initial commit: @arbiter/core authorization engine with js-rigor hardening

Zanzibar-style authorization graph engine (direct/chain/TTU/defeasible/ binary modes, condensed snapshots, value relations) with 39 rigor test campaigns. Includes fixes for snapshot binary writer/reader format mismatch (snapshot-of-snapshot corruption), possibility write-boundary validation, empty-graph snapshot serialization, relation lookup cache direction collision, config-redefinition cache invalidation, binary threshold semantics, defeasible compiled routing, and comparator reason whitelisting.
2026-07-31 13:44:06 -07:00
commit 717ae1031e
373 changed files with 654131 additions and 0 deletions
@@ -0,0 +1,46 @@
+import { describe, test } from 'node:test';
+import assert from 'node:assert/strict';
+import { UnifiedKeyManager } from '../../src/core/UnifiedKeyManager.js';
+
+describe('UnifiedKeyManager key uniqueness', () => {
+  test('composite keys differ for distinct small tuples', () => {
+    const keyManager = new UnifiedKeyManager();
+    const keyA = keyManager.createCompositeKey(1, 'rel', 2);
+    const keyB = keyManager.createCompositeKey(2, 'rel', 2);
+    const keyC = keyManager.createCompositeKey(1, 'rel', 3);
+    assert.notStrictEqual(keyA, keyB);
+    assert.notStrictEqual(keyA, keyC);
+  });
+
+  test('composite keys remain unique for large ids', () => {
+    const keyManager = new UnifiedKeyManager();
+    const relation = 'rel';
+    const srcIdA = 1;
+    const srcIdB = 1 + (1 << 18);
+    const dstId = 1;
+    const keyA = keyManager.createCompositeKey(srcIdA, relation, dstId);
+    const keyB = keyManager.createCompositeKey(srcIdB, relation, dstId);
+    assert.notStrictEqual(keyA, keyB);
+  });
+
+  test('source-relation keys remain unique for large ids', () => {
+    const keyManager = new UnifiedKeyManager();
+    const relation = 'rel';
+    const srcIdA = 1;
+    const srcIdB = 1 + (1 << 16);
+    const keyA = keyManager.createSrcRelKey(srcIdA, relation);
+    const keyB = keyManager.createSrcRelKey(srcIdB, relation);
+    assert.notStrictEqual(keyA, keyB);
+  });
+
+  test('chain keys remain unique for large ids', () => {
+    const keyManager = new UnifiedKeyManager();
+    const steps = [{ relation: 'rel', direction: 'out' }];
+    const userIdA = 1;
+    const userIdB = 1 + (1 << 18);
+    const objectId = 42;
+    const keyA = keyManager.createChainKey(userIdA, objectId, steps);
+    const keyB = keyManager.createChainKey(userIdB, objectId, steps);
+    assert.notStrictEqual(keyA, keyB);
+  });
+});