initial commit: @arbiter/core authorization engine with js-rigor hardening

Zanzibar-style authorization graph engine (direct/chain/TTU/defeasible/ binary modes, condensed snapshots, value relations) with 39 rigor test campaigns. Includes fixes for snapshot binary writer/reader format mismatch (snapshot-of-snapshot corruption), possibility write-boundary validation, empty-graph snapshot serialization, relation lookup cache direction collision, config-redefinition cache invalidation, binary threshold semantics, defeasible compiled routing, and comparator reason whitelisting.
2026-07-31 13:44:06 -07:00
commit 717ae1031e
373 changed files with 654131 additions and 0 deletions
@@ -0,0 +1,66 @@
+import { describe, test } from 'node:test';
+import assert from 'node:assert/strict';
+import { Arbiter } from '../../src/core/Arbiter.js';
+
+describe('OWA relational comparator', () => {
+  test('nested OWA aggregation compares values', () => {
+    const arbiter = new Arbiter();
+    arbiter.addNode('user:1', 'user');
+    arbiter.addNode('resource:1', 'resource');
+
+    arbiter.addRelation('user:1', 'risk_score', 'resource:1', 1.0, { value: 40 });
+    arbiter.addRelation('user:1', 'risk_bonus', 'resource:1', 1.0, { value: 10 });
+    arbiter.addRelation('user:1', 'risk_noise', 'resource:1', 1.0, { value: 0 });
+    arbiter.addRelation('resource:1', 'risk_limit', 'resource:1', 1.0, { value: 50 });
+    arbiter.addRelation('resource:1', 'risk_cap', 'resource:1', 1.0, { value: 80 });
+
+    arbiter.setRelationConfig('risk_score', { type: 'direct' });
+    arbiter.setRelationConfig('risk_bonus', { type: 'direct' });
+    arbiter.setRelationConfig('risk_noise', { type: 'direct' });
+    arbiter.setRelationConfig('risk_limit', { type: 'direct' });
+    arbiter.setRelationConfig('risk_cap', { type: 'direct' });
+    arbiter.setRelationConfig('risk_ok_owa', {
+      type: 'relational_comparator',
+      comparator: '<=',
+      fallbackBehavior: 'deny',
+      left: {
+        rule: {
+          union: {
+            rules: [
+              { type: 'direct', relation: 'risk_score' },
+              { type: 'direct', relation: 'risk_bonus' },
+              { type: 'direct', relation: 'risk_noise' }
+            ],
+            aggregator: 'owa',
+            owaWeights: [0.5, 0.3, 0.2]
+          }
+        },
+        extractValue: true,
+        valueRelation: 'risk_score',
+        aggregator: 'owa',
+        owaWeights: [0.5, 0.3, 0.2]
+      },
+      right: {
+        rule: {
+          union: {
+            rules: [
+              { type: 'direct', relation: 'risk_limit' },
+              { type: 'direct', relation: 'risk_cap' }
+            ],
+            aggregator: 'owa',
+            owaWeights: [0.6, 0.4]
+          }
+        },
+        extractValue: true,
+        valueRelation: 'risk_limit',
+        evaluateFrom: 'object',
+        aggregator: 'owa',
+        owaWeights: [0.6, 0.4]
+      }
+    });
+
+    const result = arbiter.check('user:1', 'risk_ok_owa', 'resource:1', { fastPath: false });
+    assert.ok(result);
+    assert.ok(result.possibility > 0);
+  });
+});