tapimo 0.15.1 → 0.18.0

package/src/internal/routes/Policy.test.ts

@@ -0,0 +1,316 @@
+import * as TestRoutes from '../../../test/Routes.js'
+import * as Policy from './Policy.js'
+
+const relay = Policy.fromRoute(
+  TestRoutes.snapshot.routes.find((item) => item.providerId === 'relay')!,
+)
+
+describe('resolve', () => {
+  test('denies missing access while preserving explicit allow-all and independent inheritance', () => {
+    const legacy = { subsidyEnabled: false, maxAmount: '1', subsidyPayer: 'enterprise' } as const
+
+    expect(Policy.resolve({ legacy, layers: [] }).access).toEqual([])
+    expect(Policy.resolve({ legacy, layers: [{}, {}] }).access).toEqual([])
+    expect(
+      Policy.resolve({
+        legacy,
+        layers: [{ subsidyEnabled: true, subsidyPayer: 'tempo', maxAmount: '10' }, {}],
+      }),
+    ).toMatchObject({
+      access: [],
+      maxAmount: '10',
+      subsidyEnabled: true,
+      subsidyPayer: 'tempo',
+    })
+    expect(Policy.resolve({ legacy, layers: [{ access: null }, {}] }).access).toBeNull()
+    expect(Policy.resolve({ legacy, layers: [{ access: [] }, { access: null }] }).access).toBeNull()
+  })
+
+  test('inherits and replaces route lists at more specific scopes', () => {
+    const legacy = { subsidyEnabled: false, maxAmount: '1', subsidyPayer: 'enterprise' } as const
+    const other = { ...relay, providerId: 'stargate' }
+
+    expect(Policy.resolve({ legacy, layers: [{ access: [relay] }, {}] }).access).toEqual([relay])
+    expect(
+      Policy.resolve({ legacy, layers: [{ access: [relay] }, { access: [other] }] }).access,
+    ).toEqual([other])
+    expect(Policy.resolve({ legacy, layers: [{ access: null }, { access: [] }] }).access).toEqual(
+      [],
+    )
+  })
+
+  test('prefers scope over provider specificity and resolves financial fields independently', () => {
+    const { providerId: _, ...anyProvider } = relay
+    const legacy = { subsidyEnabled: false, maxAmount: '1', subsidyPayer: 'enterprise' } as const
+    expect(
+      Policy.resolve({
+        legacy,
+        layers: [
+          { terms: [{ ...relay, maxAmount: '20', subsidyPayer: 'enterprise' }] },
+          { maxAmount: '7', terms: [{ ...anyProvider, subsidyPayer: 'tempo' }] },
+          { terms: [{ ...relay, maxAmount: '3' }] },
+        ],
+        route: relay,
+      }),
+    ).toMatchObject({ maxAmount: '3', subsidyPayer: 'tempo' })
+    expect(
+      Policy.resolve({
+        legacy,
+        layers: [
+          {
+            terms: [
+              { ...anyProvider, maxAmount: '7', subsidyPayer: 'tempo' },
+              { ...relay, maxAmount: '9' },
+            ],
+          },
+        ],
+        route: relay,
+      }),
+    ).toMatchObject({ maxAmount: '9', subsidyPayer: 'tempo' })
+    expect(
+      Policy.resolve({
+        legacy,
+        layers: [{ terms: [{ ...relay, maxAmount: '20' }] }, { maxAmount: '7' }],
+        route: relay,
+      }).maxAmount,
+    ).toBe('7')
+  })
+
+  test('inherits independent parent fields while a key overrides one financial term', () => {
+    expect(
+      Policy.resolve({
+        legacy: { subsidyEnabled: false, maxAmount: '0', subsidyPayer: 'enterprise' },
+        layers: [
+          { access: [relay], subsidyEnabled: true, subsidyPayer: 'tempo', maxAmount: '10' },
+          {},
+          { maxAmount: '3.5' },
+        ],
+        route: relay,
+      }),
+    ).toEqual({
+      access: [relay],
+      maxAmount: '3.5',
+      subsidyEnabled: true,
+      subsidyEligible: true,
+      subsidyPayer: 'tempo',
+      subsidyRoutes: null,
+      suspended: false,
+    })
+  })
+
+  test('resolves route eligibility by scope, provider specificity, and legacy lists', () => {
+    const { providerId: _, ...anyProvider } = relay
+    const legacy = { subsidyEnabled: true, maxAmount: '1', subsidyPayer: 'enterprise' } as const
+    const eligible = (layers: Policy.Overrides[]) =>
+      Policy.resolve({ legacy, layers, route: relay }).subsidyEligible
+
+    expect(eligible([{ terms: [{ ...relay, subsidyEligible: false }] }])).toBe(false)
+    expect(
+      eligible([
+        { terms: [{ ...anyProvider, subsidyEligible: false }] },
+        { terms: [{ ...relay, maxAmount: '2' }] },
+      ]),
+    ).toBe(false)
+    expect(
+      eligible([
+        { terms: [{ ...anyProvider, subsidyEligible: false }] },
+        {
+          terms: [
+            { ...anyProvider, subsidyEligible: false },
+            { ...relay, subsidyEligible: true },
+          ],
+        },
+      ]),
+    ).toBe(true)
+    expect(
+      eligible([{ terms: [{ ...relay, subsidyEligible: false }] }, { subsidyRoutes: null }]),
+    ).toBe(true)
+    expect(
+      eligible([{ subsidyRoutes: null }, { terms: [{ ...relay, subsidyEligible: false }] }]),
+    ).toBe(false)
+    expect(eligible([{ subsidyRoutes: null }, { subsidyRoutes: [] }])).toBe(false)
+    expect(eligible([{ subsidyRoutes: [] }, { subsidyRoutes: null }])).toBe(true)
+    expect(eligible([])).toBe(true)
+    expect(Policy.resolve({ legacy, layers: [{ subsidyRoutes: [] }] }).subsidyEligible).toBe(true)
+  })
+
+  test('lets route enablement override legacy gates without changing eligible-only policies', () => {
+    const { providerId: _, ...anyProvider } = relay
+    const disabled = { subsidyEnabled: false, maxAmount: '1', subsidyPayer: 'enterprise' } as const
+
+    expect(
+      Policy.resolve({
+        legacy: disabled,
+        layers: [{ subsidyRoutes: [], terms: [{ ...relay, subsidyEnabled: true }] }],
+        route: relay,
+      }),
+    ).toMatchObject({ subsidyEnabled: true, subsidyEligible: true })
+    expect(
+      Policy.resolve({
+        legacy: disabled,
+        layers: [{ terms: [{ ...relay, subsidyEligible: true }] }],
+        route: relay,
+      }),
+    ).toMatchObject({ subsidyEnabled: false, subsidyEligible: true })
+    expect(
+      Policy.resolve({
+        legacy: { ...disabled, subsidyEnabled: true },
+        layers: [{ subsidyRoutes: null, terms: [{ ...anyProvider, subsidyEnabled: false }] }],
+        route: relay,
+      }),
+    ).toMatchObject({ subsidyEnabled: false, subsidyEligible: false })
+  })
+
+  test('inherits enabled terms per field and does not leak provider-specific values', () => {
+    const otherProvider = { ...relay, providerId: 'stargate' }
+    const legacy = { subsidyEnabled: false, maxAmount: '1', subsidyPayer: 'enterprise' } as const
+    const layers: Policy.Overrides[] = [
+      { terms: [{ ...relay, subsidyEnabled: true, subsidyPayer: 'tempo' }] },
+      { terms: [{ ...relay, maxAmount: '4' }] },
+    ]
+
+    expect(Policy.resolve({ legacy, layers, route: relay })).toMatchObject({
+      maxAmount: '4',
+      subsidyEnabled: true,
+      subsidyPayer: 'tempo',
+    })
+    expect(Policy.resolve({ legacy, layers, route: otherProvider }).subsidyEnabled).toBe(false)
+  })
+
+  test('only honors suspension at the organization layer', () => {
+    expect(
+      Policy.resolve({
+        legacy: { subsidyEnabled: false, maxAmount: '0', subsidyPayer: 'enterprise' },
+        layers: [{}, { suspended: true }],
+      }).suspended,
+    ).toBe(false)
+    expect(
+      Policy.resolve({
+        legacy: { subsidyEnabled: false, maxAmount: '0', subsidyPayer: 'enterprise' },
+        layers: [{ suspended: true }, { suspended: false }],
+      }).suspended,
+    ).toBe(true)
+  })
+})
+
+describe('filter', () => {
+  test('returns an empty route list and provider index when key access denies all routes', () => {
+    const filtered = Policy.filter(TestRoutes.snapshot, {
+      legacy: { subsidyEnabled: false, maxAmount: '0', subsidyPayer: 'enterprise' },
+      layers: [{ access: null }, { access: [] }],
+    })
+
+    expect(filtered.routes).toEqual([])
+    expect([...filtered.routesByProvider]).toEqual([])
+    expect(TestRoutes.snapshot.routes.length).toBeGreaterThan(0)
+  })
+
+  test('requires access, global enablement, and resolved route eligibility for subsidies', () => {
+    const legacy = { subsidyEnabled: true, maxAmount: '0', subsidyPayer: 'enterprise' } as const
+    const base = {
+      access: null,
+      terms: [{ ...relay, subsidyEligible: true }],
+    } satisfies Policy.Overrides
+
+    expect(
+      Policy.filter(TestRoutes.snapshot, { legacy, layers: [base], subsidize: true }).routes,
+    ).toHaveLength(TestRoutes.snapshot.routes.length)
+    expect(
+      Policy.filter(TestRoutes.snapshot, {
+        legacy,
+        layers: [base, { subsidyEnabled: false }],
+        subsidize: true,
+      }).routes,
+    ).toEqual([])
+    expect(
+      Policy.filter(TestRoutes.snapshot, {
+        legacy,
+        layers: [base, { access: [] }],
+        subsidize: true,
+      }).routes,
+    ).toEqual([])
+    const ineligible = {
+      access: [relay],
+      terms: [{ ...relay, subsidyEligible: false }],
+    }
+    expect(
+      Policy.filter(TestRoutes.snapshot, { legacy, layers: [ineligible], subsidize: true }).routes,
+    ).toEqual([])
+    expect(
+      Policy.filter(TestRoutes.snapshot, {
+        legacy,
+        layers: [ineligible],
+        subsidize: false,
+      }).routes.map(Policy.fromRoute),
+    ).toEqual([relay])
+  })
+})
+
+describe('commitmentKey', () => {
+  test('keeps replay identity stable across authoring scope and policy revisions', () => {
+    const first: Policy.Commitment = {
+      maxAmount: '1',
+      scope: { ...scope, apiKeyId: 'key_a' },
+      subsidyPayer: 'tempo',
+      versions: [1],
+    }
+    const replay: Policy.Commitment = {
+      ...first,
+      maxAmount: '1.000000',
+      scope: { ...scope, apiKeyId: 'key_b' },
+      versions: [99],
+    }
+    expect(Policy.commitmentKey(first)).toBe(Policy.commitmentKey(replay))
+    expect(Policy.commitmentKey({ ...first, subsidyPayer: 'enterprise' })).not.toBe(
+      Policy.commitmentKey(first),
+    )
+    expect(Policy.commitmentKey({ ...first, maxAmount: '1.000001' })).not.toBe(
+      Policy.commitmentKey(first),
+    )
+  })
+})
+
+describe('depositKey', () => {
+  test('separates fixed-rate delivery from legacy and scoped top-ups', () => {
+    const routePolicy: Policy.Commitment = {
+      maxAmount: '1',
+      scope,
+      subsidyPayer: 'enterprise',
+      versions: [1],
+    }
+    expect([
+      Policy.depositKey(undefined),
+      Policy.depositKey({ fixedRate: '1:1' }),
+      Policy.depositKey({ routePolicy }),
+      Policy.depositKey({ fixedRate: '1:1', routePolicy }),
+    ]).toMatchInlineSnapshot(`
+      [
+        "",
+        "["","1:1"]",
+        "["enterprise","1.000000"]",
+        "["[\\"enterprise\\",\\"1.000000\\"]","1:1"]",
+      ]
+    `)
+  })
+})
+
+describe('schema', () => {
+  test('accepts org keys but rejects duplicate terms, unknown fields, and invalid expense caps', () => {
+    expect(Policy.schema.Scope.safeParse({ ...scope, apiKeyId: 'key_a' }).success).toBe(true)
+    expect(Policy.schema.Overrides.safeParse({ terms: [relay, relay] }).success).toBe(false)
+    expect(Policy.schema.Overrides.safeParse({ access: [relay, relay] }).success).toBe(false)
+    expect(
+      Policy.schema.Overrides.safeParse({ terms: [{ ...relay, subsidyEligible: false }] }).success,
+    ).toBe(true)
+    expect(
+      Policy.schema.Overrides.safeParse({ terms: [{ ...relay, subsidyEnabled: true }] }).success,
+    ).toBe(true)
+    expect(Policy.schema.Overrides.safeParse({ subsidyEligible: true }).success).toBe(false)
+    expect(Policy.schema.Rule.safeParse({ ...relay, extra: true }).success).toBe(false)
+    expect(Policy.schema.Overrides.safeParse({ maxAmount: '1.123456' }).success).toBe(true)
+    for (const maxAmount of ['-1', '1e2', '1.1234567', '1000000000000'])
+      expect(Policy.schema.Overrides.safeParse({ maxAmount }).success).toBe(false)
+  })
+})
+
+const scope = { environment: 'production', orgId: 'org_policy' } as const