@pikku/core 0.12.3 → 0.12.4

package/src/permissions.test.ts

@@ -1,434 +0,0 @@
-import { describe, test, beforeEach } from 'node:test'
-import * as assert from 'node:assert'
-import { addPermission, runPermissions } from './permissions.js'
-import { pikkuState, resetPikkuState } from './pikku-state.js'
-import type { CoreServices, CoreUserSession } from './types/core.types.js'
-import type {
-  CorePermissionGroup,
-  CorePikkuPermission,
-} from './function/functions.types.js'
-
-beforeEach(() => {
-  resetPikkuState()
-})
-
-// Test helper to get permissions for tags (not exported from core to keep it lean)
-const getPermissionsForTags = (
-  tags?: string[]
-): (CorePermissionGroup | CorePikkuPermission)[] => {
-  if (!tags || tags.length === 0) {
-    return []
-  }
-  const permissionsStore = pikkuState(null, 'permissions', 'tagGroup')
-  const result: (CorePermissionGroup | CorePikkuPermission)[] = []
-  for (const tag of new Set(tags)) {
-    const tagPermissions = permissionsStore[tag]
-    if (tagPermissions) {
-      if (Array.isArray(tagPermissions)) {
-        result.push(...tagPermissions)
-      } else {
-        result.push(tagPermissions)
-      }
-    }
-  }
-  return result
-}
-
-const mockServices: CoreServices = {
-  logger: {
-    info: () => {},
-    warn: () => {},
-    error: () => {},
-    debug: () => {},
-  },
-} as any
-
-const mockSession: CoreUserSession = {
-  userId: 'test-user',
-} as any
-
-describe('addPermission', () => {
-  test('should add single permission for a tag', () => {
-    const mockPermission = async () => true
-
-    addPermission('testTag', [mockPermission])
-
-    const permissions = getPermissionsForTags(['testTag'])
-    assert.equal(permissions.length, 1)
-    assert.equal(permissions[0], mockPermission)
-  })
-
-  test('should add multiple permissions for a tag', () => {
-    const mockPermission1 = async () => true
-    const mockPermission2 = async () => false
-
-    addPermission('multiTestTag', [mockPermission1, mockPermission2])
-
-    const permissions = getPermissionsForTags(['multiTestTag'])
-    assert.equal(permissions.length, 2)
-    assert.equal(permissions[0], mockPermission1)
-    assert.equal(permissions[1], mockPermission2)
-  })
-
-  test('should add permission group object for a tag', () => {
-    const mockPermissionGroup: CorePermissionGroup = {
-      permissions: [async () => true, async () => false],
-    }
-
-    addPermission('groupTestTag', mockPermissionGroup)
-
-    const permissions = getPermissionsForTags(['groupTestTag'])
-    assert.equal(permissions.length, 1)
-    assert.equal(permissions[0], mockPermissionGroup)
-  })
-
-  test('should apply parent tag permission to namespaced tag via runPermissions', async () => {
-    const billingPermission = async () => true
-
-    addPermission('billing', [billingPermission])
-
-    await runPermissions('rpc', Math.random().toString(), {
-      wireInheritedPermissions: [{ type: 'tag', tag: 'billing:write' }],
-      services: mockServices,
-      wire: {},
-      data: {},
-    })
-  })
-
-  test('should apply both parent and exact tag permissions', async () => {
-    const executionOrder: string[] = []
-    const billingPermission = async () => {
-      executionOrder.push('billing')
-      return true
-    }
-    const billingReadPermission = async () => {
-      executionOrder.push('billing:read')
-      return true
-    }
-
-    addPermission('billing', [billingPermission])
-    addPermission('billing:read', [billingReadPermission])
-
-    await runPermissions('rpc', Math.random().toString(), {
-      wireInheritedPermissions: [{ type: 'tag', tag: 'billing:read' }],
-      services: mockServices,
-      wire: {},
-      data: {},
-    })
-
-    assert.deepEqual(executionOrder, ['billing:read'])
-  })
-
-  test('should resolve multi-level namespace permissions', async () => {
-    const executionOrder: string[] = []
-    const billingPermission = async () => {
-      executionOrder.push('billing')
-      return false
-    }
-    const billingReadPermission = async () => {
-      executionOrder.push('billing:read')
-      return false
-    }
-    const billingReadAdminPermission = async () => {
-      executionOrder.push('billing:read:admin')
-      return true
-    }
-
-    addPermission('billing', [billingPermission])
-    addPermission('billing:read', [billingReadPermission])
-    addPermission('billing:read:admin', [billingReadAdminPermission])
-
-    await runPermissions('rpc', Math.random().toString(), {
-      wireInheritedPermissions: [{ type: 'tag', tag: 'billing:read:admin' }],
-      services: mockServices,
-      wire: {},
-      data: {},
-    })
-
-    assert.deepEqual(executionOrder, ['billing:read:admin'])
-  })
-
-  test('should apply parent tag permission via funcInheritedPermissions', async () => {
-    const billingPermission = async () => true
-
-    addPermission('billing', [billingPermission])
-
-    await runPermissions('rpc', Math.random().toString(), {
-      funcInheritedPermissions: [{ type: 'tag', tag: 'billing:delete' }],
-      services: mockServices,
-      wire: {},
-      data: {},
-    })
-  })
-
-  test('should throw error when tag already exists', () => {
-    const mockPermission = async () => true
-
-    addPermission('duplicateTag', [mockPermission])
-
-    assert.throws(
-      () => {
-        addPermission('duplicateTag', [mockPermission])
-      },
-      {
-        message:
-          "Permissions for tag 'duplicateTag' already exist. Use a different tag or remove the existing permissions first.",
-      }
-    )
-  })
-})
-
-describe('runPermissions', () => {
-  test('should pass when no permissions are defined', async () => {
-    // Should not throw
-    await runPermissions('rpc', Math.random().toString(), {
-      services: mockServices,
-      wire: {},
-      data: {},
-    })
-  })
-
-  test('should execute wiring tag permissions first', async () => {
-    const executionOrder: string[] = []
-    const wiringTagPermission = async () => {
-      executionOrder.push('wiringTag')
-      return true
-    }
-
-    addPermission('wiringTag', [wiringTagPermission])
-
-    await runPermissions('rpc', Math.random().toString(), {
-      wireInheritedPermissions: [{ type: 'tag', tag: 'wiringTag' }],
-      services: mockServices,
-      wire: {},
-      data: {},
-    })
-
-    assert.deepEqual(executionOrder, ['wiringTag'])
-  })
-
-  test('should execute all permission levels in correct order', async () => {
-    const executionOrder: string[] = []
-
-    const wiringTagPermission = async () => {
-      executionOrder.push('wiringTag')
-      return true
-    }
-    const funcTagPermission = async () => {
-      executionOrder.push('funcTag')
-      return true
-    }
-
-    addPermission('wiringTag', [wiringTagPermission])
-    addPermission('funcTag', [funcTagPermission])
-
-    const wirePermissions: CorePermissionGroup = {
-      permissions: [
-        async () => {
-          executionOrder.push('wiringPermission')
-          return true
-        },
-      ],
-    }
-
-    const funcPermissions: CorePermissionGroup = {
-      permissions: [
-        async () => {
-          executionOrder.push('funcPermission')
-          return true
-        },
-      ],
-    }
-
-    await runPermissions('rpc', Math.random().toString(), {
-      wireInheritedPermissions: [{ type: 'tag', tag: 'wiringTag' }],
-      wirePermissions,
-      funcInheritedPermissions: [{ type: 'tag', tag: 'funcTag' }],
-      funcPermissions,
-      services: mockServices,
-      wire: {},
-      data: {},
-    })
-
-    // Order: wireInheritedPermissions (wiringTag) only (short-circuit on first passing group)
-    assert.deepEqual(executionOrder, ['wiringTag'])
-  })
-
-  test('should implement "at least one must pass" logic for tag permissions', async () => {
-    const failingPermission = async () => false
-    const passingPermission = async () => true
-
-    addPermission('atLeastOneTestTag', [failingPermission, passingPermission])
-
-    // Should not throw because at least one permission passes
-    await runPermissions('rpc', Math.random().toString(), {
-      wireInheritedPermissions: [{ type: 'tag', tag: 'atLeastOneTestTag' }],
-      services: mockServices,
-      wire: {},
-      data: {},
-    })
-  })
-
-  test('should throw error when all wiring tag permissions fail', async () => {
-    const failingPermission1 = async () => false
-    const failingPermission2 = async () => false
-
-    addPermission('allFailTestTag', [failingPermission1, failingPermission2])
-
-    await assert.rejects(
-      runPermissions('rpc', Math.random().toString(), {
-        wireInheritedPermissions: [{ type: 'tag', tag: 'allFailTestTag' }],
-        services: mockServices,
-        wire: {},
-        data: {},
-      }),
-      {
-        message: 'Permission denied',
-      }
-    )
-  })
-
-  test('should throw error when wiring permissions fail', async () => {
-    const wirePermissions: CorePermissionGroup = {
-      permissions: [async () => false],
-    }
-
-    await assert.rejects(
-      runPermissions('rpc', Math.random().toString(), {
-        wirePermissions,
-        services: mockServices,
-        wire: {},
-        data: {},
-      }),
-      {
-        message: 'Permission denied',
-      }
-    )
-  })
-
-  test('should throw error when all function tag permissions fail', async () => {
-    const failingPermission = async () => false
-
-    addPermission('funcTag', [failingPermission])
-
-    await assert.rejects(
-      runPermissions('rpc', Math.random().toString(), {
-        funcInheritedPermissions: [{ type: 'tag', tag: 'funcTag' }],
-        services: mockServices,
-        wire: {},
-        data: {},
-      }),
-      {
-        message: 'Permission denied',
-      }
-    )
-  })
-
-  test('should throw error when function permissions fail', async () => {
-    const funcPermissions: CorePermissionGroup = {
-      permissions: [async () => false],
-    }
-
-    await assert.rejects(
-      runPermissions('rpc', Math.random().toString(), {
-        funcPermissions,
-        services: mockServices,
-        wire: {},
-        data: {},
-      }),
-      {
-        message: 'Permission denied',
-      }
-    )
-  })
-
-  test('should evaluate all permissions and pass if at least one succeeds', async () => {
-    const executionOrder: string[] = []
-
-    const failingWiringTagPermission = async () => {
-      executionOrder.push('wiringTag')
-      return false
-    }
-
-    addPermission('failingWiringTag', [failingWiringTagPermission])
-
-    const wirePermissions: CorePermissionGroup = {
-      permissions: [
-        async () => {
-          executionOrder.push('wiringPermission')
-          return true
-        },
-      ],
-    }
-
-    // Should NOT throw because at least one permission (wirePermissions) passes
-    await runPermissions('rpc', Math.random().toString(), {
-      wireInheritedPermissions: [{ type: 'tag', tag: 'failingWiringTag' }],
-      wirePermissions,
-      services: mockServices,
-      wire: {},
-      data: {},
-    })
-
-    // Both permissions should be evaluated
-    assert.deepEqual(executionOrder, ['wiringTag', 'wiringPermission'])
-  })
-
-  test('should handle array permissions in tag-based permissions', async () => {
-    const arrayPermission = [async () => true, async () => false]
-
-    addPermission('arrayTestTag', arrayPermission)
-
-    // Should not throw because verifyPermissions handles array properly
-    await runPermissions('rpc', Math.random().toString(), {
-      wireInheritedPermissions: [{ type: 'tag', tag: 'arrayTestTag' }],
-      services: mockServices,
-      wire: {},
-      data: {},
-    })
-  })
-
-  test('should handle permission group objects in tag-based permissions', async () => {
-    const permissionGroup: CorePermissionGroup = {
-      permissions: [async () => true],
-    }
-
-    addPermission('objectTestTag', permissionGroup)
-
-    // Should not throw because verifyPermissions handles objects properly
-    await runPermissions('rpc', Math.random().toString(), {
-      wireInheritedPermissions: [{ type: 'tag', tag: 'objectTestTag' }],
-      services: mockServices,
-      wire: {},
-      data: {},
-    })
-  })
-
-  test('should pass correct parameters to permission functions', async () => {
-    let receivedServices: any
-    let receivedWire: any
-    let receivedData: any
-
-    const testPermission = async (services: any, data: any, wire: any) => {
-      receivedServices = services
-      receivedData = data
-      receivedWire = wire
-      return true
-    }
-
-    const testData = { test: 'data' }
-
-    addPermission('paramTestTag', [testPermission])
-
-    await runPermissions('rpc', Math.random().toString(), {
-      wireInheritedPermissions: [{ type: 'tag', tag: 'paramTestTag' }],
-      services: mockServices,
-      wire: {},
-      data: testData,
-    })
-
-    assert.equal(receivedServices, mockServices)
-    assert.equal(receivedData, testData)
-    assert.deepEqual(receivedWire, {})
-  })
-})