@gotgenes/pi-permission-system 18.1.0 → 18.1.2

package/test/permission-gate.test.ts

@@ -1,269 +0,0 @@
-import { describe, expect, it, vi } from "vitest";
-import type { PermissionPromptDecision } from "#src/permission-dialog";
-import {
-  applyPermissionGate,
-  type PermissionGateParams,
-} from "#src/permission-gate";
-
-function makeParams(
-  overrides: Partial<PermissionGateParams> = {},
-): PermissionGateParams {
-  return {
-    state: "allow",
-    canConfirm: true,
-    promptForApproval: vi.fn<() => Promise<PermissionPromptDecision>>(),
-    writeLog: vi.fn(),
-    logContext: { source: "test" },
-    messages: {
-      denyReason: "Denied by policy.",
-      unavailableReason: "No interactive UI available.",
-      userDeniedReason: (d) =>
-        d.denialReason
-          ? `User denied. Reason: ${d.denialReason}.`
-          : "User denied.",
-    },
-    ...overrides,
-  };
-}
-
-describe("applyPermissionGate", () => {
-  describe("deny branch", () => {
-    it("returns block with deny reason when state is deny", async () => {
-      const params = makeParams({ state: "deny" });
-      const result = await applyPermissionGate(params);
-      expect(result).toEqual({
-        action: "block",
-        reason: "Denied by policy.",
-      });
-    });
-
-    it("calls writeLog with policy_denied resolution", async () => {
-      const params = makeParams({
-        state: "deny",
-        logContext: { source: "tool_call", toolName: "bash" },
-      });
-      await applyPermissionGate(params);
-      expect(params.writeLog).toHaveBeenCalledOnce();
-      expect(params.writeLog).toHaveBeenCalledWith(
-        "permission_request.blocked",
-        {
-          source: "tool_call",
-          toolName: "bash",
-          resolution: "policy_denied",
-        },
-      );
-    });
-
-    it("does not call promptForApproval when state is deny", async () => {
-      const params = makeParams({ state: "deny" });
-      await applyPermissionGate(params);
-      expect(params.promptForApproval).not.toHaveBeenCalled();
-    });
-  });
-
-  describe("ask branch — unavailable", () => {
-    it("returns block with unavailable reason when canConfirm is false", async () => {
-      const params = makeParams({ state: "ask", canConfirm: false });
-      const result = await applyPermissionGate(params);
-      expect(result).toEqual({
-        action: "block",
-        reason: "No interactive UI available.",
-      });
-    });
-
-    it("calls writeLog with confirmation_unavailable resolution", async () => {
-      const params = makeParams({
-        state: "ask",
-        canConfirm: false,
-        logContext: { source: "skill_read", skillName: "foo" },
-      });
-      await applyPermissionGate(params);
-      expect(params.writeLog).toHaveBeenCalledOnce();
-      expect(params.writeLog).toHaveBeenCalledWith(
-        "permission_request.blocked",
-        {
-          source: "skill_read",
-          skillName: "foo",
-          resolution: "confirmation_unavailable",
-        },
-      );
-    });
-
-    it("does not call promptForApproval when canConfirm is false", async () => {
-      const params = makeParams({ state: "ask", canConfirm: false });
-      await applyPermissionGate(params);
-      expect(params.promptForApproval).not.toHaveBeenCalled();
-    });
-  });
-
-  describe("ask branch — user rejects", () => {
-    it("returns block with user-denied reason when user rejects", async () => {
-      const decision: PermissionPromptDecision = {
-        approved: false,
-        state: "denied",
-      };
-      const promptForApproval = vi.fn().mockResolvedValue(decision);
-      const params = makeParams({
-        state: "ask",
-        canConfirm: true,
-        promptForApproval,
-      });
-      const result = await applyPermissionGate(params);
-      expect(result).toEqual({ action: "block", reason: "User denied." });
-    });
-
-    it("passes denial reason through userDeniedReason formatter", async () => {
-      const decision: PermissionPromptDecision = {
-        approved: false,
-        state: "denied_with_reason",
-        denialReason: "not now",
-      };
-      const promptForApproval = vi.fn().mockResolvedValue(decision);
-      const params = makeParams({
-        state: "ask",
-        canConfirm: true,
-        promptForApproval,
-      });
-      const result = await applyPermissionGate(params);
-      expect(result).toEqual({
-        action: "block",
-        reason: "User denied. Reason: not now.",
-      });
-    });
-
-    it("does not call writeLog when user rejects (logged by promptPermission)", async () => {
-      const decision: PermissionPromptDecision = {
-        approved: false,
-        state: "denied",
-      };
-      const promptForApproval = vi.fn().mockResolvedValue(decision);
-      const params = makeParams({
-        state: "ask",
-        canConfirm: true,
-        promptForApproval,
-      });
-      await applyPermissionGate(params);
-      expect(params.writeLog).not.toHaveBeenCalled();
-    });
-  });
-
-  describe("ask branch — user approves", () => {
-    it("returns allow when user approves", async () => {
-      const decision: PermissionPromptDecision = {
-        approved: true,
-        state: "approved",
-      };
-      const promptForApproval = vi.fn().mockResolvedValue(decision);
-      const params = makeParams({
-        state: "ask",
-        canConfirm: true,
-        promptForApproval,
-      });
-      const result = await applyPermissionGate(params);
-      expect(result).toEqual({ action: "allow" });
-    });
-
-    it("does not call writeLog when user approves", async () => {
-      const decision: PermissionPromptDecision = {
-        approved: true,
-        state: "approved",
-      };
-      const promptForApproval = vi.fn().mockResolvedValue(decision);
-      const params = makeParams({
-        state: "ask",
-        canConfirm: true,
-        promptForApproval,
-      });
-      await applyPermissionGate(params);
-      expect(params.writeLog).not.toHaveBeenCalled();
-    });
-  });
-
-  describe("ask branch — approved_for_session with sessionApproval", () => {
-    it("attaches sessionApproval to result when decision is approved_for_session and param provided", async () => {
-      const decision: PermissionPromptDecision = {
-        approved: true,
-        state: "approved_for_session",
-      };
-      const promptForApproval = vi.fn().mockResolvedValue(decision);
-      const params = makeParams({
-        state: "ask",
-        canConfirm: true,
-        promptForApproval,
-        sessionApproval: { surface: "bash", pattern: "git *" },
-      });
-      const result = await applyPermissionGate(params);
-      expect(result).toEqual({
-        action: "allow",
-        sessionApproval: { surface: "bash", pattern: "git *" },
-      });
-    });
-
-    it("does not attach sessionApproval when decision is approved (once)", async () => {
-      const decision: PermissionPromptDecision = {
-        approved: true,
-        state: "approved",
-      };
-      const promptForApproval = vi.fn().mockResolvedValue(decision);
-      const params = makeParams({
-        state: "ask",
-        canConfirm: true,
-        promptForApproval,
-        sessionApproval: { surface: "bash", pattern: "git *" },
-      });
-      const result = await applyPermissionGate(params);
-      expect(result).toEqual({ action: "allow" });
-    });
-
-    it("does not attach sessionApproval when no sessionApproval param", async () => {
-      const decision: PermissionPromptDecision = {
-        approved: true,
-        state: "approved_for_session",
-      };
-      const promptForApproval = vi.fn().mockResolvedValue(decision);
-      const params = makeParams({
-        state: "ask",
-        canConfirm: true,
-        promptForApproval,
-      });
-      const result = await applyPermissionGate(params);
-      expect(result).toEqual({ action: "allow" });
-    });
-
-    it("does not attach sessionApproval when user denies", async () => {
-      const decision: PermissionPromptDecision = {
-        approved: false,
-        state: "denied",
-      };
-      const promptForApproval = vi.fn().mockResolvedValue(decision);
-      const params = makeParams({
-        state: "ask",
-        canConfirm: true,
-        promptForApproval,
-        sessionApproval: { surface: "bash", pattern: "git *" },
-      });
-      const result = await applyPermissionGate(params);
-      expect(result).toEqual({ action: "block", reason: "User denied." });
-    });
-  });
-
-  describe("allow branch", () => {
-    it("returns allow immediately when state is allow", async () => {
-      const params = makeParams({ state: "allow" });
-      const result = await applyPermissionGate(params);
-      expect(result).toEqual({ action: "allow" });
-    });
-
-    it("does not call writeLog when state is allow", async () => {
-      const params = makeParams({ state: "allow" });
-      await applyPermissionGate(params);
-      expect(params.writeLog).not.toHaveBeenCalled();
-    });
-
-    it("does not call promptForApproval when state is allow", async () => {
-      const params = makeParams({ state: "allow" });
-      await applyPermissionGate(params);
-      expect(params.promptForApproval).not.toHaveBeenCalled();
-    });
-  });
-});