offrouter-core 0.2.1 → 0.2.2

package/src/policy.test.ts

@@ -1,634 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { evaluatePolicy, type PolicyConfig } from "./policy.js";
-import type { ProviderCandidate, RouteRequest } from "./types.js";
-
-function baseRequest(
-  overrides: Partial<RouteRequest> & {
-    harness?: Partial<RouteRequest["harness"]>;
-    task?: Partial<RouteRequest["task"]>;
-    workspace?: Partial<RouteRequest["workspace"]>;
-    constraints?: Partial<RouteRequest["constraints"]>;
-  } = {},
-): RouteRequest {
-  return {
-    protocolVersion: "offrouter.route.v1",
-    requestId: overrides.requestId ?? "req_1",
-    harness: {
-      kind: "claude",
-      profile: "claude-personal",
-      ...overrides.harness,
-    },
-    task: {
-      promptPreview: "explain this repo",
-      promptDigest: "sha256:example",
-      kind: "explain",
-      risk: "low",
-      ...overrides.task,
-    },
-    workspace: {
-      cwd: "/tmp/project",
-      trusted: true,
-      ...overrides.workspace,
-    },
-    constraints: {
-      maxCostUsd: 1,
-      localOnly: false,
-      subscriptionFirst: true,
-      allowApiKeyFallback: true,
-      ...overrides.constraints,
-    },
-  };
-}
-
-function candidate(
-  partial: Partial<ProviderCandidate> &
-    Pick<ProviderCandidate, "providerId" | "modelId" | "authTier">,
-): ProviderCandidate {
-  return {
-    authScope: "first-party",
-    health: "healthy",
-    supportsTools: true,
-    supportsStreaming: true,
-    supportsJson: true,
-    supportsImages: false,
-    estimatedCostUsd: 0.01,
-    ...partial,
-  };
-}
-
-const personalConfig: PolicyConfig = {
-  allowlistedProfiles: ["claude-personal", "codex-personal", "gemini-personal"],
-  deniedProfilePatterns: ["*-work"],
-};
-
-describe("evaluatePolicy", () => {
-  it("allows claude-personal", () => {
-    const result = evaluatePolicy(
-      baseRequest({ harness: { profile: "claude-personal" } }),
-      [
-        candidate({
-          providerId: "claude",
-          modelId: "sonnet",
-          authTier: "subscription",
-          subscriptionStatus: "active",
-        }),
-      ],
-      personalConfig,
-    );
-
-    expect(result.allowed).toHaveLength(1);
-    expect(result.denials).toEqual([]);
-  });
-
-  it("denies claude-work", () => {
-    const result = evaluatePolicy(
-      baseRequest({ harness: { profile: "claude-work" } }),
-      [
-        candidate({
-          providerId: "claude",
-          modelId: "sonnet",
-          authTier: "subscription",
-          subscriptionStatus: "active",
-        }),
-      ],
-      personalConfig,
-    );
-
-    expect(result.allowed).toHaveLength(0);
-    expect(result.denials).toContainEqual(
-      expect.objectContaining({
-        code: "work_profile_denied",
-        target: "profile",
-        id: "claude-work",
-      }),
-    );
-  });
-
-  it("denies wildcard *-work profiles", () => {
-    for (const profile of ["codex-work", "gemini-work", "pi-work"]) {
-      const result = evaluatePolicy(
-        baseRequest({ harness: { profile } }),
-        [
-          candidate({
-            providerId: "fake",
-            modelId: "fast",
-            authTier: "api-key",
-          }),
-        ],
-        personalConfig,
-      );
-
-      expect(result.allowed).toHaveLength(0);
-      expect(result.denials).toContainEqual(
-        expect.objectContaining({
-          code: "work_profile_denied",
-          id: profile,
-        }),
-      );
-    }
-  });
-
-  it("always denies *-work profiles even with custom deny patterns", () => {
-    const result = evaluatePolicy(
-      baseRequest({ harness: { profile: "claude-work" } }),
-      [
-        candidate({
-          providerId: "fake",
-          modelId: "fast",
-          authTier: "api-key",
-        }),
-      ],
-      {
-        allowlistedProfiles: ["claude-work"],
-        deniedProfilePatterns: ["corp-*"],
-      },
-    );
-
-    expect(result.allowed).toHaveLength(0);
-    expect(result.denials).toContainEqual(
-      expect.objectContaining({
-        code: "work_profile_denied",
-        id: "claude-work",
-      }),
-    );
-  });
-
-  it("denies work-like staging profiles (e.g. claude-work-staging) even when allowlisted", () => {
-    for (const profile of ["claude-work-staging", "codex-work-staging"]) {
-      const result = evaluatePolicy(
-        baseRequest({ harness: { profile } }),
-        [
-          candidate({
-            providerId: "fake",
-            modelId: "fast",
-            authTier: "api-key",
-          }),
-        ],
-        {
-          // Work-like ids are denied by default even if explicitly allowlisted.
-          allowlistedProfiles: [profile],
-        },
-      );
-
-      expect(result.allowed).toHaveLength(0);
-      expect(result.denials).toContainEqual(
-        expect.objectContaining({
-          code: "work_profile_denied",
-          target: "profile",
-          id: profile,
-        }),
-      );
-    }
-  });
-
-  it("denies unallowlisted personal profiles", () => {
-    const result = evaluatePolicy(
-      baseRequest({ harness: { profile: "cursor-personal" } }),
-      [
-        candidate({
-          providerId: "cursor",
-          modelId: "default",
-          authTier: "subscription",
-          subscriptionStatus: "active",
-        }),
-      ],
-      personalConfig,
-    );
-
-    expect(result.allowed).toHaveLength(0);
-    expect(result.denials).toContainEqual(
-      expect.objectContaining({
-        code: "profile_not_allowlisted",
-        target: "profile",
-        id: "cursor-personal",
-      }),
-    );
-  });
-
-  it("excludes remote providers when localOnly is set", () => {
-    const result = evaluatePolicy(
-      baseRequest({ constraints: { localOnly: true } }),
-      [
-        candidate({
-          providerId: "ollama",
-          modelId: "llama",
-          authTier: "local",
-          estimatedCostUsd: 0,
-        }),
-        candidate({
-          providerId: "openrouter",
-          modelId: "fast",
-          authTier: "api-key",
-          authScope: "third-party",
-          estimatedCostUsd: 0.001,
-        }),
-        candidate({
-          providerId: "claude",
-          modelId: "sonnet",
-          authTier: "subscription",
-          subscriptionStatus: "active",
-        }),
-      ],
-      personalConfig,
-    );
-
-    expect(result.allowed.map((c) => c.providerId)).toEqual(["ollama"]);
-    expect(result.denials).toContainEqual(
-      expect.objectContaining({
-        code: "local_only_required",
-        id: "openrouter:fast",
-      }),
-    );
-    expect(result.denials).toContainEqual(
-      expect.objectContaining({
-        code: "local_only_required",
-        id: "claude:sonnet",
-      }),
-    );
-  });
-
-  it("excludes expensive providers under maxCostUsd", () => {
-    const result = evaluatePolicy(
-      baseRequest({ constraints: { maxCostUsd: 0.05 } }),
-      [
-        candidate({
-          providerId: "cheap",
-          modelId: "fast",
-          authTier: "api-key",
-          estimatedCostUsd: 0.01,
-        }),
-        candidate({
-          providerId: "expensive",
-          modelId: "opus",
-          authTier: "api-key",
-          estimatedCostUsd: 0.5,
-        }),
-      ],
-      personalConfig,
-    );
-
-    expect(result.allowed.map((c) => c.providerId)).toEqual(["cheap"]);
-    expect(result.denials).toContainEqual(
-      expect.objectContaining({
-        code: "cost_cap_exceeded",
-        id: "expensive:opus",
-      }),
-    );
-  });
-
-  it("excludes unknown-cost API-key providers under maxCostUsd", () => {
-    const result = evaluatePolicy(
-      baseRequest({ constraints: { maxCostUsd: 0.05 } }),
-      [
-        candidate({
-          providerId: "unknown-cost",
-          modelId: "fast",
-          authTier: "api-key",
-          estimatedCostUsd: undefined,
-        }),
-      ],
-      personalConfig,
-    );
-
-    expect(result.allowed).toHaveLength(0);
-    expect(result.denials).toContainEqual(
-      expect.objectContaining({
-        code: "cost_cap_exceeded",
-        id: "unknown-cost:fast",
-      }),
-    );
-  });
-
-  it("blocks untrusted workspaces", () => {
-    const result = evaluatePolicy(
-      baseRequest({ workspace: { trusted: false } }),
-      [
-        candidate({
-          providerId: "claude",
-          modelId: "sonnet",
-          authTier: "subscription",
-          subscriptionStatus: "active",
-        }),
-      ],
-      personalConfig,
-    );
-
-    expect(result.allowed).toHaveLength(0);
-    expect(result.denials).toContainEqual(
-      expect.objectContaining({
-        code: "project_untrusted",
-        target: "workspace",
-      }),
-    );
-  });
-
-  it("excludes API-key candidates while a healthy subscription can satisfy the task", () => {
-    const result = evaluatePolicy(
-      baseRequest({
-        constraints: { subscriptionFirst: true, allowApiKeyFallback: true },
-      }),
-      [
-        candidate({
-          providerId: "claude",
-          modelId: "sonnet",
-          authTier: "subscription",
-          subscriptionStatus: "active",
-          health: "healthy",
-          estimatedCostUsd: 0,
-        }),
-        candidate({
-          providerId: "openrouter",
-          modelId: "fast",
-          authTier: "api-key",
-          authScope: "third-party",
-          estimatedCostUsd: 0.001,
-        }),
-      ],
-      personalConfig,
-    );
-
-    expect(result.allowed.map((c) => c.providerId)).toEqual(["claude"]);
-    expect(result.denials).toContainEqual(
-      expect.objectContaining({
-        code: "api_key_blocked_by_subscription_first_policy",
-        target: "candidate",
-        id: "openrouter:fast",
-      }),
-    );
-  });
-
-  it("allows API-key fallback when only a degraded subscription can satisfy the task", () => {
-    const result = evaluatePolicy(
-      baseRequest({
-        constraints: { subscriptionFirst: true, allowApiKeyFallback: true },
-      }),
-      [
-        candidate({
-          providerId: "claude",
-          modelId: "sonnet",
-          authTier: "subscription",
-          subscriptionStatus: "active",
-          health: "degraded",
-          estimatedCostUsd: 0,
-        }),
-        candidate({
-          providerId: "openrouter",
-          modelId: "fast",
-          authTier: "api-key",
-          authScope: "third-party",
-          estimatedCostUsd: 0.001,
-        }),
-      ],
-      personalConfig,
-    );
-
-    expect(result.allowed.map((c) => c.providerId)).toEqual([
-      "claude",
-      "openrouter",
-    ]);
-    expect(result.denials).not.toContainEqual(
-      expect.objectContaining({
-        code: "api_key_blocked_by_subscription_first_policy",
-      }),
-    );
-  });
-
-  it("allows API-key candidates through policy when subscriptionFirst is disabled", () => {
-    const result = evaluatePolicy(
-      baseRequest({
-        constraints: { subscriptionFirst: false, allowApiKeyFallback: false },
-      }),
-      [
-        candidate({
-          providerId: "claude",
-          modelId: "sonnet",
-          authTier: "subscription",
-          subscriptionStatus: "active",
-          health: "healthy",
-          estimatedCostUsd: 0,
-        }),
-        candidate({
-          providerId: "openrouter",
-          modelId: "fast",
-          authTier: "api-key",
-          authScope: "third-party",
-          estimatedCostUsd: 0.001,
-        }),
-      ],
-      personalConfig,
-    );
-
-    expect(result.allowed.map((c) => c.providerId)).toEqual([
-      "claude",
-      "openrouter",
-    ]);
-  });
-
-  it("allows API-key fallback only when subscriptions are exhausted, rate-limited, unavailable, or policy-ineligible", () => {
-    const cases: Array<{
-      label: string;
-      candidates: ProviderCandidate[];
-      expectApiKeyAllowed: boolean;
-    }> = [
-      {
-        label: "exhausted",
-        candidates: [
-          candidate({
-            providerId: "claude",
-            modelId: "sonnet",
-            authTier: "subscription",
-            subscriptionStatus: "exhausted",
-            health: "healthy",
-          }),
-          candidate({
-            providerId: "openrouter",
-            modelId: "fast",
-            authTier: "api-key",
-            authScope: "third-party",
-          }),
-        ],
-        expectApiKeyAllowed: true,
-      },
-      {
-        label: "rate-limited",
-        candidates: [
-          candidate({
-            providerId: "claude",
-            modelId: "sonnet",
-            authTier: "subscription",
-            subscriptionStatus: "rate-limited",
-            health: "healthy",
-          }),
-          candidate({
-            providerId: "openrouter",
-            modelId: "fast",
-            authTier: "api-key",
-            authScope: "third-party",
-          }),
-        ],
-        expectApiKeyAllowed: true,
-      },
-      {
-        label: "unconfigured subscription",
-        candidates: [
-          candidate({
-            providerId: "claude",
-            modelId: "sonnet",
-            authTier: "subscription",
-            subscriptionStatus: "unconfigured",
-            health: "dead",
-          }),
-          candidate({
-            providerId: "openrouter",
-            modelId: "fast",
-            authTier: "api-key",
-            authScope: "third-party",
-          }),
-        ],
-        expectApiKeyAllowed: true,
-      },
-      {
-        label: "no subscription candidates",
-        candidates: [
-          candidate({
-            providerId: "openrouter",
-            modelId: "fast",
-            authTier: "api-key",
-            authScope: "third-party",
-          }),
-        ],
-        expectApiKeyAllowed: true,
-      },
-      {
-        label: "subscription tool-ineligible for tool task",
-        candidates: [
-          candidate({
-            providerId: "claude",
-            modelId: "text",
-            authTier: "subscription",
-            subscriptionStatus: "active",
-            health: "healthy",
-            supportsTools: false,
-          }),
-          candidate({
-            providerId: "openrouter",
-            modelId: "tools",
-            authTier: "api-key",
-            authScope: "third-party",
-            supportsTools: true,
-          }),
-        ],
-        expectApiKeyAllowed: true,
-      },
-    ];
-
-    for (const { label, candidates, expectApiKeyAllowed } of cases) {
-      const result = evaluatePolicy(
-        baseRequest({
-          task: {
-            kind: label.includes("tool") ? "tools" : "explain",
-            requiresTools: label.includes("tool"),
-          },
-          constraints: { subscriptionFirst: true, allowApiKeyFallback: true },
-        }),
-        candidates,
-        personalConfig,
-      );
-
-      const apiKeyAllowed = result.allowed.some((c) => c.authTier === "api-key");
-      expect(apiKeyAllowed, label).toBe(expectApiKeyAllowed);
-    }
-  });
-
-  it("denies API-key fallback when allowApiKeyFallback is false even if subscription is exhausted", () => {
-    const result = evaluatePolicy(
-      baseRequest({
-        constraints: { subscriptionFirst: true, allowApiKeyFallback: false },
-      }),
-      [
-        candidate({
-          providerId: "claude",
-          modelId: "sonnet",
-          authTier: "subscription",
-          subscriptionStatus: "exhausted",
-        }),
-        candidate({
-          providerId: "openrouter",
-          modelId: "fast",
-          authTier: "api-key",
-          authScope: "third-party",
-        }),
-      ],
-      personalConfig,
-    );
-
-    expect(result.allowed).toHaveLength(0);
-    expect(result.denials).toContainEqual(
-      expect.objectContaining({
-        code: "api_key_blocked_by_subscription_first_policy",
-        id: "openrouter:fast",
-      }),
-    );
-  });
-
-  it("denies first-party subscription surface used as third-party unless policy allows", () => {
-    const thirdPartySub = candidate({
-      providerId: "openrouter",
-      modelId: "claude-sonnet",
-      authTier: "subscription",
-      authScope: "third-party",
-      subscriptionStatus: "active",
-    });
-
-    const denied = evaluatePolicy(
-      baseRequest(),
-      [thirdPartySub],
-      personalConfig,
-    );
-    expect(denied.allowed).toHaveLength(0);
-    expect(denied.denials).toContainEqual(
-      expect.objectContaining({
-        code: "subscription_scope_denied",
-        target: "candidate",
-        id: "openrouter:claude-sonnet",
-      }),
-    );
-
-    const allowed = evaluatePolicy(baseRequest(), [thirdPartySub], {
-      ...personalConfig,
-      allowThirdPartySubscriptionAdapters: true,
-    });
-    expect(allowed.allowed).toHaveLength(1);
-  });
-
-  it("denies unknown subscription auth scope until the adapter proves support", () => {
-    const result = evaluatePolicy(
-      baseRequest(),
-      [
-        candidate({
-          providerId: "unknown-sub",
-          modelId: "sonnet",
-          authTier: "subscription",
-          authScope: "unknown",
-          subscriptionStatus: "active",
-        }),
-        candidate({
-          providerId: "openrouter",
-          modelId: "fast",
-          authTier: "api-key",
-          authScope: "third-party",
-          estimatedCostUsd: 0.001,
-        }),
-      ],
-      personalConfig,
-    );
-
-    expect(result.allowed.map((c) => c.providerId)).toEqual(["openrouter"]);
-    expect(result.denials).toContainEqual(
-      expect.objectContaining({
-        code: "subscription_scope_denied",
-        id: "unknown-sub:sonnet",
-      }),
-    );
-  });
-});