@gotgenes/pi-permission-system 11.0.0 → 13.0.0

package/test/rule.test.ts

@@ -1,6 +1,11 @@
 import { describe, expect, test } from "vitest";
 import type { Rule, RuleOrigin, Ruleset } from "#src/rule";
-import { evaluate, evaluateFirst, evaluateMostRestrictive } from "#src/rule";
+import {
+  evaluate,
+  evaluateAnyValue,
+  evaluateFirst,
+  evaluateMostRestrictive,
+} from "#src/rule";
 
 describe("evaluate", () => {
   const allowBashGit: Rule = {
@@ -393,6 +398,74 @@ describe("evaluateFirst", () => {
   });
 });
 
+describe("evaluateAnyValue", () => {
+  const catchAllAllow: Rule = {
+    surface: "path",
+    pattern: "*",
+    action: "allow",
+    layer: "config",
+    origin: "global",
+  };
+  const catchAllAsk: Rule = {
+    surface: "path",
+    pattern: "*",
+    action: "ask",
+    layer: "config",
+    origin: "global",
+  };
+  const relativeDeny: Rule = {
+    surface: "path",
+    pattern: "src/*",
+    action: "deny",
+    layer: "config",
+    origin: "global",
+  };
+  const absoluteAllow: Rule = {
+    surface: "path",
+    pattern: "/proj/*",
+    action: "allow",
+    layer: "config",
+    origin: "global",
+  };
+
+  test("a later relative rule wins over a catch-all matched by another alias", () => {
+    const rules: Ruleset = [catchAllAllow, relativeDeny];
+    const result = evaluateAnyValue(
+      "path",
+      ["/proj/src/foo.ts", "src/foo.ts"],
+      rules,
+    );
+    expect(result.rule).toEqual(relativeDeny);
+    expect(result.value).toBe("src/foo.ts");
+  });
+
+  test("uses an absolute alias when no later relative rule matches", () => {
+    const rules: Ruleset = [catchAllAsk, absoluteAllow];
+    const result = evaluateAnyValue(
+      "path",
+      ["/proj/src/foo.ts", "src/foo.ts"],
+      rules,
+    );
+    expect(result.rule).toEqual(absoluteAllow);
+    expect(result.value).toBe("/proj/src/foo.ts");
+  });
+
+  test("falls back to the first value's default when no rule matches", () => {
+    const result = evaluateAnyValue(
+      "path",
+      ["/proj/src/foo.ts", "src/foo.ts"],
+      [],
+    );
+    expect(result.rule.action).toBe("ask");
+    expect(result.value).toBe("/proj/src/foo.ts");
+  });
+
+  test("uses '*' as fallback value when values array is empty", () => {
+    const result = evaluateAnyValue("path", [], []);
+    expect(result.value).toBe("*");
+  });
+});
+
 describe("evaluateMostRestrictive", () => {
   const denyEnv: Rule = {
     surface: "path",

package/test/service-lifecycle.test.ts

@@ -35,6 +35,7 @@ function makeService(): PermissionsService {
     checkPermission: vi.fn(),
     getToolPermission: vi.fn(),
     registerToolInputFormatter: vi.fn(),
+    registerToolAccessExtractor: vi.fn(),
   };
 }
 

package/test/service.test.ts

@@ -6,6 +6,7 @@ import {
   publishPermissionsService,
   unpublishPermissionsService,
 } from "#src/service";
+import { ToolAccessExtractorRegistry } from "#src/tool-access-extractor-registry";
 import { ToolInputFormatterRegistry } from "#src/tool-input-formatter-registry";
 import type { PermissionCheckResult } from "#src/types";
 
@@ -18,6 +19,7 @@ function makeService(
     checkPermission: vi.fn(),
     getToolPermission: vi.fn(),
     registerToolInputFormatter: vi.fn(),
+    registerToolAccessExtractor: vi.fn(),
     ...overrides,
   };
 }
@@ -155,6 +157,7 @@ describe("service adapter delegation", () => {
         return getToolPermissionFn(toolName, agentName);
       },
       registerToolInputFormatter: vi.fn(),
+      registerToolAccessExtractor: vi.fn(),
     };
 
     publishPermissionsService(service);
@@ -177,6 +180,7 @@ describe("service adapter delegation", () => {
         return getToolPermissionFn(toolName, agentName);
       },
       registerToolInputFormatter: vi.fn(),
+      registerToolAccessExtractor: vi.fn(),
     };
 
     publishPermissionsService(service);
@@ -253,3 +257,52 @@ describe("registerToolInputFormatter delegation", () => {
     ).toThrow("my-tool");
   });
 });
+
+// ── registerToolAccessExtractor delegation (#352) ────────────────────────
+
+describe("registerToolAccessExtractor delegation", () => {
+  afterEach(() => {
+    const current = getPermissionsService();
+    if (current) {
+      unpublishPermissionsService(current);
+    }
+  });
+
+  it("delegates to the registry and returns its disposer", () => {
+    const registry = new ToolAccessExtractorRegistry();
+    const extractor = () => "/etc/hosts";
+
+    const service = makeService({
+      registerToolAccessExtractor(toolName, ext) {
+        return registry.register(toolName, ext);
+      },
+    });
+
+    publishPermissionsService(service);
+    const dispose = getPermissionsService()!.registerToolAccessExtractor(
+      "ffgrep",
+      extractor,
+    );
+
+    expect(registry.get("ffgrep")).toBe(extractor);
+
+    dispose();
+    expect(registry.get("ffgrep")).toBeUndefined();
+  });
+
+  it("throws when an extractor is already registered for the tool name", () => {
+    const registry = new ToolAccessExtractorRegistry();
+    registry.register("ffgrep", () => undefined);
+
+    const service = makeService({
+      registerToolAccessExtractor(toolName, ext) {
+        return registry.register(toolName, ext);
+      },
+    });
+
+    publishPermissionsService(service);
+    expect(() =>
+      getPermissionsService()!.registerToolAccessExtractor("ffgrep", () => ""),
+    ).toThrow("ffgrep");
+  });
+});

package/test/tool-access-extractor-registry.test.ts

@@ -0,0 +1,77 @@
+import { describe, expect, test } from "vitest";
+
+import {
+  type ToolAccessExtractor,
+  ToolAccessExtractorRegistry,
+} from "#src/tool-access-extractor-registry";
+
+const noopExtractor: ToolAccessExtractor = () => "/tmp/x";
+
+describe("ToolAccessExtractorRegistry", () => {
+  describe("register", () => {
+    test("stores an extractor so get() returns it", () => {
+      const registry = new ToolAccessExtractorRegistry();
+      registry.register("my-tool", noopExtractor);
+      expect(registry.get("my-tool")).toBe(noopExtractor);
+    });
+
+    test("returns a disposer that removes the extractor", () => {
+      const registry = new ToolAccessExtractorRegistry();
+      const dispose = registry.register("my-tool", noopExtractor);
+      dispose();
+      expect(registry.get("my-tool")).toBeUndefined();
+    });
+
+    test("throws when an extractor is already registered for the same tool name", () => {
+      const registry = new ToolAccessExtractorRegistry();
+      registry.register("my-tool", noopExtractor);
+      expect(() => registry.register("my-tool", () => undefined)).toThrow(
+        "my-tool",
+      );
+    });
+
+    test("allows registering different tool names independently", () => {
+      const registry = new ToolAccessExtractorRegistry();
+      const extractorA: ToolAccessExtractor = () => "/a";
+      const extractorB: ToolAccessExtractor = () => "/b";
+      registry.register("tool-a", extractorA);
+      registry.register("tool-b", extractorB);
+      expect(registry.get("tool-a")).toBe(extractorA);
+      expect(registry.get("tool-b")).toBe(extractorB);
+    });
+  });
+
+  describe("disposer identity guard", () => {
+    test("stale disposer does not evict a later registration", () => {
+      const registry = new ToolAccessExtractorRegistry();
+      const first: ToolAccessExtractor = () => "/first";
+      const second: ToolAccessExtractor = () => "/second";
+
+      const disposeFirst = registry.register("my-tool", first);
+      disposeFirst(); // removes first
+
+      registry.register("my-tool", second); // second registration is now valid
+      disposeFirst(); // calling stale disposer again — must not remove second
+
+      expect(registry.get("my-tool")).toBe(second);
+    });
+  });
+
+  describe("get", () => {
+    test("returns undefined for an unregistered tool name", () => {
+      const registry = new ToolAccessExtractorRegistry();
+      expect(registry.get("unknown")).toBeUndefined();
+    });
+
+    test("the registered extractor is callable and returns its path", () => {
+      const registry = new ToolAccessExtractorRegistry();
+      const extractor: ToolAccessExtractor = (input) =>
+        typeof input.target === "string" ? input.target : undefined;
+      registry.register("ffgrep", extractor);
+      expect(registry.get("ffgrep")?.({ target: "/etc/hosts" })).toBe(
+        "/etc/hosts",
+      );
+      expect(registry.get("ffgrep")?.({ other: true })).toBeUndefined();
+    });
+  });
+});