87 lines
3.2 KiB
TypeScript
87 lines
3.2 KiB
TypeScript
import { describe, expect, it } from "vitest";
|
|
import {
|
|
browserAllowedOperationNames,
|
|
capabilityCallsEnabledForHost,
|
|
createBrowserOperationPolicy,
|
|
isBrowserAllowedOperationName,
|
|
} from "./browser-operation-policy.js";
|
|
|
|
describe("browser operation policy", () => {
|
|
it("pins the authored console boundary independently from generated inventory", () => {
|
|
expect(browserAllowedOperationNames).toEqual([
|
|
"workflow.health",
|
|
"workflow.sources.list",
|
|
"workflow.capabilities.list",
|
|
"workflow.capabilities.inspect",
|
|
"workflow.draft_workspaces.list",
|
|
"workflow.draft_workspaces.get",
|
|
"workflow.draft_workspaces.inspect_authoring_contract",
|
|
"workflow.draft_workspaces.create_empty",
|
|
"workflow.draft_workspaces.create_from_capability",
|
|
"workflow.draft_workspaces.add_step_from_capability",
|
|
"workflow.draft_workspaces.update_capability_step",
|
|
"workflow.draft_workspaces.set_route",
|
|
"workflow.draft_workspaces.set_contract",
|
|
"workflow.draft_workspaces.set_start",
|
|
"workflow.draft_workspaces.set_step_input_bindings",
|
|
"workflow.draft_workspaces.set_step_output_bindings",
|
|
"workflow.draft_workspaces.validate",
|
|
"workflow.draft_workspaces.set_workflow_output_bindings",
|
|
"workflow.artifacts.list",
|
|
"workflow.artifacts.inspect",
|
|
"workflow.deployments.list",
|
|
"workflow.deployments.inspect",
|
|
"workflow.deployments.validate",
|
|
"workflow.runs.list",
|
|
"workflow.runs.inspect",
|
|
"workflow.runs.start",
|
|
"workflow.runs.resume",
|
|
"workflow.runs.trace",
|
|
]);
|
|
expect(isBrowserAllowedOperationName("workflow.health")).toBe(true);
|
|
expect(browserAllowedOperationNames).toContain(
|
|
"workflow.draft_workspaces.add_step_from_capability",
|
|
);
|
|
expect(browserAllowedOperationNames).not.toContain(
|
|
"workflow.draft_workspaces.replace_document",
|
|
);
|
|
expect(browserAllowedOperationNames).not.toContain(
|
|
"workflow.draft_workspaces.patch",
|
|
);
|
|
expect(browserAllowedOperationNames).not.toContain(
|
|
"workflow.draft_workspaces.remove_step",
|
|
);
|
|
expect(isBrowserAllowedOperationName("workflow.admin.auth.list")).toBe(false);
|
|
});
|
|
|
|
it("classifies static, conditional, and unexposed operations", () => {
|
|
const disabled = createBrowserOperationPolicy({
|
|
enableCapabilityCalls: false,
|
|
});
|
|
const enabled = createBrowserOperationPolicy({
|
|
enableCapabilityCalls: true,
|
|
});
|
|
|
|
expect(disabled.classify("workflow.health")).toBe("allowed");
|
|
expect(disabled.classify("workflow.capabilities.call")).toBe("disabled");
|
|
expect(enabled.classify("workflow.capabilities.call")).toBe("allowed");
|
|
expect(disabled.classify("workflow.admin.auth.list")).toBe("unknown");
|
|
});
|
|
|
|
it.each([
|
|
["127.0.0.1", undefined, true],
|
|
["localhost", undefined, true],
|
|
["::1", undefined, true],
|
|
["0.0.0.0", undefined, false],
|
|
["192.168.1.20", undefined, false],
|
|
["192.168.1.20", "0", false],
|
|
["192.168.1.20", "1", true],
|
|
["192.168.1.20", "true", false],
|
|
] as const)(
|
|
"computes capability-call access for host %s with override %s",
|
|
(hostname, override, expected) => {
|
|
expect(capabilityCallsEnabledForHost(hostname, override)).toBe(expected);
|
|
},
|
|
);
|
|
});
|