offrouter-core 0.0.0

package/src/policy.test.ts

@@ -0,0 +1,634 @@
+import { describe, expect, it } from "vitest";
+import { evaluatePolicy, type PolicyConfig } from "./policy.js";
+import type { ProviderCandidate, RouteRequest } from "./types.js";
+
+function baseRequest(
+  overrides: Partial<RouteRequest> & {
+    harness?: Partial<RouteRequest["harness"]>;
+    task?: Partial<RouteRequest["task"]>;
+    workspace?: Partial<RouteRequest["workspace"]>;
+    constraints?: Partial<RouteRequest["constraints"]>;
+  } = {},
+): RouteRequest {
+  return {
+    protocolVersion: "offrouter.route.v1",
+    requestId: overrides.requestId ?? "req_1",
+    harness: {
+      kind: "claude",
+      profile: "claude-personal",
+      ...overrides.harness,
+    },
+    task: {
+      promptPreview: "explain this repo",
+      promptDigest: "sha256:example",
+      kind: "explain",
+      risk: "low",
+      ...overrides.task,
+    },
+    workspace: {
+      cwd: "/tmp/project",
+      trusted: true,
+      ...overrides.workspace,
+    },
+    constraints: {
+      maxCostUsd: 1,
+      localOnly: false,
+      subscriptionFirst: true,
+      allowApiKeyFallback: true,
+      ...overrides.constraints,
+    },
+  };
+}
+
+function candidate(
+  partial: Partial<ProviderCandidate> &
+    Pick<ProviderCandidate, "providerId" | "modelId" | "authTier">,
+): ProviderCandidate {
+  return {
+    authScope: "first-party",
+    health: "healthy",
+    supportsTools: true,
+    supportsStreaming: true,
+    supportsJson: true,
+    supportsImages: false,
+    estimatedCostUsd: 0.01,
+    ...partial,
+  };
+}
+
+const personalConfig: PolicyConfig = {
+  allowlistedProfiles: ["claude-personal", "codex-personal", "gemini-personal"],
+  deniedProfilePatterns: ["*-work"],
+};
+
+describe("evaluatePolicy", () => {
+  it("allows claude-personal", () => {
+    const result = evaluatePolicy(
+      baseRequest({ harness: { profile: "claude-personal" } }),
+      [
+        candidate({
+          providerId: "claude",
+          modelId: "sonnet",
+          authTier: "subscription",
+          subscriptionStatus: "active",
+        }),
+      ],
+      personalConfig,
+    );
+
+    expect(result.allowed).toHaveLength(1);
+    expect(result.denials).toEqual([]);
+  });
+
+  it("denies claude-work", () => {
+    const result = evaluatePolicy(
+      baseRequest({ harness: { profile: "claude-work" } }),
+      [
+        candidate({
+          providerId: "claude",
+          modelId: "sonnet",
+          authTier: "subscription",
+          subscriptionStatus: "active",
+        }),
+      ],
+      personalConfig,
+    );
+
+    expect(result.allowed).toHaveLength(0);
+    expect(result.denials).toContainEqual(
+      expect.objectContaining({
+        code: "work_profile_denied",
+        target: "profile",
+        id: "claude-work",
+      }),
+    );
+  });
+
+  it("denies wildcard *-work profiles", () => {
+    for (const profile of ["codex-work", "gemini-work", "pi-work"]) {
+      const result = evaluatePolicy(
+        baseRequest({ harness: { profile } }),
+        [
+          candidate({
+            providerId: "fake",
+            modelId: "fast",
+            authTier: "api-key",
+          }),
+        ],
+        personalConfig,
+      );
+
+      expect(result.allowed).toHaveLength(0);
+      expect(result.denials).toContainEqual(
+        expect.objectContaining({
+          code: "work_profile_denied",
+          id: profile,
+        }),
+      );
+    }
+  });
+
+  it("always denies *-work profiles even with custom deny patterns", () => {
+    const result = evaluatePolicy(
+      baseRequest({ harness: { profile: "claude-work" } }),
+      [
+        candidate({
+          providerId: "fake",
+          modelId: "fast",
+          authTier: "api-key",
+        }),
+      ],
+      {
+        allowlistedProfiles: ["claude-work"],
+        deniedProfilePatterns: ["corp-*"],
+      },
+    );
+
+    expect(result.allowed).toHaveLength(0);
+    expect(result.denials).toContainEqual(
+      expect.objectContaining({
+        code: "work_profile_denied",
+        id: "claude-work",
+      }),
+    );
+  });
+
+  it("denies work-like staging profiles (e.g. claude-work-staging) even when allowlisted", () => {
+    for (const profile of ["claude-work-staging", "codex-work-staging"]) {
+      const result = evaluatePolicy(
+        baseRequest({ harness: { profile } }),
+        [
+          candidate({
+            providerId: "fake",
+            modelId: "fast",
+            authTier: "api-key",
+          }),
+        ],
+        {
+          // Work-like ids are denied by default even if explicitly allowlisted.
+          allowlistedProfiles: [profile],
+        },
+      );
+
+      expect(result.allowed).toHaveLength(0);
+      expect(result.denials).toContainEqual(
+        expect.objectContaining({
+          code: "work_profile_denied",
+          target: "profile",
+          id: profile,
+        }),
+      );
+    }
+  });
+
+  it("denies unallowlisted personal profiles", () => {
+    const result = evaluatePolicy(
+      baseRequest({ harness: { profile: "cursor-personal" } }),
+      [
+        candidate({
+          providerId: "cursor",
+          modelId: "default",
+          authTier: "subscription",
+          subscriptionStatus: "active",
+        }),
+      ],
+      personalConfig,
+    );
+
+    expect(result.allowed).toHaveLength(0);
+    expect(result.denials).toContainEqual(
+      expect.objectContaining({
+        code: "profile_not_allowlisted",
+        target: "profile",
+        id: "cursor-personal",
+      }),
+    );
+  });
+
+  it("excludes remote providers when localOnly is set", () => {
+    const result = evaluatePolicy(
+      baseRequest({ constraints: { localOnly: true } }),
+      [
+        candidate({
+          providerId: "ollama",
+          modelId: "llama",
+          authTier: "local",
+          estimatedCostUsd: 0,
+        }),
+        candidate({
+          providerId: "openrouter",
+          modelId: "fast",
+          authTier: "api-key",
+          authScope: "third-party",
+          estimatedCostUsd: 0.001,
+        }),
+        candidate({
+          providerId: "claude",
+          modelId: "sonnet",
+          authTier: "subscription",
+          subscriptionStatus: "active",
+        }),
+      ],
+      personalConfig,
+    );
+
+    expect(result.allowed.map((c) => c.providerId)).toEqual(["ollama"]);
+    expect(result.denials).toContainEqual(
+      expect.objectContaining({
+        code: "local_only_required",
+        id: "openrouter:fast",
+      }),
+    );
+    expect(result.denials).toContainEqual(
+      expect.objectContaining({
+        code: "local_only_required",
+        id: "claude:sonnet",
+      }),
+    );
+  });
+
+  it("excludes expensive providers under maxCostUsd", () => {
+    const result = evaluatePolicy(
+      baseRequest({ constraints: { maxCostUsd: 0.05 } }),
+      [
+        candidate({
+          providerId: "cheap",
+          modelId: "fast",
+          authTier: "api-key",
+          estimatedCostUsd: 0.01,
+        }),
+        candidate({
+          providerId: "expensive",
+          modelId: "opus",
+          authTier: "api-key",
+          estimatedCostUsd: 0.5,
+        }),
+      ],
+      personalConfig,
+    );
+
+    expect(result.allowed.map((c) => c.providerId)).toEqual(["cheap"]);
+    expect(result.denials).toContainEqual(
+      expect.objectContaining({
+        code: "cost_cap_exceeded",
+        id: "expensive:opus",
+      }),
+    );
+  });
+
+  it("excludes unknown-cost API-key providers under maxCostUsd", () => {
+    const result = evaluatePolicy(
+      baseRequest({ constraints: { maxCostUsd: 0.05 } }),
+      [
+        candidate({
+          providerId: "unknown-cost",
+          modelId: "fast",
+          authTier: "api-key",
+          estimatedCostUsd: undefined,
+        }),
+      ],
+      personalConfig,
+    );
+
+    expect(result.allowed).toHaveLength(0);
+    expect(result.denials).toContainEqual(
+      expect.objectContaining({
+        code: "cost_cap_exceeded",
+        id: "unknown-cost:fast",
+      }),
+    );
+  });
+
+  it("blocks untrusted workspaces", () => {
+    const result = evaluatePolicy(
+      baseRequest({ workspace: { trusted: false } }),
+      [
+        candidate({
+          providerId: "claude",
+          modelId: "sonnet",
+          authTier: "subscription",
+          subscriptionStatus: "active",
+        }),
+      ],
+      personalConfig,
+    );
+
+    expect(result.allowed).toHaveLength(0);
+    expect(result.denials).toContainEqual(
+      expect.objectContaining({
+        code: "project_untrusted",
+        target: "workspace",
+      }),
+    );
+  });
+
+  it("excludes API-key candidates while a healthy subscription can satisfy the task", () => {
+    const result = evaluatePolicy(
+      baseRequest({
+        constraints: { subscriptionFirst: true, allowApiKeyFallback: true },
+      }),
+      [
+        candidate({
+          providerId: "claude",
+          modelId: "sonnet",
+          authTier: "subscription",
+          subscriptionStatus: "active",
+          health: "healthy",
+          estimatedCostUsd: 0,
+        }),
+        candidate({
+          providerId: "openrouter",
+          modelId: "fast",
+          authTier: "api-key",
+          authScope: "third-party",
+          estimatedCostUsd: 0.001,
+        }),
+      ],
+      personalConfig,
+    );
+
+    expect(result.allowed.map((c) => c.providerId)).toEqual(["claude"]);
+    expect(result.denials).toContainEqual(
+      expect.objectContaining({
+        code: "api_key_blocked_by_subscription_first_policy",
+        target: "candidate",
+        id: "openrouter:fast",
+      }),
+    );
+  });
+
+  it("allows API-key fallback when only a degraded subscription can satisfy the task", () => {
+    const result = evaluatePolicy(
+      baseRequest({
+        constraints: { subscriptionFirst: true, allowApiKeyFallback: true },
+      }),
+      [
+        candidate({
+          providerId: "claude",
+          modelId: "sonnet",
+          authTier: "subscription",
+          subscriptionStatus: "active",
+          health: "degraded",
+          estimatedCostUsd: 0,
+        }),
+        candidate({
+          providerId: "openrouter",
+          modelId: "fast",
+          authTier: "api-key",
+          authScope: "third-party",
+          estimatedCostUsd: 0.001,
+        }),
+      ],
+      personalConfig,
+    );
+
+    expect(result.allowed.map((c) => c.providerId)).toEqual([
+      "claude",
+      "openrouter",
+    ]);
+    expect(result.denials).not.toContainEqual(
+      expect.objectContaining({
+        code: "api_key_blocked_by_subscription_first_policy",
+      }),
+    );
+  });
+
+  it("allows API-key candidates through policy when subscriptionFirst is disabled", () => {
+    const result = evaluatePolicy(
+      baseRequest({
+        constraints: { subscriptionFirst: false, allowApiKeyFallback: false },
+      }),
+      [
+        candidate({
+          providerId: "claude",
+          modelId: "sonnet",
+          authTier: "subscription",
+          subscriptionStatus: "active",
+          health: "healthy",
+          estimatedCostUsd: 0,
+        }),
+        candidate({
+          providerId: "openrouter",
+          modelId: "fast",
+          authTier: "api-key",
+          authScope: "third-party",
+          estimatedCostUsd: 0.001,
+        }),
+      ],
+      personalConfig,
+    );
+
+    expect(result.allowed.map((c) => c.providerId)).toEqual([
+      "claude",
+      "openrouter",
+    ]);
+  });
+
+  it("allows API-key fallback only when subscriptions are exhausted, rate-limited, unavailable, or policy-ineligible", () => {
+    const cases: Array<{
+      label: string;
+      candidates: ProviderCandidate[];
+      expectApiKeyAllowed: boolean;
+    }> = [
+      {
+        label: "exhausted",
+        candidates: [
+          candidate({
+            providerId: "claude",
+            modelId: "sonnet",
+            authTier: "subscription",
+            subscriptionStatus: "exhausted",
+            health: "healthy",
+          }),
+          candidate({
+            providerId: "openrouter",
+            modelId: "fast",
+            authTier: "api-key",
+            authScope: "third-party",
+          }),
+        ],
+        expectApiKeyAllowed: true,
+      },
+      {
+        label: "rate-limited",
+        candidates: [
+          candidate({
+            providerId: "claude",
+            modelId: "sonnet",
+            authTier: "subscription",
+            subscriptionStatus: "rate-limited",
+            health: "healthy",
+          }),
+          candidate({
+            providerId: "openrouter",
+            modelId: "fast",
+            authTier: "api-key",
+            authScope: "third-party",
+          }),
+        ],
+        expectApiKeyAllowed: true,
+      },
+      {
+        label: "unconfigured subscription",
+        candidates: [
+          candidate({
+            providerId: "claude",
+            modelId: "sonnet",
+            authTier: "subscription",
+            subscriptionStatus: "unconfigured",
+            health: "dead",
+          }),
+          candidate({
+            providerId: "openrouter",
+            modelId: "fast",
+            authTier: "api-key",
+            authScope: "third-party",
+          }),
+        ],
+        expectApiKeyAllowed: true,
+      },
+      {
+        label: "no subscription candidates",
+        candidates: [
+          candidate({
+            providerId: "openrouter",
+            modelId: "fast",
+            authTier: "api-key",
+            authScope: "third-party",
+          }),
+        ],
+        expectApiKeyAllowed: true,
+      },
+      {
+        label: "subscription tool-ineligible for tool task",
+        candidates: [
+          candidate({
+            providerId: "claude",
+            modelId: "text",
+            authTier: "subscription",
+            subscriptionStatus: "active",
+            health: "healthy",
+            supportsTools: false,
+          }),
+          candidate({
+            providerId: "openrouter",
+            modelId: "tools",
+            authTier: "api-key",
+            authScope: "third-party",
+            supportsTools: true,
+          }),
+        ],
+        expectApiKeyAllowed: true,
+      },
+    ];
+
+    for (const { label, candidates, expectApiKeyAllowed } of cases) {
+      const result = evaluatePolicy(
+        baseRequest({
+          task: {
+            kind: label.includes("tool") ? "tools" : "explain",
+            requiresTools: label.includes("tool"),
+          },
+          constraints: { subscriptionFirst: true, allowApiKeyFallback: true },
+        }),
+        candidates,
+        personalConfig,
+      );
+
+      const apiKeyAllowed = result.allowed.some((c) => c.authTier === "api-key");
+      expect(apiKeyAllowed, label).toBe(expectApiKeyAllowed);
+    }
+  });
+
+  it("denies API-key fallback when allowApiKeyFallback is false even if subscription is exhausted", () => {
+    const result = evaluatePolicy(
+      baseRequest({
+        constraints: { subscriptionFirst: true, allowApiKeyFallback: false },
+      }),
+      [
+        candidate({
+          providerId: "claude",
+          modelId: "sonnet",
+          authTier: "subscription",
+          subscriptionStatus: "exhausted",
+        }),
+        candidate({
+          providerId: "openrouter",
+          modelId: "fast",
+          authTier: "api-key",
+          authScope: "third-party",
+        }),
+      ],
+      personalConfig,
+    );
+
+    expect(result.allowed).toHaveLength(0);
+    expect(result.denials).toContainEqual(
+      expect.objectContaining({
+        code: "api_key_blocked_by_subscription_first_policy",
+        id: "openrouter:fast",
+      }),
+    );
+  });
+
+  it("denies first-party subscription surface used as third-party unless policy allows", () => {
+    const thirdPartySub = candidate({
+      providerId: "openrouter",
+      modelId: "claude-sonnet",
+      authTier: "subscription",
+      authScope: "third-party",
+      subscriptionStatus: "active",
+    });
+
+    const denied = evaluatePolicy(
+      baseRequest(),
+      [thirdPartySub],
+      personalConfig,
+    );
+    expect(denied.allowed).toHaveLength(0);
+    expect(denied.denials).toContainEqual(
+      expect.objectContaining({
+        code: "subscription_scope_denied",
+        target: "candidate",
+        id: "openrouter:claude-sonnet",
+      }),
+    );
+
+    const allowed = evaluatePolicy(baseRequest(), [thirdPartySub], {
+      ...personalConfig,
+      allowThirdPartySubscriptionAdapters: true,
+    });
+    expect(allowed.allowed).toHaveLength(1);
+  });
+
+  it("denies unknown subscription auth scope until the adapter proves support", () => {
+    const result = evaluatePolicy(
+      baseRequest(),
+      [
+        candidate({
+          providerId: "unknown-sub",
+          modelId: "sonnet",
+          authTier: "subscription",
+          authScope: "unknown",
+          subscriptionStatus: "active",
+        }),
+        candidate({
+          providerId: "openrouter",
+          modelId: "fast",
+          authTier: "api-key",
+          authScope: "third-party",
+          estimatedCostUsd: 0.001,
+        }),
+      ],
+      personalConfig,
+    );
+
+    expect(result.allowed.map((c) => c.providerId)).toEqual(["openrouter"]);
+    expect(result.denials).toContainEqual(
+      expect.objectContaining({
+        code: "subscription_scope_denied",
+        id: "unknown-sub:sonnet",
+      }),
+    );
+  });
+});