John Dvorak
717ae1031e
Zanzibar-style authorization graph engine (direct/chain/TTU/defeasible/ binary modes, condensed snapshots, value relations) with 39 rigor test campaigns. Includes fixes for snapshot binary writer/reader format mismatch (snapshot-of-snapshot corruption), possibility write-boundary validation, empty-graph snapshot serialization, relation lookup cache direction collision, config-redefinition cache invalidation, binary threshold semantics, defeasible compiled routing, and comparator reason whitelisting.
108 lines
3.8 KiB
JavaScript
108 lines
3.8 KiB
JavaScript
import assert from 'node:assert/strict';
|
|
import { describe, test } from 'node:test';
|
|
import { Arbiter } from '../../src/core/Arbiter.js';
|
|
|
|
describe('Value Aggregation', () => {
|
|
test('max aggregator returns highest value', () => {
|
|
const arbiter = new Arbiter();
|
|
|
|
arbiter.addNode('user:1', 'user');
|
|
arbiter.addNode('user:2', 'user');
|
|
arbiter.addNode('user:3', 'user');
|
|
arbiter.addNode('resource:1', 'resource');
|
|
|
|
arbiter.setRelationConfig('member', { type: 'direct' });
|
|
arbiter.setRelationConfig('allow', {
|
|
union: {
|
|
rules: [{ type: 'direct', relation: 'member' }],
|
|
aggregator: 'max'
|
|
}
|
|
});
|
|
|
|
arbiter.addRelation('user:1', 'member', 'resource:1', 0.3);
|
|
arbiter.addRelation('user:2', 'member', 'resource:1', 0.7);
|
|
arbiter.addRelation('user:3', 'member', 'resource:1', 0.5);
|
|
|
|
const result = arbiter.check('user:2', 'allow', 'resource:1', { fastPath: false });
|
|
assert.strictEqual(result.possibility, 0.7, 'max returns 0.7');
|
|
});
|
|
|
|
test('sum aggregator returns total', () => {
|
|
const arbiter = new Arbiter();
|
|
|
|
arbiter.addNode('user:1', 'user');
|
|
arbiter.addNode('resource:1', 'resource');
|
|
|
|
arbiter.setRelationConfig('permission1', { type: 'direct' });
|
|
arbiter.setRelationConfig('permission2', { type: 'direct' });
|
|
arbiter.setRelationConfig('permission3', { type: 'direct' });
|
|
arbiter.setRelationConfig('allow', {
|
|
union: {
|
|
rules: [
|
|
{ type: 'direct', relation: 'permission1' },
|
|
{ type: 'direct', relation: 'permission2' },
|
|
{ type: 'direct', relation: 'permission3' }
|
|
],
|
|
aggregator: 'sum'
|
|
}
|
|
});
|
|
|
|
arbiter.addRelation('user:1', 'permission1', 'resource:1', 0.2);
|
|
arbiter.addRelation('user:1', 'permission2', 'resource:1', 0.3);
|
|
arbiter.addRelation('user:1', 'permission3', 'resource:1', 0.4);
|
|
|
|
const result = arbiter.check('user:1', 'allow', 'resource:1', { fastPath: false });
|
|
assert.ok(Math.abs(result.possibility - 0.9) < 1e-6, `sum returns 0.9, got ${result.possibility}`);
|
|
});
|
|
|
|
test('min aggregator returns lowest value', () => {
|
|
const arbiter = new Arbiter();
|
|
|
|
arbiter.addNode('user:1', 'user');
|
|
arbiter.addNode('resource:1', 'resource');
|
|
|
|
arbiter.setRelationConfig('permission1', { type: 'direct' });
|
|
arbiter.setRelationConfig('permission2', { type: 'direct' });
|
|
arbiter.setRelationConfig('allow', {
|
|
union: {
|
|
rules: [
|
|
{ type: 'direct', relation: 'permission1' },
|
|
{ type: 'direct', relation: 'permission2' }
|
|
],
|
|
aggregator: 'min'
|
|
}
|
|
});
|
|
|
|
arbiter.addRelation('user:1', 'permission1', 'resource:1', 0.3);
|
|
arbiter.addRelation('user:1', 'permission2', 'resource:1', 0.7);
|
|
|
|
const result = arbiter.check('user:1', 'allow', 'resource:1', { fastPath: false });
|
|
assert.strictEqual(result.possibility, 0.3, 'min returns 0.3');
|
|
});
|
|
|
|
test('intersection with sum requires both relations', () => {
|
|
const arbiter = new Arbiter();
|
|
|
|
arbiter.addNode('user:1', 'user');
|
|
arbiter.addNode('resource:1', 'resource');
|
|
|
|
arbiter.setRelationConfig('permission1', { type: 'direct' });
|
|
arbiter.setRelationConfig('permission2', { type: 'direct' });
|
|
arbiter.setRelationConfig('allow', {
|
|
intersection: {
|
|
rules: [
|
|
{ type: 'direct', relation: 'permission1' },
|
|
{ type: 'direct', relation: 'permission2' }
|
|
],
|
|
aggregator: 'sum'
|
|
}
|
|
});
|
|
|
|
arbiter.addRelation('user:1', 'permission1', 'resource:1', 0.3);
|
|
arbiter.addRelation('user:1', 'permission2', 'resource:1', 0.7);
|
|
|
|
const result = arbiter.check('user:1', 'allow', 'resource:1', { fastPath: false });
|
|
assert.strictEqual(result.possibility, 1.0, 'sum of both relations');
|
|
});
|
|
});
|