John Dvorak
717ae1031e
Zanzibar-style authorization graph engine (direct/chain/TTU/defeasible/ binary modes, condensed snapshots, value relations) with 39 rigor test campaigns. Includes fixes for snapshot binary writer/reader format mismatch (snapshot-of-snapshot corruption), possibility write-boundary validation, empty-graph snapshot serialization, relation lookup cache direction collision, config-redefinition cache invalidation, binary threshold semantics, defeasible compiled routing, and comparator reason whitelisting.
86 lines
2.9 KiB
JavaScript
86 lines
2.9 KiB
JavaScript
import { describe, test } from 'node:test';
|
|
import assert from 'node:assert/strict';
|
|
import fc from 'fast-check';
|
|
import { Arbiter } from '../../src/core/Arbiter.js';
|
|
|
|
describe('Fast-check: injectable witness invariants', () => {
|
|
test('injectable witness present/absent determinism', () => {
|
|
fc.assert(
|
|
fc.property(
|
|
fc.integer({ min: 1, max: 5 }),
|
|
fc.boolean(),
|
|
(userCount, hasProof) => {
|
|
const arbiter = new Arbiter();
|
|
arbiter.setRelationConfig('mfa', {
|
|
type: 'source',
|
|
relation: 'mfa',
|
|
injectable: true,
|
|
provides: 'Proof'
|
|
});
|
|
arbiter.setRelationConfig('secure_action', {
|
|
type: 'direct',
|
|
relation: 'mfa'
|
|
});
|
|
|
|
for (let u = 0; u < userCount; u++) {
|
|
arbiter.addNode(`user:${u}`, 'user');
|
|
}
|
|
arbiter.addNode('resource:0', 'resource');
|
|
|
|
if (hasProof) {
|
|
arbiter.addRelation('user:0', 'mfa', 'resource:0', 1.0);
|
|
}
|
|
|
|
const result = arbiter.check('user:0', 'secure_action', 'resource:0');
|
|
|
|
assert.strictEqual(result.possibility > 0, hasProof);
|
|
if (!hasProof) {
|
|
assert.ok(result.remediation?.options?.length > 0);
|
|
}
|
|
}
|
|
),
|
|
{ numRuns: 40 }
|
|
);
|
|
});
|
|
|
|
test('direct injectable witness remediation when missing', () => {
|
|
fc.assert(
|
|
fc.property(
|
|
fc.boolean(),
|
|
fc.boolean(),
|
|
(hasMfa, hasWebauthn) => {
|
|
const arbiter = new Arbiter();
|
|
arbiter.setRelationConfig('mfa', {
|
|
type: 'direct', relation: 'mfa', injectable: true, provides: 'Proof'
|
|
});
|
|
arbiter.setRelationConfig('webauthn', {
|
|
type: 'direct', relation: 'webauthn', injectable: true, provides: 'Proof'
|
|
});
|
|
|
|
arbiter.addNode('user:0', 'user');
|
|
arbiter.addNode('resource:0', 'resource');
|
|
|
|
if (hasMfa) arbiter.addRelation('user:0', 'mfa', 'resource:0', 1.0);
|
|
if (hasWebauthn) arbiter.addRelation('user:0', 'webauthn', 'resource:0', 1.0);
|
|
|
|
const mfaResult = arbiter.check('user:0', 'mfa', 'resource:0');
|
|
const webResult = arbiter.check('user:0', 'webauthn', 'resource:0');
|
|
|
|
assert.strictEqual(mfaResult.possibility > 0, hasMfa);
|
|
assert.strictEqual(webResult.possibility > 0, hasWebauthn);
|
|
|
|
if (!hasMfa) {
|
|
assert.ok(Array.isArray(mfaResult.remediation?.options), 'mfa missing should give remediation');
|
|
assert.strictEqual(mfaResult.remediation.options[0].relation, 'mfa');
|
|
}
|
|
if (!hasWebauthn) {
|
|
assert.ok(Array.isArray(webResult.remediation?.options), 'webauthn missing should give remediation');
|
|
assert.strictEqual(webResult.remediation.options[0].relation, 'webauthn');
|
|
}
|
|
}
|
|
),
|
|
{ numRuns: 40 }
|
|
);
|
|
});
|
|
});
|