluator = new evaluator_1.PolicyEvaluator();
+            evaluator.start();
+            evaluator.stop();
+            // Should not throw
+            expect(() => evaluator.stop()).not.toThrow();
+        });
+    });
+    describe('evaluate - no policies', () => {
+        it('should allow when no policies are loaded', () => {
+            const evaluator = new evaluator_1.PolicyEvaluator();
+            const request = {
+                toolName: 'test_tool',
+                actionType: 'file_read',
+                resource: '/test/path',
+                toolArgs: {},
+            };
+            const decision = evaluator.evaluate(request);
+            expect(decision.action).toBe('allow');
+            expect(decision.reason).toContain('No policies loaded');
+        });
+    });
+    describe('evaluate - policy matching', () => {
+        it('should match policy and allow', () => {
+            const evaluator = new evaluator_1.PolicyEvaluator();
+            const testPolicy = {
+                policyId: 'policy-1',
+                tenantId: 'test-tenant',
+                priority: 100,
+                status: 'active',
+                scope: { applyToAll: true },
+                rules: [
+                    {
+                        ruleId: 'rule-1',
+                        name: 'Allow file reads',
+                        enabled: true,
+                        priority: 100,
+                        conditions: [
+                            {
+                                field: 'action_type',
+                                operator: 'equals',
+                                value: 'file_read',
+                            },
+                        ],
+                        actions: [{ actionType: 'allow' }],
+                    },
+                ],
+            };
+            evaluator.updatePolicies([testPolicy]);
+            const request = {
+                toolName: 'fs.readFile',
+                actionType: 'file_read',
+                resource: '/test/path',
+                toolArgs: {},
+            };
+            const decision = evaluator.evaluate(request);
+            expect(decision.action).toBe('allow');
+            expect(decision.matchedPolicyId).toBe('policy-1');
+            expect(decision.matchedRuleId).toBe('rule-1');
+        });
+        it('should match policy and deny', () => {
+            const evaluator = new evaluator_1.PolicyEvaluator();
+            const testPolicy = {
+                policyId: 'policy-2',
+                tenantId: 'test-tenant',
+                priority: 100,
+                status: 'active',
+                scope: { applyToAll: true },
+                rules: [
+                    {
+                        ruleId: 'rule-2',
+                        name: 'Deny sensitive files',
+                        enabled: true,
+                        priority: 100,
+                        conditions: [
+                            {
+                                field: 'resource',
+                                operator: 'contains',
+                                value: '/secret',
+                            },
+                        ],
+                        actions: [{ actionType: 'deny' }],
+                    },
+                ],
+            };
+            evaluator.updatePolicies([testPolicy]);
+            const request = {
+                toolName: 'fs.readFile',
+                actionType: 'file_read',
+                resource: '/etc/secret/credentials',
+                toolArgs: {},
+            };
+            const decision = evaluator.evaluate(request);
+            expect(decision.action).toBe('deny');
+            expect(decision.matchedPolicyId).toBe('policy-2');
+        });
+        it('should skip disabled rules', () => {
+            const evaluator = new evaluator_1.PolicyEvaluator();
+            const testPolicy = {
+                policyId: 'policy-3',
+                tenantId: 'test-tenant',
+                priority: 100,
+                status: 'active',
+                scope: { applyToAll: true },
+                rules: [
+                    {
+                        ruleId: 'rule-disabled',
+                        name: 'Disabled rule',
+                        enabled: false, // Disabled
+                        priority: 100,
+                        conditions: [],
+                        actions: [{ actionType: 'deny' }],
+                    },
+                ],
+            };
+            evaluator.updatePolicies([testPolicy]);
+            const request = {
+                toolName: 'test_tool',
+                actionType: 'test_action',
+                toolArgs: {},
+            };
+            const decision = evaluator.evaluate(request);
+            // Should allow because rule is disabled
+            expect(decision.action).toBe('allow');
+            expect(decision.reason).toContain('No rules matched');
+        });
+        it('should skip inactive policies', () => {
+            const evaluator = new evaluator_1.PolicyEvaluator();
+            const testPolicy = {
+                policyId: 'policy-4',
+                tenantId: 'test-tenant',
+                priority: 100,
+                status: 'inactive', // Inactive
+                scope: { applyToAll: true },
+                rules: [
+                    {
+                        ruleId: 'rule-1',
+                        name: 'Some rule',
+                        enabled: true,
+                        priority: 100,
+                        conditions: [],
+                        actions: [{ actionType: 'deny' }],
+                    },
+                ],
+            };
+            evaluator.updatePolicies([testPolicy]);
+            const request = {
+                toolName: 'test_tool',
+                actionType: 'test_action',
+                toolArgs: {},
+            };
+            const decision = evaluator.evaluate(request);
+            expect(decision.action).toBe('allow');
+        });
+    });
+    describe('evaluate - condition operators', () => {
+        const createPolicyWithCondition = (operator, value, values) => ({
+            policyId: `policy-${operator}`,
+            tenantId: 'test-tenant',
+            priority: 100,
+            status: 'active',
+            scope: { applyToAll: true },
+            rules: [
+                {
+                    ruleId: `rule-${operator}`,
+                    name: `Test ${operator}`,
+                    enabled: true,
+                    priority: 100,
+                    conditions: [
+                        {
+                            field: 'resource',
+                            operator,
+                            value,
+                            values,
+                        },
+                    ],
+                    actions: [{ actionType: 'deny' }],
+                },
+            ],
+        });
+        it('should match equals operator', () => {
+            const evaluator = new evaluator_1.PolicyEvaluator();
+            evaluator.updatePolicies([createPolicyWithCondition('equals', 'test_value')]);
+            const request = {
+                toolName: 'test_tool',
+                actionType: 'test_action',
+                resource: 'test_value',
+                toolArgs: {},
+            };
+            const decision = evaluator.evaluate(request);
+            expect(decision.action).toBe('deny');
+        });
+        it('should not match equals operator with different value', () => {
+            const evaluator = new evaluator_1.PolicyEvaluator();
+            evaluator.updatePolicies([createPolicyWithCondition('equals', 'test_value')]);
+            const request = {
+                toolName: 'test_tool',
+                actionType: 'test_action',
+                resource: 'other_value',
+                toolArgs: {},
+            };
+            const decision = evaluator.evaluate(request);
+            expect(decision.action).toBe('allow');
+        });
+        it('should match not_equals operator', () => {
+            const evaluator = new evaluator_1.PolicyEvaluator();
+            evaluator.updatePolicies([createPolicyWithCondition('not_equals', 'test_value')]);
+            const request = {
+                toolName: 'test_tool',
+                actionType: 'test_action',
+                resource: 'other_value',
+                toolArgs: {},
+            };
+            const decision = evaluator.evaluate(request);
+            expect(decision.action).toBe('deny');
+        });
+        it('should match contains operator', () => {
+            const evaluator = new evaluator_1.PolicyEvaluator();
+            evaluator.updatePolicies([createPolicyWithCondition('contains', 'world')]);
+            const request = {
+                toolName: 'test_tool',
+                actionType: 'test_action',
+                resource: 'hello world',
+                toolArgs: {},
+            };
+            const decision = evaluator.evaluate(request);
+            expect(decision.action).toBe('deny');
+        });
+        it('should match starts_with operator', () => {
+            const evaluator = new evaluator_1.PolicyEvaluator();
+            evaluator.updatePolicies([createPolicyWithCondition('starts_with', 'hello')]);
+            const request = {
+                toolName: 'test_tool',
+                actionType: 'test_action',
+                resource: 'hello world',
+                toolArgs: {},
+            };
+            const decision = evaluator.evaluate(request);
+            expect(decision.action).toBe('deny');
+        });
+        it('should match ends_with operator', () => {
+            const evaluator = new evaluator_1.PolicyEvaluator();
+            evaluator.updatePolicies([createPolicyWithCondition('ends_with', 'world')]);
+            const request = {
+                toolName: 'test_tool',
+                actionType: 'test_action',
+                resource: 'hello world',
+                toolArgs: {},
+            };
+            const decision = evaluator.evaluate(request);
+            expect(decision.action).toBe('deny');
+        });
+        it('should match in operator', () => {
+            const evaluator = new evaluator_1.PolicyEvaluator();
+            evaluator.updatePolicies([createPolicyWithCondition('in', undefined, ['value1', 'value2'])]);
+            const request = {
+                toolName: 'test_tool',
+                actionType: 'test_action',
+                resource: 'value1',
+                toolArgs: {},
+            };
+            const decision = evaluator.evaluate(request);
+            expect(decision.action).toBe('deny');
+        });
+        it('should match not_in operator', () => {
+            const evaluator = new evaluator_1.PolicyEvaluator();
+            evaluator.updatePolicies([createPolicyWithCondition('not_in', undefined, ['value1', 'value2'])]);
+            const request = {
+                toolName: 'test_tool',
+                actionType: 'test_action',
+                resource: 'value3',
+                toolArgs: {},
+            };
+            const decision = evaluator.evaluate(request);
+            expect(decision.action).toBe('deny');
+        });
+        it('should match matches (regex) operator', () => {
+            const evaluator = new evaluator_1.PolicyEvaluator();
+            evaluator.updatePolicies([createPolicyWithCondition('matches', 'test\\d+')]);
+            const request = {
+                toolName: 'test_tool',
+                actionType: 'test_action',
+                resource: 'test123',
+                toolArgs: {},
+            };
+            const decision = evaluator.evaluate(request);
+            expect(decision.action).toBe('deny');
+        });
+        it('should handle invalid regex gracefully', () => {
+            const evaluator = new evaluator_1.PolicyEvaluator();
+            evaluator.updatePolicies([createPolicyWithCondition('matches', '[invalid(regex')]);
+            const request = {
+                toolName: 'test_tool',
+                actionType: 'test_action',
+                resource: 'test',
+                toolArgs: {},
+            };
+            const decision = evaluator.evaluate(request);
+            // Invalid regex should not match
+            expect(decision.action).toBe('allow');
+        });
+        it('should warn on unknown operator', () => {
+            const consoleSpy = jest.spyOn(console, 'warn').mockImplementation();
+            const evaluator = new evaluator_1.PolicyEvaluator();
+            const policy = {
+                policyId: 'policy-unknown',
+                tenantId: 'test-tenant',
+                priority: 100,
+                status: 'active',
+                scope: { applyToAll: true },
+                rules: [
+                    {
+                        ruleId: 'rule-unknown',
+                        name: 'Unknown operator',
+                        enabled: true,
+                        priority: 100,
+                        conditions: [
+                            {
+                                field: 'resource',
+                                operator: 'unknown_operator',
+                                value: 'test',
+                            },
+                        ],
+                        actions: [{ actionType: 'deny' }],
+                    },
+                ],
+            };
+            evaluator.updatePolicies([policy]);
+            const request = {
+                toolName: 'test_tool',
+                actionType: 'test_action',
+                resource: 'test',
+                toolArgs: {},
+            };
+            evaluator.evaluate(request);
+            expect(consoleSpy).toHaveBeenCalledWith(expect.stringContaining('Unknown operator'));
+            consoleSpy.mockRestore();
+        });
+    });
+    describe('evaluate - field extraction', () => {
+        it('should extract tool_name field', () => {
+            const evaluator = new evaluator_1.PolicyEvaluator();
+            const policy = {
+                policyId: 'policy-1',
+                tenantId: 'test-tenant',
+                priority: 100,
+                status: 'active',
+                scope: { applyToAll: true },
+                rules: [
+                    {
+                        ruleId: 'rule-1',
+                        name: 'Match tool name',
+                        enabled: true,
+                        priority: 100,
+                        conditions: [
+                            {
+                                field: 'tool_name',
+                                operator: 'equals',
+                                value: 'fs.readFile',
+                            },
+                        ],
+                        actions: [{ actionType: 'deny' }],
+                    },
+                ],
+            };
+            evaluator.updatePolicies([policy]);
+            const request = {
+                toolName: 'fs.readFile',
+                actionType: 'file_read',
+                toolArgs: {},
+            };
+            const decision = evaluator.evaluate(request);
+            expect(decision.action).toBe('deny');
+        });
+        it('should extract action_type field', () => {
+            const evaluator = new evaluator_1.PolicyEvaluator();
+            const policy = {
+                policyId: 'policy-1',
+                tenantId: 'test-tenant',
+                priority: 100,
+                status: 'active',
+                scope: { applyToAll: true },
+                rules: [
+                    {
+                        ruleId: 'rule-1',
+                        name: 'Match action type',
+                        enabled: true,
+                        priority: 100,
+                        conditions: [
+                            {
+                                field: 'action_type',
+                                operator: 'equals',
+                                value: 'file_write',
+                            },
+                        ],
+                        actions: [{ actionType: 'deny' }],
+                    },
+                ],
+            };
+            evaluator.updatePolicies([policy]);
+            const request = {
+                toolName: 'fs.writeFile',
+                actionType: 'file_write',
+                toolArgs: {},
+            };
+            const decision = evaluator.evaluate(request);
+            expect(decision.action).toBe('deny');
+        });
+        it('should extract args.* fields', () => {
+            const evaluator = new evaluator_1.PolicyEvaluator();
+            const policy = {
+                policyId: 'policy-1',
+                tenantId: 'test-tenant',
+                priority: 100,
+                status: 'active',
+                scope: { applyToAll: true },
+                rules: [
+                    {
+                        ruleId: 'rule-1',
+                        name: 'Match arg',
+                        enabled: true,
+                        priority: 100,
+                        conditions: [
+                            {
+                                field: 'args.path',
+                                operator: 'equals',
+                                value: '/sensitive/path',
+                            },
+                        ],
+                        actions: [{ actionType: 'deny' }],
+                    },
+                ],
+            };
+            evaluator.updatePolicies([policy]);
+            const request = {
+                toolName: 'fs.readFile',
+                actionType: 'file_read',
+                toolArgs: { path: '/sensitive/path' },
+            };
+            const decision = evaluator.evaluate(request);
+            expect(decision.action).toBe('deny');
+        });
+        it('should extract metadata.* fields', () => {
+            const evaluator = new evaluator_1.PolicyEvaluator();
+            const policy = {
+                policyId: 'policy-1',
+                tenantId: 'test-tenant',
+                priority: 100,
+                status: 'active',
+                scope: { applyToAll: true },
+                rules: [
+                    {
+                        ruleId: 'rule-1',
+                        name: 'Match metadata',
+                        enabled: true,
+                        priority: 100,
+                        conditions: [
+                            {
+                                field: 'metadata.environment',
+                                operator: 'equals',
+                                value: 'production',
+                            },
+                        ],
+                        actions: [{ actionType: 'deny' }],
+                    },
+                ],
+            };
+            evaluator.updatePolicies([policy]);
+            const request = {
+                toolName: 'test_tool',
+                actionType: 'test_action',
+                toolArgs: {},
+                metadata: { environment: 'production' },
+            };
+            const decision = evaluator.evaluate(request);
+            expect(decision.action).toBe('deny');
+        });
+        it('should return undefined for unknown fields', () => {
+            const evaluator = new evaluator_1.PolicyEvaluator();
+            const policy = {
+                policyId: 'policy-1',
+                tenantId: 'test-tenant',
+                priority: 100,
+                status: 'active',
+                scope: { applyToAll: true },
+                rules: [
+                    {
+                        ruleId: 'rule-1',
+                        name: 'Unknown field',
+                        enabled: true,
+                        priority: 100,
+                        conditions: [
+                            {
+                                field: 'unknown_field',
+                                operator: 'equals',
+                                value: 'test',
+                            },
+                        ],
+                        actions: [{ actionType: 'deny' }],
+                    },
+                ],
+            };
+            evaluator.updatePolicies([policy]);
+            const request = {
+                toolName: 'test_tool',
+                actionType: 'test_action',
+                toolArgs: {},
+            };
+            const decision = evaluator.evaluate(request);
+            // Unknown field should not match
+            expect(decision.action).toBe('allow');
+        });
+    });
+    describe('evaluate - policy scope', () => {
+        it('should apply policy when applyToAll is true', () => {
+            const evaluator = new evaluator_1.PolicyEvaluator();
+            const policy = {
+                policyId: 'policy-1',
+                tenantId: 'test-tenant',
+                priority: 100,
+                status: 'active',
+                scope: { applyToAll: true },
+                rules: [
+                    {
+                        ruleId: 'rule-1',
+                        name: 'Deny all',
+                        enabled: true,
+                        priority: 100,
+                        conditions: [],
+                        actions: [{ actionType: 'deny' }],
+                    },
+                ],
+            };
+            evaluator.updatePolicies([policy]);
+            const request = {
+                toolName: 'any_tool',
+                actionType: 'any_action',
+                toolArgs: {},
+            };
+            const decision = evaluator.evaluate(request);
+            expect(decision.action).toBe('deny');
+        });
+        it('should filter by tool names', () => {
+            const evaluator = new evaluator_1.PolicyEvaluator();
+            const policy = {
+                policyId: 'policy-1',
+                tenantId: 'test-tenant',
+                priority: 100,
+                status: 'active',
+                scope: {
+                    applyToAll: false,
+                    toolNames: ['fs.readFile', 'fs.writeFile'],
+                },
+                rules: [
+                    {
+                        ruleId: 'rule-1',
+                        name: 'Deny file operations',
+                        enabled: true,
+                        priority: 100,
+                        conditions: [],
+                        actions: [{ actionType: 'deny' }],
+                    },
+                ],
+            };
+            evaluator.updatePolicies([policy]);
+            // Should match for allowed tool
+            const request1 = {
+                toolName: 'fs.readFile',
+                actionType: 'file_read',
+                toolArgs: {},
+            };
+            expect(evaluator.evaluate(request1).action).toBe('deny');
+            // Should not match for other tool
+            const request2 = {
+                toolName: 'fetch',
+                actionType: 'http_request',
+                toolArgs: {},
+            };
+            expect(evaluator.evaluate(request2).action).toBe('allow');
+        });
+    });
+    describe('evaluate - fail-safe behavior', () => {
+        it('should fail open on evaluation error', () => {
+            const consoleSpy = jest.spyOn(console, 'warn').mockImplementation();
+            const evaluator = new evaluator_1.PolicyEvaluator();
+            // Mock evaluateInternal to throw an error
+            jest.spyOn(evaluator, 'evaluateInternal').mockImplementation(() => {
+                throw new Error('Simulated evaluation error');
+            });
+            const request = {
+                toolName: 'test_tool',
+                actionType: 'test_action',
+                toolArgs: {},
+            };
+            const decision = evaluator.evaluate(request);
+            // Should allow (fail open)
+            expect(decision.action).toBe('allow');
+            expect(decision.reason).toContain('Evaluation error (fail-open)');
+            // Should have logged warning
+            expect(consoleSpy).toHaveBeenCalledWith(expect.stringContaining('Policy evaluation error'));
+            consoleSpy.mockRestore();
+        });
+    });
+    describe('updatePolicies', () => {
+        it('should update policy cache', () => {
+            const evaluator = new evaluator_1.PolicyEvaluator();
+            expect(evaluator.policyCount).toBe(0);
+            const testPolicies = [
+                {
+                    policyId: 'policy-1',
+                    tenantId: 'test-tenant',
+                    priority: 100,
+                    status: 'active',
+                    rules: [],
+                },
+                {
+                    policyId: 'policy-2',
+                    tenantId: 'test-tenant',
+                    priority: 90,
+                    status: 'active',
+                    rules: [],
+                },
+            ];
+            evaluator.updatePolicies(testPolicies);
+            expect(evaluator.policyCount).toBe(2);
+        });
+        it('should update last sync time', () => {
+            const evaluator = new evaluator_1.PolicyEvaluator();
+            const before = evaluator.lastSyncTime;
+            evaluator.updatePolicies([]);
+            const after = evaluator.lastSyncTime;
+            expect(after).toBeGreaterThan(before);
+        });
+    });
+    describe('properties', () => {
+        it('should return policy count', () => {
+            const evaluator = new evaluator_1.PolicyEvaluator();
+            evaluator.updatePolicies([
+                {
+                    policyId: 'policy-1',
+                    tenantId: 'test-tenant',
+                    priority: 100,
+                    status: 'active',
+                    rules: [],
+                },
+            ]);
+            expect(evaluator.policyCount).toBe(1);
+        });
+        it('should return last sync time', () => {
+            const evaluator = new evaluator_1.PolicyEvaluator();
+            const time = evaluator.lastSyncTime;
+            expect(time).toBeGreaterThanOrEqual(0);
+        });
+        it('should return sync error', () => {
+            const evaluator = new evaluator_1.PolicyEvaluator();
+            expect(evaluator.syncErrorMessage).toBeNull();
+        });
+    });
+});