@highflame/policy 2.0.8 → 2.0.9

package/src/context.gen.ts

@@ -1,10 +0,0 @@
-// Code generated by highflame-policy-codegen. DO NOT EDIT.
-// Source: schema/context.yaml
-
-/**
- * Context attribute keys for Cedar policy evaluation.
- */
-export const ContextKey = {
-} as const;
-
-export type ContextKey = (typeof ContextKey)[keyof typeof ContextKey];

package/src/engine.test.ts

@@ -1,370 +0,0 @@
-/**
- * Engine unit tests
- *
- * Tests the PolicyEngine evaluate() function.
- * These tests are consistent across Go, TypeScript, and Python SDKs.
- */
-
-import { describe, it, expect, beforeEach } from 'vitest';
-import {
-  PolicyEngine,
-  Decision,
-  EntityType,
-  ActionType,
-  InputValidationError,
-  DEFAULT_LIMITS,
-} from './index.js';
-
-describe('PolicyEngine', () => {
-  let engine: PolicyEngine;
-
-  const permitAllPolicy = `
-    permit(principal, action, resource);
-  `;
-
-  const denyAllPolicy = `
-    forbid(principal, action, resource);
-  `;
-
-  // Simple context-based policy without action constraint for testing context evaluation
-  const contextBasedPolicy = `
-    @id("allow-production")
-    permit(
-      principal,
-      action,
-      resource
-    )
-    when { context.environment == "production" };
-
-    @id("deny-all")
-    forbid(principal, action, resource);
-  `;
-
-  beforeEach(() => {
-    engine = new PolicyEngine();
-  });
-
-  describe('basic evaluation', () => {
-    it('should allow when permit policy matches', () => {
-      engine.loadPolicy(permitAllPolicy);
-
-      const decision = engine.evaluateSimple(
-        EntityType.Scanner,
-        'test-scanner',
-        ActionType.ScanArtifact,
-        EntityType.Artifact,
-        '/model.safetensors'
-      );
-
-      expect(decision.effect).toBe('Allow');
-    });
-
-    it('should deny when forbid policy matches', () => {
-      engine.loadPolicy(denyAllPolicy);
-
-      const decision = engine.evaluateSimple(
-        EntityType.Scanner,
-        'test-scanner',
-        ActionType.ScanArtifact,
-        EntityType.Artifact,
-        '/model.safetensors'
-      );
-
-      expect(decision.effect).toBe('Deny');
-    });
-
-    it('should deny when no policies match (default deny)', () => {
-      engine.loadPolicy(''); // No policies
-
-      const decision = engine.evaluateSimple(
-        EntityType.Scanner,
-        'test-scanner',
-        ActionType.ScanArtifact,
-        EntityType.Artifact,
-        '/model.safetensors'
-      );
-
-      expect(decision.effect).toBe('Deny');
-    });
-  });
-
-  describe('context-based evaluation', () => {
-    beforeEach(() => {
-      engine.loadPolicy(contextBasedPolicy);
-    });
-
-    it('should allow when context matches permit condition', () => {
-      // Use simple permit policy to test context evaluation in isolation
-      const simplePermitPolicy = `
-        permit(principal, action, resource)
-        when { context.environment == "production" };
-      `;
-      const testEngine = new PolicyEngine();
-      testEngine.loadPolicy(simplePermitPolicy);
-
-      const decision = testEngine.evaluateSimple(
-        EntityType.Scanner,
-        'palisade',
-        ActionType.ScanArtifact,
-        EntityType.Artifact,
-        '/model.safetensors',
-        { environment: 'production' }
-      );
-
-      expect(decision.effect).toBe('Allow');
-    });
-
-    it('should deny when context does not match permit condition', () => {
-      const decision = engine.evaluateSimple(
-        EntityType.Scanner,
-        'palisade',
-        ActionType.ScanArtifact,
-        EntityType.Artifact,
-        '/model.safetensors',
-        { environment: 'development' }
-      );
-
-      expect(decision.effect).toBe('Deny');
-    });
-
-    it('should deny when context is missing required field', () => {
-      const decision = engine.evaluateSimple(
-        EntityType.Scanner,
-        'palisade',
-        ActionType.ScanArtifact,
-        EntityType.Artifact,
-        '/model.safetensors',
-        {} // Missing environment
-      );
-
-      expect(decision.effect).toBe('Deny');
-    });
-  });
-
-  describe('input validation', () => {
-    beforeEach(() => {
-      engine.loadPolicy(permitAllPolicy);
-    });
-
-    it('should accept valid context', () => {
-      const decision = engine.evaluateSimple(
-        EntityType.Scanner,
-        'test',
-        ActionType.ScanArtifact,
-        EntityType.Artifact,
-        '/model.safetensors',
-        {
-          environment: 'production',
-          severity: 'HIGH',
-          count: 42,
-          enabled: true,
-        }
-      );
-
-      expect(decision.effect).toBe('Allow');
-    });
-
-    it('should reject context with too many keys', () => {
-      const engine = new PolicyEngine({ limits: { maxContextKeys: 5 } });
-      engine.loadPolicy(permitAllPolicy);
-
-      const bigContext: Record<string, unknown> = {};
-      for (let i = 0; i < 10; i++) {
-        bigContext[`key${i}`] = 'value';
-      }
-
-      expect(() => {
-        engine.evaluateSimple(
-          EntityType.Scanner,
-          'test',
-          ActionType.ScanArtifact,
-          EntityType.Artifact,
-          '/model.safetensors',
-          bigContext
-        );
-      }).toThrow(InputValidationError);
-    });
-
-    it('should reject context with too long strings', () => {
-      const engine = new PolicyEngine({ limits: { maxStringLength: 100 } });
-      engine.loadPolicy(permitAllPolicy);
-
-      const longString = 'x'.repeat(200);
-
-      expect(() => {
-        engine.evaluateSimple(
-          EntityType.Scanner,
-          'test',
-          ActionType.ScanArtifact,
-          EntityType.Artifact,
-          '/model.safetensors',
-          { value: longString }
-        );
-      }).toThrow(InputValidationError);
-    });
-
-    it('should reject deeply nested context', () => {
-      const engine = new PolicyEngine({ limits: { maxNestingDepth: 3 } });
-      engine.loadPolicy(permitAllPolicy);
-
-      const deepContext = {
-        level1: {
-          level2: {
-            level3: {
-              level4: {
-                level5: 'too deep',
-              },
-            },
-          },
-        },
-      };
-
-      expect(() => {
-        engine.evaluateSimple(
-          EntityType.Scanner,
-          'test',
-          ActionType.ScanArtifact,
-          EntityType.Artifact,
-          '/model.safetensors',
-          deepContext
-        );
-      }).toThrow(InputValidationError);
-    });
-
-    it('should allow skipping validation', () => {
-      const engine = new PolicyEngine({
-        skipValidation: true,
-        limits: { maxContextKeys: 1 },
-      });
-      engine.loadPolicy(permitAllPolicy);
-
-      // This would normally fail validation
-      const decision = engine.evaluateSimple(
-        EntityType.Scanner,
-        'test',
-        ActionType.ScanArtifact,
-        EntityType.Artifact,
-        '/model.safetensors',
-        { key1: 'value1', key2: 'value2', key3: 'value3' }
-      );
-
-      expect(decision.effect).toBe('Allow');
-    });
-  });
-
-  describe('complex context types', () => {
-    beforeEach(() => {
-      engine.loadPolicy(permitAllPolicy);
-    });
-
-    it('should handle array context values', () => {
-      const decision = engine.evaluateSimple(
-        EntityType.Scanner,
-        'test',
-        ActionType.ScanArtifact,
-        EntityType.Artifact,
-        '/model.safetensors',
-        { threats: ['malware', 'backdoor', 'injection'] }
-      );
-
-      expect(decision.effect).toBe('Allow');
-    });
-
-    it('should handle nested object context', () => {
-      const decision = engine.evaluateSimple(
-        EntityType.Scanner,
-        'test',
-        ActionType.ScanArtifact,
-        EntityType.Artifact,
-        '/model.safetensors',
-        {
-          metadata: {
-            format: 'safetensors',
-            size: 1024,
-          },
-        }
-      );
-
-      expect(decision.effect).toBe('Allow');
-    });
-
-    it('should handle empty context', () => {
-      // Cedar doesn't have null values - this tests that empty context works
-      const decision = engine.evaluateSimple(
-        EntityType.Scanner,
-        'test',
-        ActionType.ScanArtifact,
-        EntityType.Artifact,
-        '/model.safetensors',
-        {}
-      );
-
-      expect(decision.effect).toBe('Allow');
-    });
-
-    it('should handle boolean context values', () => {
-      const decision = engine.evaluateSimple(
-        EntityType.Scanner,
-        'test',
-        ActionType.ScanArtifact,
-        EntityType.Artifact,
-        '/model.safetensors',
-        { is_signed: true, is_malicious: false }
-      );
-
-      expect(decision.effect).toBe('Allow');
-    });
-
-    it('should handle integer context values', () => {
-      // Cedar uses Long type for numbers (integers only, no floats)
-      const decision = engine.evaluateSimple(
-        EntityType.Scanner,
-        'test',
-        ActionType.ScanArtifact,
-        EntityType.Artifact,
-        '/model.safetensors',
-        { severity_score: 7, count: 100 }
-      );
-
-      expect(decision.effect).toBe('Allow');
-    });
-  });
-
-  describe('error handling', () => {
-    it('should handle invalid policy syntax gracefully', () => {
-      const invalidPolicy = `permit(principal, action, resource`; // Missing closing paren
-
-      expect(() => {
-        engine.loadPolicy(invalidPolicy);
-        engine.evaluateSimple(
-          EntityType.Scanner,
-          'test',
-          ActionType.ScanArtifact,
-          EntityType.Artifact,
-          '/model.safetensors'
-        );
-      }).not.toThrow();
-
-      // Should return deny with reason
-      engine.loadPolicy(invalidPolicy);
-      const decision = engine.evaluateSimple(
-        EntityType.Scanner,
-        'test',
-        ActionType.ScanArtifact,
-        EntityType.Artifact,
-        '/model.safetensors'
-      );
-
-      expect(decision.effect).toBe('Deny');
-    });
-  });
-
-  describe('DEFAULT_LIMITS', () => {
-    it('should have consistent default values', () => {
-      expect(DEFAULT_LIMITS.maxContextKeys).toBe(100);
-      expect(DEFAULT_LIMITS.maxStringLength).toBe(1_000_000);
-      expect(DEFAULT_LIMITS.maxNestingDepth).toBe(10);
-      expect(DEFAULT_LIMITS.maxContextSizeBytes).toBe(10_000_000);
-    });
-  });
-});