Initial Commit

packages/api-stack/api/api-secrets-vault/src/allowlist/allowlist.test.ts

@@ -0,0 +1,82 @@
+import { describe, expect, it } from "@suaveplan/testing/runner";
+import {
+    SECRETS_VAULT_CODES,
+    SecretsVaultError,
+} from "../error-codes/error-codes.js";
+import { createAllowlist } from "./allowlist.js";
+
+describe("createAllowlist", () => {
+    it("rejects non-string names with INVALID_OPTIONS", {
+        timeout: 5000,
+    }, () => {
+        let caught: unknown;
+        try {
+            const bad = 123 as unknown;
+            createAllowlist({ names: [bad as string] });
+        } catch (err) {
+            caught = err;
+        }
+        expect(caught).toBeInstanceOf(SecretsVaultError);
+        expect((caught as SecretsVaultError).code).toBe(
+            SECRETS_VAULT_CODES.INVALID_OPTIONS
+        );
+    });
+
+    it("rejects empty-string entries", { timeout: 5000 }, () => {
+        let caught: unknown;
+        try {
+            createAllowlist({ names: ["A", ""] });
+        } catch (err) {
+            caught = err;
+        }
+        expect(caught).toBeInstanceOf(SecretsVaultError);
+    });
+
+    it("accepts an empty list", { timeout: 5000 }, () => {
+        const allow = createAllowlist({ names: [] });
+        expect(allow.names).toEqual([]);
+        expect(allow.isAllowed("anything")).toBe(false);
+    });
+
+    it("deduplicates and sorts names", { timeout: 5000 }, () => {
+        const allow = createAllowlist({ names: ["B", "A", "B", "A"] });
+        expect(allow.names).toEqual(["A", "B"]);
+    });
+
+    it("isAllowed is true for in-list names", { timeout: 5000 }, () => {
+        const allow = createAllowlist({ names: ["STRIPE"] });
+        expect(allow.isAllowed("STRIPE")).toBe(true);
+        expect(allow.isAllowed("AWS")).toBe(false);
+    });
+
+    it("assertAllowed raises NOT_ALLOWED with the name in context", {
+        timeout: 5000,
+    }, () => {
+        const allow = createAllowlist({ names: ["STRIPE"] });
+        let caught: unknown;
+        try {
+            allow.assertAllowed("AWS");
+        } catch (err) {
+            caught = err;
+        }
+        expect(caught).toBeInstanceOf(SecretsVaultError);
+        expect((caught as SecretsVaultError).code).toBe(
+            SECRETS_VAULT_CODES.NOT_ALLOWED
+        );
+        expect((caught as SecretsVaultError).context).toEqual({
+            name: "AWS",
+        });
+    });
+
+    it("un-manifested read raises SECRETS_VAULT_NOT_ALLOWED", {
+        timeout: 5000,
+    }, () => {
+        const allow = createAllowlist({ names: ["STRIPE"] });
+        expect(() => allow.assertAllowed("AWS")).toThrow(SecretsVaultError);
+    });
+
+    it("names array is frozen", { timeout: 5000 }, () => {
+        const allow = createAllowlist({ names: ["A"] });
+        expect(Object.isFrozen(allow.names)).toBe(true);
+    });
+});