refactor: centralize workflow operation guards

2026-08-04 14:34:06 +07:00
parent 6b322f0aa4
commit 5b44f00ce0
11 changed files with 140 additions and 46 deletions
@@ -0,0 +1,26 @@
+import { describe, expect, it } from "vitest";
+import {
+  browserAllowedOperationNames,
+  isBrowserAllowedOperationName,
+} from "./browser-operation-policy.js";
+
+describe("browser operation policy", () => {
+  it("pins the authored console boundary independently from generated inventory", () => {
+    expect(browserAllowedOperationNames).toEqual([
+      "workflow.health",
+      "workflow.sources.list",
+      "workflow.artifacts.list",
+      "workflow.artifacts.inspect",
+      "workflow.deployments.list",
+      "workflow.deployments.inspect",
+      "workflow.deployments.validate",
+      "workflow.runs.list",
+      "workflow.runs.inspect",
+      "workflow.runs.start",
+      "workflow.runs.resume",
+      "workflow.runs.trace",
+    ]);
+    expect(isBrowserAllowedOperationName("workflow.health")).toBe(true);
+    expect(isBrowserAllowedOperationName("workflow.admin.auth.list")).toBe(false);
+  });
+});