initial commit: @arbiter/core authorization engine with js-rigor hardening

Zanzibar-style authorization graph engine (direct/chain/TTU/defeasible/ binary modes, condensed snapshots, value relations) with 39 rigor test campaigns. Includes fixes for snapshot binary writer/reader format mismatch (snapshot-of-snapshot corruption), possibility write-boundary validation, empty-graph snapshot serialization, relation lookup cache direction collision, config-redefinition cache invalidation, binary threshold semantics, defeasible compiled routing, and comparator reason whitelisting.
2026-07-31 13:44:06 -07:00
commit 717ae1031e
373 changed files with 654131 additions and 0 deletions
@@ -0,0 +1,58 @@
+import { describe, test } from 'node:test';
+import assert from 'node:assert/strict';
+import { validateDslText } from '../../src/ast/validation/DSLValidation.js';
+
+describe('DSL injectable predicates (* prefix)', () => {
+  test('allows injectable predicates with * prefix in evidence bodies', () => {
+    const dsl = `
+      definition Doc { id: string }
+      definition Proof { issued_at: timestamp }
+      fact owns(user: User, doc: Doc)
+      source *mfa(user: User) PROVIDES Proof
+      source *webauthn(user: User) PROVIDES Proof
+
+      evidence can_delete(user: User, doc: Doc) {
+        owns(user, doc)
+        *mfa(user)
+        *webauthn(user)
+      }
+    `;
+
+    const result = validateDslText(dsl);
+    assert.equal(result.success, true, result.errors.join('\n'));
+    assert.equal(result.errors.length, 0);
+  });
+
+  test('injectable facts parse with * prefix', () => {
+    const dsl = `
+      definition Doc { id: string }
+      fact *device_link(user: User, device: string)
+
+      evidence is_trusted(user: User) {
+        *device_link(user, "trusted_device_01")
+      }
+    `;
+
+    const result = validateDslText(dsl);
+    assert.equal(result.success, true, result.errors.join('\n'));
+    assert.equal(result.errors.length, 0);
+  });
+
+  test('allows within constraints on injectable predicates', () => {
+    const dsl = `
+      definition Doc { id: string }
+      definition Proof { issued_at: timestamp }
+      fact owns(user: User, doc: Doc)
+      source *mfa(user: User) PROVIDES Proof within 10m
+
+      evidence can_delete(user: User, doc: Doc) {
+        owns(user, doc)
+        *mfa(user)
+      }
+    `;
+
+    const result = validateDslText(dsl);
+    assert.equal(result.success, true, result.errors.join('\n'));
+    assert.equal(result.errors.length, 0);
+  });
+});