/** * tests/rigor/complex-graphs.js — realistic complex graph generators for * the rigor crucibles. * * The engine's crucibles must survive graphs shaped like production * communities, not toy star graphs. Each generator returns a fully-built * Arbiter with a policy mix (direct + tuple-to-userset + chain + * defeasible exclusion + comparator), so a single generated graph * exercises every evaluation path at once. * * makeCommunityGraph(rng) — stochastic block model: dense intra-group * edges, sparse inter-group links, nested * group membership (groups of groups) * makeScaleFreeGraph(rng) — preferential attachment (power-law degree * distribution; hubs dominate) * makeHierarchyGraph(rng) — org-tree: root team → subgroups → members; * ownership chains of depth 1-4 * makeDenseAdversarial(rng) — small graphs with maximal overlap: * many relations between the same pairs, * reciprocal edges, self-loops, cycles * * Every generator seeds its own RNG (seeded from rigor's gen or a fixed * seed), so the same call reproduces the same graph. */ import { Arbiter } from '../../src/index.js'; function mulberry32(seed) { let a = seed >>> 0; return function () { a |= 0; a = (a + 0x6d2b79f5) | 0; let t = Math.imul(a ^ (a >>> 15), 1 | a); t = (t + Math.imul(t ^ (t >>> 7), 61 | t)) ^ t; return ((t ^ (t >>> 14)) >>> 0) / 4294967296; }; } function pick(rng, arr) { return arr[Math.floor(rng() * arr.length)]; } function randPossibility(rng, min = 0.3) { return min + rng() * (1 - min); } /** * Stochastic block model with nested groups. * * Communities are groups (and groups of groups). Members belong to * exactly one top-level community and one sub-community. Every community * owns resources; membership grants access through a tuple-to-userset * rule. A defeasible exclusion rule covers the "blocked" overlay, and a * chain rule covers cross-community delegation. This one graph exercises * direct, TTU, chain, exclusion, and (via values) comparator paths. */ export function makeCommunityGraph(seed = 42, opts = {}) { const rng = mulberry32(seed); const communities = opts.communities ?? 5; const membersPerCommunity = opts.membersPerCommunity ?? 12; const resourcesPerCommunity = opts.resourcesPerCommunity ?? 6; const subCommunities = opts.subCommunities ?? 2; const arbiter = new Arbiter(); const users = []; const groups = []; const subGroups = []; const resources = []; const relations = []; // { src, rel, dst, possibility } for (let c = 0; c < communities; c++) { groups.push(`group:${c}`); arbiter.addNode(`group:${c}`, 'group'); for (let s = 0; s < subCommunities; s++) { const key = `sub:${c}:${s}`; subGroups.push(key); arbiter.addNode(key, 'group'); relations.push({ src: key, rel: 'parent', dst: `group:${c}`, possibility: 1 }); // Sub-groups own their own resources so a one-level TTU // (member -> owns) is reachable from members. for (let r = 0; r < resourcesPerCommunity; r++) { const rkey = `res:${c}:${s}:${r}`; resources.push(rkey); arbiter.addNode(rkey, 'resource'); relations.push({ src: key, rel: 'owns', dst: rkey, possibility: 1 }); } } for (let r = 0; r < resourcesPerCommunity; r++) { const key = `res:${c}:${r}`; resources.push(key); arbiter.addNode(key, 'resource'); relations.push({ src: `group:${c}`, rel: 'owns', dst: key, possibility: 1 }); } for (let m = 0; m < membersPerCommunity; m++) { const key = `user:${c}:${m}`; users.push(key); arbiter.addNode(key, 'user'); const home = pick(rng, subGroups.filter(g => g.startsWith(`sub:${c}:`))); relations.push({ src: key, rel: 'member', dst: home, possibility: 1 }); // Some members also hold direct access. if (rng() < 0.3) { relations.push({ src: key, rel: 'direct_access', dst: pick(rng, resources), possibility: randPossibility(rng) }); } } } // Inter-community edges: sparse links between groups (delegation). for (let c = 0; c < communities; c++) { for (let s = 0; s < subCommunities; s++) { if (rng() < 0.4) { const other = (c + 1 + Math.floor(rng() * (communities - 1))) % communities; relations.push({ src: `sub:${c}:${s}`, rel: 'delegate', dst: pick(rng, subGroups.filter(g => g.startsWith(`sub:${other}:`))), possibility: randPossibility(rng, 0.5) }); } } } // Blocked overlay: ~10% of users blocked on some resource. for (const u of users) { if (rng() < 0.1) { relations.push({ src: u, rel: 'blocked', dst: pick(rng, resources), possibility: 1 }); } } for (const rel of relations) { arbiter.addRelation(rel.src, rel.rel, rel.dst, { possibility: rel.possibility }); } arbiter.setRelationConfig('parent', { type: 'direct' }); arbiter.setRelationConfig('owns', { type: 'direct' }); arbiter.setRelationConfig('member', { type: 'direct' }); arbiter.setRelationConfig('direct_access', { type: 'direct' }); arbiter.setRelationConfig('delegate', { type: 'direct' }); arbiter.setRelationConfig('blocked', { type: 'direct' }); arbiter.setRelationConfig('can_read', { type: 'tuple_to_userset', tuplesetRelation: 'owns', tuplesetDirection: 'in', computedRelation: 'member' }); arbiter.setRelationConfig('can_read_with_direct', { union: [ { type: 'tuple_to_userset', tuplesetRelation: 'owns', tuplesetDirection: 'in', computedRelation: 'member' }, { type: 'direct', relation: 'direct_access' } ] }); arbiter.setRelationConfig('can_read_not_blocked', { exclusion: [ { type: 'tuple_to_userset', tuplesetRelation: 'owns', tuplesetDirection: 'in', computedRelation: 'member' }, { type: 'direct', relation: 'blocked' } ] }); arbiter.setRelationConfig('can_delegate_read', { type: 'chain', steps: [ { relation: 'member', direction: 'out' }, { relation: 'delegate', direction: 'out' } ], collectValues: false }); return { arbiter, users, groups, subGroups, resources, relations, meta: { kind: 'community', communities, membersPerCommunity, resourcesPerCommunity, subCommunities } }; } /** * Preferential attachment (Barabási-Albert): power-law degree distribution. * * Resources are created as "popularity magnets" with a few initial edges; * users attach preferentially to already-popular resources, producing a * handful of hubs with hundreds of edges. Exercises long adjacency lists, * hub contention, and cache pressure. */ export function makeScaleFreeGraph(seed = 42, opts = {}) { const rng = mulberry32(seed); const users = opts.users ?? 150; const resources = opts.resources ?? 30; const edges = opts.edges ?? 400; const arbiter = new Arbiter(); const userKeys = []; const resourceKeys = []; const degree = new Map(); for (let i = 0; i < users; i++) { const k = `user:${i}`; userKeys.push(k); arbiter.addNode(k, 'user'); } for (let i = 0; i < resources; i++) { const k = `res:${i}`; resourceKeys.push(k); arbiter.addNode(k, 'resource'); } const allKeys = [...userKeys, ...resourceKeys]; const attach = () => { if (allKeys.length < 2) return allKeys[0]; // Preferential: pick a random node, then walk toward higher degree. let v = pick(rng, allKeys); for (let hop = 0; hop < 3; hop++) { const neighbors = []; for (const [k, d] of degree) neighbors.push([k, d]); const sampled = neighbors[Math.floor(rng() * neighbors.length)]; if (sampled && sampled[1] > (degree.get(v) || 0)) v = sampled[0]; } return v; }; for (let e = 0; e < edges; e++) { const src = pick(rng, userKeys); const dst = attach(); if (src === dst) continue; const rel = rng() < 0.6 ? 'can_read' : 'can_write'; arbiter.addRelation(src, rel, dst, { possibility: randPossibility(rng) }); degree.set(dst, (degree.get(dst) || 0) + 1); } arbiter.setRelationConfig('can_read', { type: 'direct' }); arbiter.setRelationConfig('can_write', { type: 'direct' }); return { arbiter, users: userKeys, resources: resourceKeys, relations: null, meta: { kind: 'scale-free', users, resources, edges } }; } /** * Org-tree hierarchy: nested teams with ownership chains of depth 1-4. * * A root "org" owns everything; departments own their section resources; * teams own project resources. Membership is a chain: user → team → * department → org. A chain rule grants access along ownership. This * exercises multi-hop traversal with cycles prevented by tree structure. */ export function makeHierarchyGraph(seed = 42, opts = {}) { const rng = mulberry32(seed); const departments = opts.departments ?? 4; const teamsPerDept = opts.teamsPerDept ?? 3; const membersPerTeam = opts.membersPerTeam ?? 6; const resourcesPerTeam = opts.resourcesPerTeam ?? 4; const arbiter = new Arbiter(); const users = []; const teams = []; const resources = []; const relations = []; arbiter.addNode('org:0', 'group'); for (let d = 0; d < departments; d++) { const dept = `dept:${d}`; arbiter.addNode(dept, 'group'); relations.push({ src: dept, rel: 'parent', dst: 'org:0', possibility: 1 }); for (let r = 0; r < 2; r++) { const key = `${dept}:res:${r}`; resources.push(key); arbiter.addNode(key, 'resource'); relations.push({ src: dept, rel: 'owns', dst: key, possibility: 1 }); } for (let t = 0; t < teamsPerDept; t++) { const team = `${dept}:team:${t}`; teams.push(team); arbiter.addNode(team, 'group'); relations.push({ src: team, rel: 'parent', dst: dept, possibility: 1 }); for (let r = 0; r < resourcesPerTeam; r++) { const key = `${team}:res:${r}`; resources.push(key); arbiter.addNode(key, 'resource'); relations.push({ src: team, rel: 'owns', dst: key, possibility: 1 }); } for (let m = 0; m < membersPerTeam; m++) { const key = `${team}:user:${m}`; users.push(key); arbiter.addNode(key, 'user'); relations.push({ src: key, rel: 'member', dst: team, possibility: 1 }); } } } for (const rel of relations) { arbiter.addRelation(rel.src, rel.rel, rel.dst, { possibility: rel.possibility }); } arbiter.setRelationConfig('parent', { type: 'direct' }); arbiter.setRelationConfig('owns', { type: 'direct' }); arbiter.setRelationConfig('member', { type: 'direct' }); arbiter.setRelationConfig('can_access_org', { type: 'chain', steps: [ { relation: 'member', direction: 'out' }, { relation: 'parent', direction: 'out' }, { relation: 'owns', direction: 'out' } ], collectValues: false }); return { arbiter, users, teams, resources, relations, meta: { kind: 'hierarchy', departments, teamsPerDept, membersPerTeam, resourcesPerTeam } }; } /** * Dense adversarial: maximal overlap on a small graph. * * Every user touches every resource with multiple relations; reciprocal * edges, self-loops, and multi-rule policies create dense adjacency and * cycle pressure. Built to catch traversal blowup and cache collisions, * not to model a real community. */ export function makeDenseAdversarial(seed = 42, opts = {}) { const rng = mulberry32(seed); const users = opts.users ?? 8; const resources = opts.resources ?? 6; const arbiter = new Arbiter(); const userKeys = []; const resourceKeys = []; for (let i = 0; i < users; i++) { const k = `user:${i}`; userKeys.push(k); arbiter.addNode(k, 'user'); } for (let i = 0; i < resources; i++) { const k = `res:${i}`; resourceKeys.push(k); arbiter.addNode(k, 'resource'); } arbiter.setRelationConfig('can_read', { type: 'direct' }); arbiter.setRelationConfig('can_write', { type: 'direct' }); arbiter.setRelationConfig('member', { type: 'direct' }); arbiter.setRelationConfig('owns', { type: 'direct' }); arbiter.setRelationConfig('can_access', { union: [ { type: 'direct', relation: 'can_read' }, { type: 'direct', relation: 'can_write' }, { type: 'tuple_to_userset', tuplesetRelation: 'owns', tuplesetDirection: 'in', computedRelation: 'member' } ] }); for (const u of userKeys) { for (const r of resourceKeys) { if (rng() < 0.9) arbiter.addRelation(u, 'can_read', r, { possibility: randPossibility(rng) }); if (rng() < 0.5) arbiter.addRelation(u, 'can_write', r, { possibility: randPossibility(rng) }); if (rng() < 0.5) arbiter.addRelation(u, 'member', r, { possibility: 1 }); if (rng() < 0.3) arbiter.addRelation(r, 'owns', u, { possibility: 1 }); // reciprocal } if (rng() < 0.3) arbiter.addRelation(u, 'can_read', u, { possibility: 0.5 }); // self-loop } return { arbiter, users: userKeys, resources: resourceKeys, relations: null, meta: { kind: 'dense-adversarial', users, resources } }; } export const GENERATORS = { community: makeCommunityGraph, 'scale-free': makeScaleFreeGraph, hierarchy: makeHierarchyGraph, 'dense-adversarial': makeDenseAdversarial };