Initial Commit

packages/api-stack/api/api-sandbox-permissions/src/checker/capability/capability.test.ts

@@ -0,0 +1,145 @@
+import { describe, expect, it } from "@suaveplan/testing/runner";
+import { PermissionPolicy } from "../../policy/policy.js";
+import { checkCapability } from "./capability.js";
+
+const policy = new PermissionPolicy({
+    database: {
+        required: true,
+        schemaVersion: 1,
+        tablePrefix: "billing_",
+    },
+    secrets: [{ name: "STRIPE_SECRET_KEY", required: true }],
+    events: {
+        publishes: ["billing.invoice.created"],
+        subscribes: ["users.profile.updated"],
+    },
+});
+
+describe("checkCapability — db", () => {
+    it("allows query inside declared tablePrefix", {
+        timeout: 5000,
+    }, () => {
+        expect(
+            checkCapability(policy, {
+                capability: "db",
+                table: "billing_invoices",
+            })
+        ).toEqual({ outcome: "allow" });
+    });
+
+    it("db denies queries outside declared tablePrefix", {
+        timeout: 5000,
+    }, () => {
+        expect(
+            checkCapability(policy, {
+                capability: "db",
+                table: "users_account",
+            })
+        ).toEqual({ outcome: "deny", reason: "table-out-of-scope" });
+    });
+
+    it("db denies queries when database manifest absent", {
+        timeout: 5000,
+    }, () => {
+        const empty = new PermissionPolicy({});
+        expect(
+            checkCapability(empty, { capability: "db", table: "any_table" })
+        ).toEqual({ outcome: "deny", reason: "db-not-declared" });
+    });
+});
+
+describe("checkCapability — secrets", () => {
+    it("allows declared name", { timeout: 5000 }, () => {
+        expect(
+            checkCapability(policy, {
+                capability: "secrets",
+                name: "STRIPE_SECRET_KEY",
+            }).outcome
+        ).toBe("allow");
+    });
+
+    it("secrets denies undeclared name", { timeout: 5000 }, () => {
+        expect(
+            checkCapability(policy, {
+                capability: "secrets",
+                name: "AWS_KEY",
+            })
+        ).toEqual({ outcome: "deny", reason: "secret-not-declared" });
+    });
+
+    it("secrets denies when manifest has no secrets array", {
+        timeout: 5000,
+    }, () => {
+        const empty = new PermissionPolicy({});
+        expect(
+            checkCapability(empty, {
+                capability: "secrets",
+                name: "FOO",
+            }).outcome
+        ).toBe("deny");
+    });
+});
+
+describe("checkCapability — events", () => {
+    it("allows publish of declared topic", { timeout: 5000 }, () => {
+        expect(
+            checkCapability(policy, {
+                capability: "events",
+                mode: "publish",
+                topic: "billing.invoice.created",
+            }).outcome
+        ).toBe("allow");
+    });
+
+    it("allows subscribe of declared topic", { timeout: 5000 }, () => {
+        expect(
+            checkCapability(policy, {
+                capability: "events",
+                mode: "subscribe",
+                topic: "users.profile.updated",
+            }).outcome
+        ).toBe("allow");
+    });
+
+    it("events denies publish outside manifest", { timeout: 5000 }, () => {
+        expect(
+            checkCapability(policy, {
+                capability: "events",
+                mode: "publish",
+                topic: "other.topic",
+            })
+        ).toEqual({ outcome: "deny", reason: "publish-not-declared" });
+    });
+
+    it("events denies subscribe outside manifest", {
+        timeout: 5000,
+    }, () => {
+        expect(
+            checkCapability(policy, {
+                capability: "events",
+                mode: "subscribe",
+                topic: "other.topic",
+            })
+        ).toEqual({ outcome: "deny", reason: "subscribe-not-declared" });
+    });
+
+    it("events denies when no events block in manifest", {
+        timeout: 5000,
+    }, () => {
+        const empty = new PermissionPolicy({});
+        expect(
+            checkCapability(empty, {
+                capability: "events",
+                mode: "publish",
+                topic: "anything",
+            }).outcome
+        ).toBe("deny");
+        expect(
+            checkCapability(empty, {
+                capability: "events",
+                mode: "subscribe",
+                topic: "anything",
+            }).outcome
+        ).toBe("deny");
+    });
+});