initial commit: @arbiter/core authorization engine with js-rigor hardening

Zanzibar-style authorization graph engine (direct/chain/TTU/defeasible/ binary modes, condensed snapshots, value relations) with 39 rigor test campaigns. Includes fixes for snapshot binary writer/reader format mismatch (snapshot-of-snapshot corruption), possibility write-boundary validation, empty-graph snapshot serialization, relation lookup cache direction collision, config-redefinition cache invalidation, binary threshold semantics, defeasible compiled routing, and comparator reason whitelisting.
2026-07-31 13:44:06 -07:00
commit 717ae1031e
373 changed files with 654131 additions and 0 deletions
@@ -0,0 +1,107 @@
+import assert from 'node:assert/strict';
+import { describe, test } from 'node:test';
+import { Arbiter } from '../../src/core/Arbiter.js';
+
+describe('Value Aggregation', () => {
+  test('max aggregator returns highest value', () => {
+    const arbiter = new Arbiter();
+    
+    arbiter.addNode('user:1', 'user');
+    arbiter.addNode('user:2', 'user');
+    arbiter.addNode('user:3', 'user');
+    arbiter.addNode('resource:1', 'resource');
+    
+    arbiter.setRelationConfig('member', { type: 'direct' });
+    arbiter.setRelationConfig('allow', {
+      union: {
+        rules: [{ type: 'direct', relation: 'member' }],
+        aggregator: 'max'
+      }
+    });
+    
+    arbiter.addRelation('user:1', 'member', 'resource:1', 0.3);
+    arbiter.addRelation('user:2', 'member', 'resource:1', 0.7);
+    arbiter.addRelation('user:3', 'member', 'resource:1', 0.5);
+    
+    const result = arbiter.check('user:2', 'allow', 'resource:1', { fastPath: false });
+    assert.strictEqual(result.possibility, 0.7, 'max returns 0.7');
+  });
+
+  test('sum aggregator returns total', () => {
+    const arbiter = new Arbiter();
+    
+    arbiter.addNode('user:1', 'user');
+    arbiter.addNode('resource:1', 'resource');
+    
+    arbiter.setRelationConfig('permission1', { type: 'direct' });
+    arbiter.setRelationConfig('permission2', { type: 'direct' });
+    arbiter.setRelationConfig('permission3', { type: 'direct' });
+    arbiter.setRelationConfig('allow', {
+      union: {
+        rules: [
+          { type: 'direct', relation: 'permission1' },
+          { type: 'direct', relation: 'permission2' },
+          { type: 'direct', relation: 'permission3' }
+        ],
+        aggregator: 'sum'
+      }
+    });
+    
+    arbiter.addRelation('user:1', 'permission1', 'resource:1', 0.2);
+    arbiter.addRelation('user:1', 'permission2', 'resource:1', 0.3);
+    arbiter.addRelation('user:1', 'permission3', 'resource:1', 0.4);
+    
+    const result = arbiter.check('user:1', 'allow', 'resource:1', { fastPath: false });
+    assert.ok(Math.abs(result.possibility - 0.9) < 1e-6, `sum returns 0.9, got ${result.possibility}`);
+  });
+
+  test('min aggregator returns lowest value', () => {
+    const arbiter = new Arbiter();
+    
+    arbiter.addNode('user:1', 'user');
+    arbiter.addNode('resource:1', 'resource');
+    
+    arbiter.setRelationConfig('permission1', { type: 'direct' });
+    arbiter.setRelationConfig('permission2', { type: 'direct' });
+    arbiter.setRelationConfig('allow', {
+      union: {
+        rules: [
+          { type: 'direct', relation: 'permission1' },
+          { type: 'direct', relation: 'permission2' }
+        ],
+        aggregator: 'min'
+      }
+    });
+    
+    arbiter.addRelation('user:1', 'permission1', 'resource:1', 0.3);
+    arbiter.addRelation('user:1', 'permission2', 'resource:1', 0.7);
+    
+    const result = arbiter.check('user:1', 'allow', 'resource:1', { fastPath: false });
+    assert.strictEqual(result.possibility, 0.3, 'min returns 0.3');
+  });
+
+  test('intersection with sum requires both relations', () => {
+    const arbiter = new Arbiter();
+    
+    arbiter.addNode('user:1', 'user');
+    arbiter.addNode('resource:1', 'resource');
+    
+    arbiter.setRelationConfig('permission1', { type: 'direct' });
+    arbiter.setRelationConfig('permission2', { type: 'direct' });
+    arbiter.setRelationConfig('allow', {
+      intersection: {
+        rules: [
+          { type: 'direct', relation: 'permission1' },
+          { type: 'direct', relation: 'permission2' }
+        ],
+        aggregator: 'sum'
+      }
+    });
+    
+    arbiter.addRelation('user:1', 'permission1', 'resource:1', 0.3);
+    arbiter.addRelation('user:1', 'permission2', 'resource:1', 0.7);
+    
+    const result = arbiter.check('user:1', 'allow', 'resource:1', { fastPath: false });
+    assert.strictEqual(result.possibility, 1.0, 'sum of both relations');
+  });
+});