@gotgenes/pi-permission-system 10.0.0 → 10.1.0

package/test/handlers/gates/path.test.ts

@@ -1,13 +1,14 @@
-import { describe, expect, it, vi } from "vitest";
+import { describe, expect, it } from "vitest";
 
 import type { GateDescriptor } from "#src/handlers/gates/descriptor";
 import { isGateDescriptor } from "#src/handlers/gates/descriptor";
 import { describePathGate } from "#src/handlers/gates/path";
 import type { ToolCallContext } from "#src/handlers/gates/types";
-import type { Rule } from "#src/rule";
-import type { PermissionCheckResult } from "#src/types";
 
-import { makeGateCheckResult as makeCheckResult } from "#test/helpers/gate-fixtures";
+import {
+  makeGateCheckResult as makeCheckResult,
+  makeResolver,
+} from "#test/helpers/gate-fixtures";
 
 // ── helpers ────────────────────────────────────────────────────────────────
 
@@ -23,53 +24,36 @@ function makeTcc(overrides: Partial<ToolCallContext> = {}): ToolCallContext {
   };
 }
 
-type CheckPermissionFn = (
-  surface: string,
-  input: unknown,
-  agentName?: string,
-  sessionRules?: Rule[],
-) => PermissionCheckResult;
-
 // ── tests ──────────────────────────────────────────────────────────────────
 
 describe("describePathGate", () => {
-  const getSessionRuleset = vi.fn<() => Rule[]>().mockReturnValue([]);
-
   it("returns null for non-path-bearing tools", () => {
-    const checkPermission = vi.fn<CheckPermissionFn>();
+    const resolver = makeResolver();
     const result = describePathGate(
       makeTcc({ toolName: "bash", input: { command: "ls" } }),
-      checkPermission,
-      getSessionRuleset,
+      resolver,
     );
     expect(result).toBeNull();
-    expect(checkPermission).not.toHaveBeenCalled();
+    expect(resolver.resolve).not.toHaveBeenCalled();
   });
 
   it("returns null when tool has no extractable path", () => {
-    const checkPermission = vi.fn<CheckPermissionFn>();
+    const resolver = makeResolver();
     const result = describePathGate(
       makeTcc({ toolName: "read", input: {} }),
-      checkPermission,
-      getSessionRuleset,
+      resolver,
     );
     expect(result).toBeNull();
   });
 
   it("returns null when path check result is allow", () => {
-    const checkPermission = vi
-      .fn<CheckPermissionFn>()
-      .mockReturnValue(makeCheckResult({ state: "allow" }));
-    const result = describePathGate(
-      makeTcc(),
-      checkPermission,
-      getSessionRuleset,
-    );
+    const resolver = makeResolver(makeCheckResult({ state: "allow" }));
+    const result = describePathGate(makeTcc(), resolver);
     expect(result).toBeNull();
   });
 
   it("returns null when matchedPattern is undefined (universal default)", () => {
-    const checkPermission = vi.fn<CheckPermissionFn>().mockReturnValue(
+    const resolver = makeResolver(
       makeCheckResult({
         state: "ask",
         matchedPattern: undefined,
@@ -77,16 +61,12 @@ describe("describePathGate", () => {
         origin: "builtin",
       }),
     );
-    const result = describePathGate(
-      makeTcc(),
-      checkPermission,
-      getSessionRuleset,
-    );
+    const result = describePathGate(makeTcc(), resolver);
     expect(result).toBeNull();
   });
 
   it("returns GateDescriptor when matchedPattern is defined (explicit path rule)", () => {
-    const checkPermission = vi.fn<CheckPermissionFn>().mockReturnValue(
+    const resolver = makeResolver(
       makeCheckResult({
         state: "ask",
         matchedPattern: "*.env",
@@ -94,27 +74,16 @@ describe("describePathGate", () => {
         origin: "global",
       }),
     );
-    const result = describePathGate(
-      makeTcc(),
-      checkPermission,
-      getSessionRuleset,
-    );
+    const result = describePathGate(makeTcc(), resolver);
     expect(result).not.toBeNull();
     expect(isGateDescriptor(result)).toBe(true);
   });
 
   it("returns GateDescriptor when path check result is deny", () => {
-    const checkPermission = vi.fn<CheckPermissionFn>().mockReturnValue(
-      makeCheckResult({
-        state: "deny",
-        matchedPattern: "*.env",
-      }),
-    );
-    const result = describePathGate(
-      makeTcc(),
-      checkPermission,
-      getSessionRuleset,
+    const resolver = makeResolver(
+      makeCheckResult({ state: "deny", matchedPattern: "*.env" }),
     );
+    const result = describePathGate(makeTcc(), resolver);
     expect(result).not.toBeNull();
     expect(isGateDescriptor(result)).toBe(true);
     const desc = result as GateDescriptor;
@@ -123,17 +92,10 @@ describe("describePathGate", () => {
   });
 
   it("returns GateDescriptor when path check result is ask", () => {
-    const checkPermission = vi.fn<CheckPermissionFn>().mockReturnValue(
-      makeCheckResult({
-        state: "ask",
-        matchedPattern: "*.env",
-      }),
-    );
-    const result = describePathGate(
-      makeTcc(),
-      checkPermission,
-      getSessionRuleset,
+    const resolver = makeResolver(
+      makeCheckResult({ state: "ask", matchedPattern: "*.env" }),
     );
+    const result = describePathGate(makeTcc(), resolver);
     expect(result).not.toBeNull();
     expect(isGateDescriptor(result)).toBe(true);
     const desc = result as GateDescriptor;
@@ -142,13 +104,12 @@ describe("describePathGate", () => {
   });
 
   it("descriptor has correct session approval surface and pattern", () => {
-    const checkPermission = vi
-      .fn<CheckPermissionFn>()
-      .mockReturnValue(makeCheckResult({ state: "ask", matchedPattern: "*" }));
+    const resolver = makeResolver(
+      makeCheckResult({ state: "ask", matchedPattern: "*" }),
+    );
     const result = describePathGate(
       makeTcc({ input: { path: "/test/project/src/.env" } }),
-      checkPermission,
-      getSessionRuleset,
+      resolver,
     ) as GateDescriptor;
     expect(result.sessionApproval).toBeDefined();
     expect(result.sessionApproval?.surface).toBe("path");
@@ -156,16 +117,10 @@ describe("describePathGate", () => {
   });
 
   it("descriptor denialContext references the file path and tool name", () => {
-    const checkPermission = vi
-      .fn<CheckPermissionFn>()
-      .mockReturnValue(
-        makeCheckResult({ state: "deny", matchedPattern: "*.env" }),
-      );
-    const result = describePathGate(
-      makeTcc(),
-      checkPermission,
-      getSessionRuleset,
-    ) as GateDescriptor;
+    const resolver = makeResolver(
+      makeCheckResult({ state: "deny", matchedPattern: "*.env" }),
+    );
+    const result = describePathGate(makeTcc(), resolver) as GateDescriptor;
     expect(result.denialContext).toEqual({
       kind: "path",
       toolName: "read",
@@ -175,43 +130,21 @@ describe("describePathGate", () => {
   });
 
   it("descriptor decision uses surface 'path' and the file path as value", () => {
-    const checkPermission = vi
-      .fn<CheckPermissionFn>()
-      .mockReturnValue(
-        makeCheckResult({ state: "deny", matchedPattern: "*.env" }),
-      );
-    const result = describePathGate(
-      makeTcc(),
-      checkPermission,
-      getSessionRuleset,
-    ) as GateDescriptor;
+    const resolver = makeResolver(
+      makeCheckResult({ state: "deny", matchedPattern: "*.env" }),
+    );
+    const result = describePathGate(makeTcc(), resolver) as GateDescriptor;
     expect(result.decision.surface).toBe("path");
     expect(result.decision.value).toBe(".env");
   });
 
-  it("passes agentName and session rules to checkPermission", () => {
-    const sessionRules: Rule[] = [
-      {
-        surface: "path",
-        pattern: "/project/*",
-        action: "allow",
-        origin: "session",
-      },
-    ];
-    const getSession = vi.fn<() => Rule[]>().mockReturnValue(sessionRules);
-    const checkPermission = vi
-      .fn<CheckPermissionFn>()
-      .mockReturnValue(makeCheckResult({ state: "allow" }));
-    describePathGate(
-      makeTcc({ agentName: "my-agent" }),
-      checkPermission,
-      getSession,
-    );
-    expect(checkPermission).toHaveBeenCalledWith(
+  it("resolves the path surface with the file path and agent name", () => {
+    const resolver = makeResolver(makeCheckResult({ state: "allow" }));
+    describePathGate(makeTcc({ agentName: "my-agent" }), resolver);
+    expect(resolver.resolve).toHaveBeenCalledWith(
       "path",
       { path: ".env" },
       "my-agent",
-      sessionRules,
     );
   });
 });