initial commit: @arbiter/core authorization engine with js-rigor hardening

Zanzibar-style authorization graph engine (direct/chain/TTU/defeasible/ binary modes, condensed snapshots, value relations) with 39 rigor test campaigns. Includes fixes for snapshot binary writer/reader format mismatch (snapshot-of-snapshot corruption), possibility write-boundary validation, empty-graph snapshot serialization, relation lookup cache direction collision, config-redefinition cache invalidation, binary threshold semantics, defeasible compiled routing, and comparator reason whitelisting.
2026-07-31 13:44:06 -07:00
commit 717ae1031e
373 changed files with 654131 additions and 0 deletions
@@ -0,0 +1,238 @@
+/**
+ * Tests for Built-in DSL Functions
+ * 
+ * Tests ip_in_cidr, ip_is_private, hour_of_day, etc.
+ */
+
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import {
+  isBuiltInFunction,
+  evaluateBuiltIn,
+  getFunctionSignature,
+  BUILT_IN_FUNCTIONS
+} from '../../src/ast/interpreter/BuiltInFunctions.js';
+
+describe('Built-in Functions Registry', () => {
+  it('should identify built-in functions', () => {
+    assert.strictEqual(isBuiltInFunction('ip_in_cidr'), true);
+    assert.strictEqual(isBuiltInFunction('ip_is_private'), true);
+    assert.strictEqual(isBuiltInFunction('hour_of_day'), true);
+    assert.strictEqual(isBuiltInFunction('unknown_function'), false);
+  });
+
+  it('should return function signatures', () => {
+    const sig = getFunctionSignature('ip_in_cidr');
+    assert.ok(sig);
+    assert.strictEqual(sig.name, 'ip_in_cidr');
+    assert.deepStrictEqual(sig.params, ['ip', 'cidr']);
+  });
+
+  it('should return null for unknown functions', () => {
+    assert.strictEqual(getFunctionSignature('unknown'), null);
+  });
+});
+
+describe('IP Address Functions', () => {
+  describe('ip_in_cidr', () => {
+    it('should match IP in CIDR range', () => {
+      assert.strictEqual(evaluateBuiltIn('ip_in_cidr', ['10.0.0.5', '10.0.0.0/8']), true);
+      assert.strictEqual(evaluateBuiltIn('ip_in_cidr', ['192.168.1.50', '192.168.1.0/24']), true);
+      assert.strictEqual(evaluateBuiltIn('ip_in_cidr', ['172.16.5.1', '172.16.0.0/12']), true);
+    });
+
+    it('should not match IP outside CIDR range', () => {
+      assert.strictEqual(evaluateBuiltIn('ip_in_cidr', ['10.0.0.5', '192.168.0.0/16']), false);
+      assert.strictEqual(evaluateBuiltIn('ip_in_cidr', ['203.0.113.42', '10.0.0.0/8']), false);
+    });
+
+    it('should handle exact IP match', () => {
+      assert.strictEqual(evaluateBuiltIn('ip_in_cidr', ['203.0.113.42', '203.0.113.42/32']), true);
+    });
+
+    it('should handle edge cases', () => {
+      assert.strictEqual(evaluateBuiltIn('ip_in_cidr', ['', '10.0.0.0/8']), false);
+      assert.strictEqual(evaluateBuiltIn('ip_in_cidr', ['invalid', '10.0.0.0/8']), false);
+      assert.strictEqual(evaluateBuiltIn('ip_in_cidr', ['10.0.0.1', 'invalid']), false);
+    });
+  });
+
+  describe('ip_is_private', () => {
+    it('should identify private IPs', () => {
+      assert.strictEqual(evaluateBuiltIn('ip_is_private', ['10.0.0.1']), true);
+      assert.strictEqual(evaluateBuiltIn('ip_is_private', ['172.16.0.1']), true);
+      assert.strictEqual(evaluateBuiltIn('ip_is_private', ['192.168.1.1']), true);
+      assert.strictEqual(evaluateBuiltIn('ip_is_private', ['127.0.0.1']), true);
+    });
+
+    it('should identify public IPs', () => {
+      assert.strictEqual(evaluateBuiltIn('ip_is_private', ['8.8.8.8']), false);
+      assert.strictEqual(evaluateBuiltIn('ip_is_private', ['203.0.113.42']), false);
+    });
+
+    it('should handle invalid input', () => {
+      assert.strictEqual(evaluateBuiltIn('ip_is_private', ['']), false);
+      assert.strictEqual(evaluateBuiltIn('ip_is_private', [null]), false);
+    });
+  });
+
+  describe('ip_is_loopback', () => {
+    it('should identify loopback IPs', () => {
+      assert.strictEqual(evaluateBuiltIn('ip_is_loopback', ['127.0.0.1']), true);
+      assert.strictEqual(evaluateBuiltIn('ip_is_loopback', ['127.255.255.255']), true);
+    });
+
+    it('should not identify non-loopback IPs', () => {
+      assert.strictEqual(evaluateBuiltIn('ip_is_loopback', ['10.0.0.1']), false);
+      assert.strictEqual(evaluateBuiltIn('ip_is_loopback', ['192.168.1.1']), false);
+    });
+  });
+
+  describe('ip_version', () => {
+    it('should identify IPv4', () => {
+      assert.strictEqual(evaluateBuiltIn('ip_version', ['10.0.0.1']), 4);
+      assert.strictEqual(evaluateBuiltIn('ip_version', ['203.0.113.42']), 4);
+    });
+
+    it('should identify IPv6', () => {
+      assert.strictEqual(evaluateBuiltIn('ip_version', ['::1']), 6);
+      assert.strictEqual(evaluateBuiltIn('ip_version', ['2001:db8::1']), 6);
+    });
+
+    it('should return null for invalid', () => {
+      assert.strictEqual(evaluateBuiltIn('ip_version', ['invalid']), null);
+    });
+  });
+
+  describe('ip_is_v4 and ip_is_v6', () => {
+    it('should correctly identify versions', () => {
+      assert.strictEqual(evaluateBuiltIn('ip_is_v4', ['10.0.0.1']), true);
+      assert.strictEqual(evaluateBuiltIn('ip_is_v4', ['::1']), false);
+      assert.strictEqual(evaluateBuiltIn('ip_is_v6', ['::1']), true);
+      assert.strictEqual(evaluateBuiltIn('ip_is_v6', ['10.0.0.1']), false);
+    });
+  });
+
+  describe('ip_equals', () => {
+    it('should match equal IPs', () => {
+      assert.strictEqual(evaluateBuiltIn('ip_equals', ['10.0.0.1', '10.0.0.1']), true);
+    });
+
+    it('should not match different IPs', () => {
+      assert.strictEqual(evaluateBuiltIn('ip_equals', ['10.0.0.1', '10.0.0.2']), false);
+    });
+  });
+});
+
+describe('Time Functions', () => {
+  describe('hour_of_day', () => {
+    it('should extract hour from timestamp', () => {
+      // 2024-01-15 10:30:00 UTC
+      const ts = new Date('2024-01-15T10:30:00Z').getTime();
+      assert.strictEqual(evaluateBuiltIn('hour_of_day', [ts]), new Date(ts).getHours());
+    });
+
+    it('should handle midnight', () => {
+      const ts = new Date('2024-01-15T00:00:00Z').getTime();
+      assert.strictEqual(evaluateBuiltIn('hour_of_day', [ts]), new Date(ts).getHours());
+    });
+
+    it('should handle noon', () => {
+      const ts = new Date('2024-01-15T12:00:00Z').getTime();
+      assert.strictEqual(evaluateBuiltIn('hour_of_day', [ts]), new Date(ts).getHours());
+    });
+
+    it('should handle 23:00', () => {
+      const ts = new Date('2024-01-15T23:00:00Z').getTime();
+      assert.strictEqual(evaluateBuiltIn('hour_of_day', [ts]), new Date(ts).getHours());
+    });
+  });
+
+  describe('day_of_week', () => {
+    it('should extract day of week', () => {
+      // Sunday = 0
+      const sun = new Date('2024-01-14T00:00:00Z').getTime();
+      assert.strictEqual(evaluateBuiltIn('day_of_week', [sun]), new Date(sun).getDay());
+
+      // Monday = 1
+      const mon = new Date('2024-01-15T00:00:00Z').getTime();
+      assert.strictEqual(evaluateBuiltIn('day_of_week', [mon]), new Date(mon).getDay());
+    });
+  });
+});
+
+describe('String Functions', () => {
+  describe('contains', () => {
+    it('should find substring', () => {
+      assert.strictEqual(evaluateBuiltIn('contains', ['hello world', 'world']), true);
+      assert.strictEqual(evaluateBuiltIn('contains', ['hello world', 'foo']), false);
+    });
+
+    it('should handle empty strings', () => {
+      assert.strictEqual(evaluateBuiltIn('contains', ['', 'foo']), false);
+      assert.strictEqual(evaluateBuiltIn('contains', ['hello', '']), false);
+    });
+  });
+
+  describe('starts_with', () => {
+    it('should match prefix', () => {
+      assert.strictEqual(evaluateBuiltIn('starts_with', ['hello world', 'hello']), true);
+      assert.strictEqual(evaluateBuiltIn('starts_with', ['hello world', 'world']), false);
+    });
+  });
+
+  describe('ends_with', () => {
+    it('should match suffix', () => {
+      assert.strictEqual(evaluateBuiltIn('ends_with', ['hello world', 'world']), true);
+      assert.strictEqual(evaluateBuiltIn('ends_with', ['hello world', 'hello']), false);
+    });
+  });
+});
+
+describe('Comparison Functions', () => {
+  describe('equals', () => {
+    it('should check equality', () => {
+      assert.strictEqual(evaluateBuiltIn('equals', [1, 1]), true);
+      assert.strictEqual(evaluateBuiltIn('equals', [1, 2]), false);
+      assert.strictEqual(evaluateBuiltIn('equals', ['a', 'a']), true);
+    });
+  });
+
+  describe('greater_than', () => {
+    it('should compare numbers', () => {
+      assert.strictEqual(evaluateBuiltIn('greater_than', [2, 1]), true);
+      assert.strictEqual(evaluateBuiltIn('greater_than', [1, 2]), false);
+    });
+  });
+
+  describe('less_than', () => {
+    it('should compare numbers', () => {
+      assert.strictEqual(evaluateBuiltIn('less_than', [1, 2]), true);
+      assert.strictEqual(evaluateBuiltIn('less_than', [2, 1]), false);
+    });
+  });
+
+  describe('in_range', () => {
+    it('should check range', () => {
+      assert.strictEqual(evaluateBuiltIn('in_range', [5, 1, 10]), true);
+      assert.strictEqual(evaluateBuiltIn('in_range', [0, 1, 10]), false);
+      assert.strictEqual(evaluateBuiltIn('in_range', [11, 1, 10]), false);
+      assert.strictEqual(evaluateBuiltIn('in_range', [1, 1, 10]), true); // inclusive
+      assert.strictEqual(evaluateBuiltIn('in_range', [10, 1, 10]), true); // inclusive
+    });
+  });
+});
+
+describe('Error Handling', () => {
+  it('should throw on unknown function', () => {
+    assert.throws(() => {
+      evaluateBuiltIn('unknown', []);
+    }, /Unknown built-in function/);
+  });
+
+  it('should throw on wrong argument count', () => {
+    assert.throws(() => {
+      evaluateBuiltIn('ip_in_cidr', ['10.0.0.1']); // Missing cidr
+    }, /expects 2 arguments/);
+  });
+});