John Dvorak
ed34df4474
Chain intermediates (rule-based reachability):
- ChainRule: a condition step ({ rule, conditionStep }) at an INTERMEDIATE
position is now EXPANDED from the current node — the rule's base edges'
destinations, filtered by its defeaters/requirements — and traversal
continues from each discovered node. Adds _expandRuleFromSrc / direct /
logical(union/intersection) / defeasible / nested-chain expansion.
- RuleEvaluator: _subjectIsObject flag for unary predicate calls whose subject
entity IS the object parameter (trusted(other) inside peer_trusted(user,
other)); previously only subject-var unary calls (_subjectAsObject) were
handled, so object-var unary defeaters never fired.
Graph-version cache invalidation:
- Arbiter gains a monotonic _graphVersion, incremented on every relation
mutation. ChainRule result cache, RuleEvaluator rule-result cache, and
DecisionCache rule cache now stamp entries with the graph version and treat
any mismatch as a miss — graph mutations can no longer serve stale
chain/authorization results.
Rolling-hash cache keys:
- UnifiedKeyManager.createChainKey now builds a 53-bit rolling hash (dual
FNV-1a lanes, exact for ints/floats/strings/nested configs) instead of
JSON.stringify — no string allocation or serialization on the chain-cache
hot path. Composite keys stay structured strings because the direct-check
cache pattern-invalidates by relation ID.
Rigor invariant migration (correctness):
- All 43 rigor test files' throw-based invariants ({ error, errorMessage } =>
!error && !errorMessage) never saw fn throws — vacuous. Migrated to
({ actual }) => actual !== undefined, which fails on any thrown violation
while passing legitimate null-skips. The migration immediately surfaced
two latent bugs, now fixed:
* node-manager/graph-indices skip paths returned bare undefined (falsy
sentinel) — return { skipped: true }.
* complex-graph-values-crucible expiry section rewrote values equal to the
mutation loop's last write; the engine (by design) keeps the old
timestamp on same-value rewrites so the pre-expiry grant never
materialized. Now writes guaranteed-different values.
262 lines
13 KiB
JavaScript
262 lines
13 KiB
JavaScript
/**
|
|
* rigor/logical-operators.test.js — js-rigor property tests for LogicalOperators.
|
|
*
|
|
* LogicalOperators handles union, intersection, exclusion, and defeasible logic
|
|
* combinations via OWA fusion. Properties verified using a mock ruleEvaluator:
|
|
*
|
|
* - union with aggregator='max' → result.possibility = max(child possibilities)
|
|
* - union with aggregator='mean' → result.possibility ≈ average of children
|
|
* - intersection with aggregator='min' → result.possibility = min(children)
|
|
* - exclusion (A AND NOT B) → high when A high, B low; low when A low, B high
|
|
* - collectedValues are passed through from child rules
|
|
* - meta.operation indicates which logical operation was applied
|
|
* - result.possibility ∈ [0, 1]
|
|
*/
|
|
import { describe, it } from 'node:test';
|
|
import assert from 'node:assert/strict';
|
|
import { rigor } from '@rigor/core';
|
|
import { LogicalOperators } from '../../src/authorization/rules/LogicalOperators.js';
|
|
|
|
/**
|
|
* Build a mock ruleEvaluator that returns a fixed possibility for each rule.
|
|
* Each rule is identified by mockKey; the evaluator looks up by mockKey.
|
|
*/
|
|
function makeMockRuleEvaluator(resultsByMockKey) {
|
|
return {
|
|
evaluateRule(userId, userKey, objectId, objectKey, rule) {
|
|
if (rule && rule.mockKey) {
|
|
return resultsByMockKey[rule.mockKey] ||
|
|
{ possibility: 0, reliability: 1.0, meta: { ruleType: 'direct' }, collectedValues: [] };
|
|
}
|
|
return { possibility: 0, reliability: 1.0, meta: { ruleType: 'direct' }, collectedValues: [] };
|
|
}
|
|
};
|
|
}
|
|
|
|
describe('LogicalOperators evaluation (rigor)', () => {
|
|
it('union with aggregator=max → possibility = max(child possibilities)', async () => {
|
|
async function check(possA, possB, possC) {
|
|
const evaluator = makeMockRuleEvaluator({
|
|
a: { possibility: possA, reliability: 1.0, meta: { ruleType: 'direct', rule: { mockKey: 'a' } }, collectedValues: [1] },
|
|
b: { possibility: possB, reliability: 1.0, meta: { ruleType: 'direct', rule: { mockKey: 'b' } }, collectedValues: [2] },
|
|
c: { possibility: possC, reliability: 1.0, meta: { ruleType: 'direct', rule: { mockKey: 'c' } }, collectedValues: [3] }
|
|
});
|
|
const logicalOps = new LogicalOperators({}, evaluator);
|
|
const rule = { type: 'logical', union: { rules: [{ mockKey: 'a' }, { mockKey: 'b' }, { mockKey: 'c' }], aggregator: 'max' } };
|
|
const result = logicalOps._evaluateRule('u', 'u', 'o', 'o', rule, new Set(), null, { collectValues: true });
|
|
const expected = Math.max(possA, possB, possC);
|
|
if (Math.abs(result.possibility - expected) > 0.001) {
|
|
throw new Error(`max aggregator: expected ${expected}, got ${result.possibility}`);
|
|
}
|
|
if (result.meta?.operation !== 'union') {
|
|
throw new Error(`meta.operation=${result.meta?.operation}, expected 'union'`);
|
|
}
|
|
return result;
|
|
}
|
|
|
|
const report = await rigor.campaign(
|
|
[rigor.fn('check', check,
|
|
rigor.args(
|
|
rigor.gen.float({ min: 0, max: 1 }),
|
|
rigor.gen.float({ min: 0, max: 1 }),
|
|
rigor.gen.float({ min: 0, max: 1 })
|
|
)
|
|
)],
|
|
rigor.crucible([
|
|
rigor.invariant('union-max', ({ actual }) => actual !== undefined)
|
|
])
|
|
).run({ seed: 'logical-operators-union-max', effort: 1500 , artifacts: { dir: '', persist: 'never' }});
|
|
|
|
if (process.env.TEST_DEBUG === '1') console.log(report.toTAP());
|
|
const inv = report.crucibleVerdict?.invariants?.find(i => i.name === 'union-max');
|
|
assert.ok(inv);
|
|
assert.equal(inv.passed, true, `union-max contract violated in ${inv.failureCount} cases`);
|
|
});
|
|
|
|
it('intersection with aggregator=min → possibility = min(child possibilities)', async () => {
|
|
async function check(possA, possB, possC) {
|
|
const evaluator = makeMockRuleEvaluator({
|
|
a: { possibility: possA, reliability: 1.0, meta: { ruleType: 'direct', rule: { mockKey: 'a' } }, collectedValues: [1] },
|
|
b: { possibility: possB, reliability: 1.0, meta: { ruleType: 'direct', rule: { mockKey: 'b' } }, collectedValues: [2] },
|
|
c: { possibility: possC, reliability: 1.0, meta: { ruleType: 'direct', rule: { mockKey: 'c' } }, collectedValues: [3] }
|
|
});
|
|
const logicalOps = new LogicalOperators({}, evaluator);
|
|
const rule = { type: 'logical', intersection: { rules: [{ mockKey: 'a' }, { mockKey: 'b' }, { mockKey: 'c' }], aggregator: 'min' } };
|
|
const result = logicalOps._evaluateRule('u', 'u', 'o', 'o', rule, new Set(), null, { collectValues: true });
|
|
const expected = Math.min(possA, possB, possC);
|
|
if (Math.abs(result.possibility - expected) > 0.001) {
|
|
throw new Error(`min aggregator: expected ${expected}, got ${result.possibility}`);
|
|
}
|
|
if (result.meta?.operation !== 'intersection') {
|
|
throw new Error(`meta.operation=${result.meta?.operation}, expected 'intersection'`);
|
|
}
|
|
return result;
|
|
}
|
|
|
|
const report = await rigor.campaign(
|
|
[rigor.fn('check', check,
|
|
rigor.args(
|
|
rigor.gen.float({ min: 0, max: 1 }),
|
|
rigor.gen.float({ min: 0, max: 1 }),
|
|
rigor.gen.float({ min: 0, max: 1 })
|
|
)
|
|
)],
|
|
rigor.crucible([
|
|
rigor.invariant('intersection-min', ({ actual }) => actual !== undefined)
|
|
])
|
|
).run({ seed: 'logical-operators-intersection-min', effort: 1500 , artifacts: { dir: '', persist: 'never' }});
|
|
|
|
if (process.env.TEST_DEBUG === '1') console.log(report.toTAP());
|
|
const inv = report.crucibleVerdict?.invariants?.find(i => i.name === 'intersection-min');
|
|
assert.ok(inv);
|
|
assert.equal(inv.passed, true, `intersection-min contract violated in ${inv.failureCount} cases`);
|
|
});
|
|
|
|
it('union with aggregator=mean → possibility ≈ average of children', async () => {
|
|
async function check(possA, possB) {
|
|
const evaluator = makeMockRuleEvaluator({
|
|
a: { possibility: possA, reliability: 1.0, meta: { ruleType: 'direct', rule: { mockKey: 'a' } }, collectedValues: [1] },
|
|
b: { possibility: possB, reliability: 1.0, meta: { ruleType: 'direct', rule: { mockKey: 'b' } }, collectedValues: [2] }
|
|
});
|
|
const logicalOps = new LogicalOperators({}, evaluator);
|
|
const rule = { type: 'logical', union: { rules: [{ mockKey: 'a' }, { mockKey: 'b' }], aggregator: 'mean' } };
|
|
const result = logicalOps._evaluateRule('u', 'u', 'o', 'o', rule, new Set(), null, { collectValues: true });
|
|
const expected = (possA + possB) / 2;
|
|
if (Math.abs(result.possibility - expected) > 0.001) {
|
|
throw new Error(`mean aggregator: expected ${expected}, got ${result.possibility}`);
|
|
}
|
|
return result;
|
|
}
|
|
|
|
const report = await rigor.campaign(
|
|
[rigor.fn('check', check,
|
|
rigor.args(
|
|
rigor.gen.float({ min: 0, max: 1 }),
|
|
rigor.gen.float({ min: 0, max: 1 })
|
|
)
|
|
)],
|
|
rigor.crucible([
|
|
rigor.invariant('union-mean', ({ actual }) => actual !== undefined)
|
|
])
|
|
).run({ seed: 'logical-operators-union-mean', effort: 1500 , artifacts: { dir: '', persist: 'never' }});
|
|
|
|
if (process.env.TEST_DEBUG === '1') console.log(report.toTAP());
|
|
const inv = report.crucibleVerdict?.invariants?.find(i => i.name === 'union-mean');
|
|
assert.ok(inv);
|
|
assert.equal(inv.passed, true, `union-mean contract violated in ${inv.failureCount} cases`);
|
|
});
|
|
|
|
it('exclusion (A AND NOT B) → high when A high, B low', async () => {
|
|
async function check(possA, possB) {
|
|
const evaluator = makeMockRuleEvaluator({
|
|
a: { possibility: possA, reliability: 1.0, meta: { ruleType: 'direct', rule: { mockKey: 'a' } }, collectedValues: [1] },
|
|
b: { possibility: possB, reliability: 1.0, meta: { ruleType: 'direct', rule: { mockKey: 'b' } }, collectedValues: [2] }
|
|
});
|
|
const logicalOps = new LogicalOperators({}, evaluator);
|
|
// exclusion is its own field, not an intersection aggregator
|
|
const rule = { type: 'logical', exclusion: { rules: [{ mockKey: 'a' }, { mockKey: 'b' }] } };
|
|
const result = logicalOps._evaluateRule('u', 'u', 'o', 'o', rule, new Set(), null, { collectValues: true });
|
|
// A AND NOT B is high when A high, B low
|
|
if (possA > 0.8 && possB < 0.2) {
|
|
if (result.possibility < 0.5) {
|
|
throw new Error(`A high, B low: expected high exclusion, got ${result.possibility}`);
|
|
}
|
|
}
|
|
// A AND NOT B is low when A low, B high
|
|
if (possA < 0.2 && possB > 0.8) {
|
|
if (result.possibility > 0.5) {
|
|
throw new Error(`A low, B high: expected low exclusion, got ${result.possibility}`);
|
|
}
|
|
}
|
|
return result;
|
|
}
|
|
|
|
const report = await rigor.campaign(
|
|
[rigor.fn('check', check,
|
|
rigor.args(
|
|
rigor.gen.float({ min: 0, max: 1 }),
|
|
rigor.gen.float({ min: 0, max: 1 })
|
|
)
|
|
)],
|
|
rigor.crucible([
|
|
rigor.invariant('exclusion', ({ actual }) => actual !== undefined)
|
|
])
|
|
).run({ seed: 'logical-operators-exclusion', effort: 1500 , artifacts: { dir: '', persist: 'never' }});
|
|
|
|
if (process.env.TEST_DEBUG === '1') console.log(report.toTAP());
|
|
const inv = report.crucibleVerdict?.invariants?.find(i => i.name === 'exclusion');
|
|
assert.ok(inv);
|
|
assert.equal(inv.passed, true, `exclusion contract violated in ${inv.failureCount} cases`);
|
|
});
|
|
|
|
it('result.possibility ∈ [0, 1] always (union, intersection, exclusion)', async () => {
|
|
async function check(possA, possB) {
|
|
const evaluator = makeMockRuleEvaluator({
|
|
a: { possibility: possA, reliability: 1.0, meta: { ruleType: 'direct', rule: { mockKey: 'a' } }, collectedValues: [1] },
|
|
b: { possibility: possB, reliability: 1.0, meta: { ruleType: 'direct', rule: { mockKey: 'b' } }, collectedValues: [2] }
|
|
});
|
|
const logicalOps = new LogicalOperators({}, evaluator);
|
|
const rule = { type: 'logical', union: { rules: [{ mockKey: 'a' }, { mockKey: 'b' }], aggregator: 'max' } };
|
|
const result = logicalOps._evaluateRule('u', 'u', 'o', 'o', rule, new Set(), null, { collectValues: true });
|
|
if (result.possibility < 0 || result.possibility > 1) {
|
|
throw new Error(`possibility=${result.possibility} outside [0,1]`);
|
|
}
|
|
return result;
|
|
}
|
|
|
|
const report = await rigor.campaign(
|
|
[rigor.fn('check', check,
|
|
rigor.args(
|
|
rigor.gen.float({ min: 0, max: 1 }),
|
|
rigor.gen.float({ min: 0, max: 1 })
|
|
)
|
|
)],
|
|
rigor.crucible([
|
|
rigor.invariant('possibility-bounded', ({ actual }) => actual !== undefined)
|
|
])
|
|
).run({ seed: 'logical-operators-possibility-bounded', effort: 1500 , artifacts: { dir: '', persist: 'never' }});
|
|
|
|
if (process.env.TEST_DEBUG === '1') console.log(report.toTAP());
|
|
const inv = report.crucibleVerdict?.invariants?.find(i => i.name === 'possibility-bounded');
|
|
assert.ok(inv);
|
|
assert.equal(inv.passed, true, `possibility-bounded violated in ${inv.failureCount} cases`);
|
|
});
|
|
|
|
it('collectedValues from child rules are concatenated', async () => {
|
|
async function check(possA, possB) {
|
|
const evaluator = makeMockRuleEvaluator({
|
|
a: { possibility: possA, reliability: 1.0, meta: { ruleType: 'direct', rule: { mockKey: 'a' } }, collectedValues: ['val-a'] },
|
|
b: { possibility: possB, reliability: 1.0, meta: { ruleType: 'direct', rule: { mockKey: 'b' } }, collectedValues: ['val-b'] }
|
|
});
|
|
const logicalOps = new LogicalOperators({}, evaluator);
|
|
const rule = { type: 'logical', union: { rules: [{ mockKey: 'a' }, { mockKey: 'b' }], aggregator: 'max' } };
|
|
const result = logicalOps._evaluateRule('u', 'u', 'o', 'o', rule, new Set(), null, { collectValues: true });
|
|
if (!Array.isArray(result.collectedValues)) {
|
|
throw new Error(`collectedValues not an array: ${JSON.stringify(result.collectedValues)}`);
|
|
}
|
|
// Both should be present
|
|
if (!result.collectedValues.includes('val-a') || !result.collectedValues.includes('val-b')) {
|
|
throw new Error(`collectedValues missing child values: ${JSON.stringify(result.collectedValues)}`);
|
|
}
|
|
return result;
|
|
}
|
|
|
|
const report = await rigor.campaign(
|
|
[rigor.fn('check', check,
|
|
rigor.args(
|
|
rigor.gen.float({ min: 0.5, max: 1 }),
|
|
rigor.gen.float({ min: 0.5, max: 1 })
|
|
)
|
|
)],
|
|
rigor.crucible([
|
|
rigor.invariant('collected-values-concat', ({ actual }) => actual !== undefined)
|
|
])
|
|
).run({ seed: 'logical-operators-collected-values', effort: 800 , artifacts: { dir: '', persist: 'never' }});
|
|
|
|
if (process.env.TEST_DEBUG === '1') console.log(report.toTAP());
|
|
const inv = report.crucibleVerdict?.invariants?.find(i => i.name === 'collected-values-concat');
|
|
assert.ok(inv);
|
|
assert.equal(inv.passed, true, `collected-values-concat violated in ${inv.failureCount} cases`);
|
|
});
|
|
});
|