83 lines
2.6 KiB
TypeScript
83 lines
2.6 KiB
TypeScript
import { describe, expect, it } from "@suaveplan/testing/runner";
|
|
import {
|
|
SECRETS_VAULT_CODES,
|
|
SecretsVaultError,
|
|
} from "../error-codes/error-codes.js";
|
|
import { createAllowlist } from "./allowlist.js";
|
|
|
|
describe("createAllowlist", () => {
|
|
it("rejects non-string names with INVALID_OPTIONS", {
|
|
timeout: 5000,
|
|
}, () => {
|
|
let caught: unknown;
|
|
try {
|
|
const bad = 123 as unknown;
|
|
createAllowlist({ names: [bad as string] });
|
|
} catch (err) {
|
|
caught = err;
|
|
}
|
|
expect(caught).toBeInstanceOf(SecretsVaultError);
|
|
expect((caught as SecretsVaultError).code).toBe(
|
|
SECRETS_VAULT_CODES.INVALID_OPTIONS
|
|
);
|
|
});
|
|
|
|
it("rejects empty-string entries", { timeout: 5000 }, () => {
|
|
let caught: unknown;
|
|
try {
|
|
createAllowlist({ names: ["A", ""] });
|
|
} catch (err) {
|
|
caught = err;
|
|
}
|
|
expect(caught).toBeInstanceOf(SecretsVaultError);
|
|
});
|
|
|
|
it("accepts an empty list", { timeout: 5000 }, () => {
|
|
const allow = createAllowlist({ names: [] });
|
|
expect(allow.names).toEqual([]);
|
|
expect(allow.isAllowed("anything")).toBe(false);
|
|
});
|
|
|
|
it("deduplicates and sorts names", { timeout: 5000 }, () => {
|
|
const allow = createAllowlist({ names: ["B", "A", "B", "A"] });
|
|
expect(allow.names).toEqual(["A", "B"]);
|
|
});
|
|
|
|
it("isAllowed is true for in-list names", { timeout: 5000 }, () => {
|
|
const allow = createAllowlist({ names: ["STRIPE"] });
|
|
expect(allow.isAllowed("STRIPE")).toBe(true);
|
|
expect(allow.isAllowed("AWS")).toBe(false);
|
|
});
|
|
|
|
it("assertAllowed raises NOT_ALLOWED with the name in context", {
|
|
timeout: 5000,
|
|
}, () => {
|
|
const allow = createAllowlist({ names: ["STRIPE"] });
|
|
let caught: unknown;
|
|
try {
|
|
allow.assertAllowed("AWS");
|
|
} catch (err) {
|
|
caught = err;
|
|
}
|
|
expect(caught).toBeInstanceOf(SecretsVaultError);
|
|
expect((caught as SecretsVaultError).code).toBe(
|
|
SECRETS_VAULT_CODES.NOT_ALLOWED
|
|
);
|
|
expect((caught as SecretsVaultError).context).toEqual({
|
|
name: "AWS",
|
|
});
|
|
});
|
|
|
|
it("un-manifested read raises SECRETS_VAULT_NOT_ALLOWED", {
|
|
timeout: 5000,
|
|
}, () => {
|
|
const allow = createAllowlist({ names: ["STRIPE"] });
|
|
expect(() => allow.assertAllowed("AWS")).toThrow(SecretsVaultError);
|
|
});
|
|
|
|
it("names array is frozen", { timeout: 5000 }, () => {
|
|
const allow = createAllowlist({ names: ["A"] });
|
|
expect(Object.isFrozen(allow.names)).toBe(true);
|
|
});
|
|
});
|