@pikku/core 0.12.4 → 0.12.6

package/src/permissions.test.ts

@@ -0,0 +1,434 @@
+import { describe, test, beforeEach } from 'node:test'
+import * as assert from 'node:assert'
+import { addPermission, runPermissions } from './permissions.js'
+import { pikkuState, resetPikkuState } from './pikku-state.js'
+import type { CoreServices, CoreUserSession } from './types/core.types.js'
+import type {
+  CorePermissionGroup,
+  CorePikkuPermission,
+} from './function/functions.types.js'
+
+beforeEach(() => {
+  resetPikkuState()
+})
+
+// Test helper to get permissions for tags (not exported from core to keep it lean)
+const getPermissionsForTags = (
+  tags?: string[]
+): (CorePermissionGroup | CorePikkuPermission)[] => {
+  if (!tags || tags.length === 0) {
+    return []
+  }
+  const permissionsStore = pikkuState(null, 'permissions', 'tagGroup')
+  const result: (CorePermissionGroup | CorePikkuPermission)[] = []
+  for (const tag of new Set(tags)) {
+    const tagPermissions = permissionsStore[tag]
+    if (tagPermissions) {
+      if (Array.isArray(tagPermissions)) {
+        result.push(...tagPermissions)
+      } else {
+        result.push(tagPermissions)
+      }
+    }
+  }
+  return result
+}
+
+const mockServices: CoreServices = {
+  logger: {
+    info: () => {},
+    warn: () => {},
+    error: () => {},
+    debug: () => {},
+  },
+} as any
+
+const mockSession: CoreUserSession = {
+  userId: 'test-user',
+} as any
+
+describe('addPermission', () => {
+  test('should add single permission for a tag', () => {
+    const mockPermission = async () => true
+
+    addPermission('testTag', [mockPermission])
+
+    const permissions = getPermissionsForTags(['testTag'])
+    assert.equal(permissions.length, 1)
+    assert.equal(permissions[0], mockPermission)
+  })
+
+  test('should add multiple permissions for a tag', () => {
+    const mockPermission1 = async () => true
+    const mockPermission2 = async () => false
+
+    addPermission('multiTestTag', [mockPermission1, mockPermission2])
+
+    const permissions = getPermissionsForTags(['multiTestTag'])
+    assert.equal(permissions.length, 2)
+    assert.equal(permissions[0], mockPermission1)
+    assert.equal(permissions[1], mockPermission2)
+  })
+
+  test('should add permission group object for a tag', () => {
+    const mockPermissionGroup: CorePermissionGroup = {
+      permissions: [async () => true, async () => false],
+    }
+
+    addPermission('groupTestTag', mockPermissionGroup)
+
+    const permissions = getPermissionsForTags(['groupTestTag'])
+    assert.equal(permissions.length, 1)
+    assert.equal(permissions[0], mockPermissionGroup)
+  })
+
+  test('should apply parent tag permission to namespaced tag via runPermissions', async () => {
+    const billingPermission = async () => true
+
+    addPermission('billing', [billingPermission])
+
+    await runPermissions('rpc', Math.random().toString(), {
+      wireInheritedPermissions: [{ type: 'tag', tag: 'billing:write' }],
+      services: mockServices,
+      wire: {},
+      data: {},
+    })
+  })
+
+  test('should apply both parent and exact tag permissions', async () => {
+    const executionOrder: string[] = []
+    const billingPermission = async () => {
+      executionOrder.push('billing')
+      return true
+    }
+    const billingReadPermission = async () => {
+      executionOrder.push('billing:read')
+      return true
+    }
+
+    addPermission('billing', [billingPermission])
+    addPermission('billing:read', [billingReadPermission])
+
+    await runPermissions('rpc', Math.random().toString(), {
+      wireInheritedPermissions: [{ type: 'tag', tag: 'billing:read' }],
+      services: mockServices,
+      wire: {},
+      data: {},
+    })
+
+    assert.deepEqual(executionOrder, ['billing:read'])
+  })
+
+  test('should resolve multi-level namespace permissions', async () => {
+    const executionOrder: string[] = []
+    const billingPermission = async () => {
+      executionOrder.push('billing')
+      return false
+    }
+    const billingReadPermission = async () => {
+      executionOrder.push('billing:read')
+      return false
+    }
+    const billingReadAdminPermission = async () => {
+      executionOrder.push('billing:read:admin')
+      return true
+    }
+
+    addPermission('billing', [billingPermission])
+    addPermission('billing:read', [billingReadPermission])
+    addPermission('billing:read:admin', [billingReadAdminPermission])
+
+    await runPermissions('rpc', Math.random().toString(), {
+      wireInheritedPermissions: [{ type: 'tag', tag: 'billing:read:admin' }],
+      services: mockServices,
+      wire: {},
+      data: {},
+    })
+
+    assert.deepEqual(executionOrder, ['billing:read:admin'])
+  })
+
+  test('should apply parent tag permission via funcInheritedPermissions', async () => {
+    const billingPermission = async () => true
+
+    addPermission('billing', [billingPermission])
+
+    await runPermissions('rpc', Math.random().toString(), {
+      funcInheritedPermissions: [{ type: 'tag', tag: 'billing:delete' }],
+      services: mockServices,
+      wire: {},
+      data: {},
+    })
+  })
+
+  test('should throw error when tag already exists', () => {
+    const mockPermission = async () => true
+
+    addPermission('duplicateTag', [mockPermission])
+
+    assert.throws(
+      () => {
+        addPermission('duplicateTag', [mockPermission])
+      },
+      {
+        message:
+          "Permissions for tag 'duplicateTag' already exist. Use a different tag or remove the existing permissions first.",
+      }
+    )
+  })
+})
+
+describe('runPermissions', () => {
+  test('should pass when no permissions are defined', async () => {
+    // Should not throw
+    await runPermissions('rpc', Math.random().toString(), {
+      services: mockServices,
+      wire: {},
+      data: {},
+    })
+  })
+
+  test('should execute wiring tag permissions first', async () => {
+    const executionOrder: string[] = []
+    const wiringTagPermission = async () => {
+      executionOrder.push('wiringTag')
+      return true
+    }
+
+    addPermission('wiringTag', [wiringTagPermission])
+
+    await runPermissions('rpc', Math.random().toString(), {
+      wireInheritedPermissions: [{ type: 'tag', tag: 'wiringTag' }],
+      services: mockServices,
+      wire: {},
+      data: {},
+    })
+
+    assert.deepEqual(executionOrder, ['wiringTag'])
+  })
+
+  test('should execute all permission levels in correct order', async () => {
+    const executionOrder: string[] = []
+
+    const wiringTagPermission = async () => {
+      executionOrder.push('wiringTag')
+      return true
+    }
+    const funcTagPermission = async () => {
+      executionOrder.push('funcTag')
+      return true
+    }
+
+    addPermission('wiringTag', [wiringTagPermission])
+    addPermission('funcTag', [funcTagPermission])
+
+    const wirePermissions: CorePermissionGroup = {
+      permissions: [
+        async () => {
+          executionOrder.push('wiringPermission')
+          return true
+        },
+      ],
+    }
+
+    const funcPermissions: CorePermissionGroup = {
+      permissions: [
+        async () => {
+          executionOrder.push('funcPermission')
+          return true
+        },
+      ],
+    }
+
+    await runPermissions('rpc', Math.random().toString(), {
+      wireInheritedPermissions: [{ type: 'tag', tag: 'wiringTag' }],
+      wirePermissions,
+      funcInheritedPermissions: [{ type: 'tag', tag: 'funcTag' }],
+      funcPermissions,
+      services: mockServices,
+      wire: {},
+      data: {},
+    })
+
+    // Order: wireInheritedPermissions (wiringTag) only (short-circuit on first passing group)
+    assert.deepEqual(executionOrder, ['wiringTag'])
+  })
+
+  test('should implement "at least one must pass" logic for tag permissions', async () => {
+    const failingPermission = async () => false
+    const passingPermission = async () => true
+
+    addPermission('atLeastOneTestTag', [failingPermission, passingPermission])
+
+    // Should not throw because at least one permission passes
+    await runPermissions('rpc', Math.random().toString(), {
+      wireInheritedPermissions: [{ type: 'tag', tag: 'atLeastOneTestTag' }],
+      services: mockServices,
+      wire: {},
+      data: {},
+    })
+  })
+
+  test('should throw error when all wiring tag permissions fail', async () => {
+    const failingPermission1 = async () => false
+    const failingPermission2 = async () => false
+
+    addPermission('allFailTestTag', [failingPermission1, failingPermission2])
+
+    await assert.rejects(
+      runPermissions('rpc', Math.random().toString(), {
+        wireInheritedPermissions: [{ type: 'tag', tag: 'allFailTestTag' }],
+        services: mockServices,
+        wire: {},
+        data: {},
+      }),
+      {
+        message: 'Permission denied',
+      }
+    )
+  })
+
+  test('should throw error when wiring permissions fail', async () => {
+    const wirePermissions: CorePermissionGroup = {
+      permissions: [async () => false],
+    }
+
+    await assert.rejects(
+      runPermissions('rpc', Math.random().toString(), {
+        wirePermissions,
+        services: mockServices,
+        wire: {},
+        data: {},
+      }),
+      {
+        message: 'Permission denied',
+      }
+    )
+  })
+
+  test('should throw error when all function tag permissions fail', async () => {
+    const failingPermission = async () => false
+
+    addPermission('funcTag', [failingPermission])
+
+    await assert.rejects(
+      runPermissions('rpc', Math.random().toString(), {
+        funcInheritedPermissions: [{ type: 'tag', tag: 'funcTag' }],
+        services: mockServices,
+        wire: {},
+        data: {},
+      }),
+      {
+        message: 'Permission denied',
+      }
+    )
+  })
+
+  test('should throw error when function permissions fail', async () => {
+    const funcPermissions: CorePermissionGroup = {
+      permissions: [async () => false],
+    }
+
+    await assert.rejects(
+      runPermissions('rpc', Math.random().toString(), {
+        funcPermissions,
+        services: mockServices,
+        wire: {},
+        data: {},
+      }),
+      {
+        message: 'Permission denied',
+      }
+    )
+  })
+
+  test('should evaluate all permissions and pass if at least one succeeds', async () => {
+    const executionOrder: string[] = []
+
+    const failingWiringTagPermission = async () => {
+      executionOrder.push('wiringTag')
+      return false
+    }
+
+    addPermission('failingWiringTag', [failingWiringTagPermission])
+
+    const wirePermissions: CorePermissionGroup = {
+      permissions: [
+        async () => {
+          executionOrder.push('wiringPermission')
+          return true
+        },
+      ],
+    }
+
+    // Should NOT throw because at least one permission (wirePermissions) passes
+    await runPermissions('rpc', Math.random().toString(), {
+      wireInheritedPermissions: [{ type: 'tag', tag: 'failingWiringTag' }],
+      wirePermissions,
+      services: mockServices,
+      wire: {},
+      data: {},
+    })
+
+    // Both permissions should be evaluated
+    assert.deepEqual(executionOrder, ['wiringTag', 'wiringPermission'])
+  })
+
+  test('should handle array permissions in tag-based permissions', async () => {
+    const arrayPermission = [async () => true, async () => false]
+
+    addPermission('arrayTestTag', arrayPermission)
+
+    // Should not throw because verifyPermissions handles array properly
+    await runPermissions('rpc', Math.random().toString(), {
+      wireInheritedPermissions: [{ type: 'tag', tag: 'arrayTestTag' }],
+      services: mockServices,
+      wire: {},
+      data: {},
+    })
+  })
+
+  test('should handle permission group objects in tag-based permissions', async () => {
+    const permissionGroup: CorePermissionGroup = {
+      permissions: [async () => true],
+    }
+
+    addPermission('objectTestTag', permissionGroup)
+
+    // Should not throw because verifyPermissions handles objects properly
+    await runPermissions('rpc', Math.random().toString(), {
+      wireInheritedPermissions: [{ type: 'tag', tag: 'objectTestTag' }],
+      services: mockServices,
+      wire: {},
+      data: {},
+    })
+  })
+
+  test('should pass correct parameters to permission functions', async () => {
+    let receivedServices: any
+    let receivedWire: any
+    let receivedData: any
+
+    const testPermission = async (services: any, data: any, wire: any) => {
+      receivedServices = services
+      receivedData = data
+      receivedWire = wire
+      return true
+    }
+
+    const testData = { test: 'data' }
+
+    addPermission('paramTestTag', [testPermission])
+
+    await runPermissions('rpc', Math.random().toString(), {
+      wireInheritedPermissions: [{ type: 'tag', tag: 'paramTestTag' }],
+      services: mockServices,
+      wire: {},
+      data: testData,
+    })
+
+    assert.equal(receivedServices, mockServices)
+    assert.equal(receivedData, testData)
+    assert.deepEqual(receivedWire, {})
+  })
+})