John Dvorak
717ae1031e
Zanzibar-style authorization graph engine (direct/chain/TTU/defeasible/ binary modes, condensed snapshots, value relations) with 39 rigor test campaigns. Includes fixes for snapshot binary writer/reader format mismatch (snapshot-of-snapshot corruption), possibility write-boundary validation, empty-graph snapshot serialization, relation lookup cache direction collision, config-redefinition cache invalidation, binary threshold semantics, defeasible compiled routing, and comparator reason whitelisting.
80 lines
2.3 KiB
JavaScript
80 lines
2.3 KiB
JavaScript
import { describe, test } from 'node:test';
|
|
import assert from 'node:assert/strict';
|
|
import { Arbiter } from '../../src/core/Arbiter.js';
|
|
|
|
describe.skip('Injectable witness plumbing', () => {
|
|
test('injectable witness succeeds when present in direct relation', () => {
|
|
const arbiter = new Arbiter();
|
|
arbiter.addNode('user:1', 'user');
|
|
arbiter.addNode('doc:1', 'doc');
|
|
|
|
arbiter.setRelationConfig('mfa', {
|
|
type: 'source',
|
|
relation: 'mfa',
|
|
injectable: true,
|
|
provides: 'Proof'
|
|
});
|
|
|
|
arbiter.setRelationConfig('can_delete', {
|
|
type: 'direct',
|
|
relation: 'mfa'
|
|
});
|
|
|
|
arbiter.addRelation('user:1', 'mfa', 'doc:1', 1.0);
|
|
|
|
const result = arbiter.check('user:1', 'can_delete', 'doc:1');
|
|
assert.equal(result.possibility, 1);
|
|
});
|
|
|
|
test('injectable witness returns unified remediation when missing', () => {
|
|
const arbiter = new Arbiter();
|
|
arbiter.addNode('user:1', 'user');
|
|
arbiter.addNode('doc:1', 'doc');
|
|
|
|
arbiter.setRelationConfig('mfa', {
|
|
type: 'source',
|
|
relation: 'mfa',
|
|
injectable: true,
|
|
provides: 'Proof'
|
|
});
|
|
|
|
arbiter.setRelationConfig('can_delete', {
|
|
type: 'direct',
|
|
relation: 'mfa'
|
|
});
|
|
|
|
const result = arbiter.check('user:1', 'can_delete', 'doc:1');
|
|
|
|
assert.equal(result.possibility, 0);
|
|
assert.ok(result.remediation?.options?.length > 0);
|
|
assert.equal(result.remediation.options[0].relation, 'mfa');
|
|
assert.equal(result.remediation.options[0].object, 'doc:1');
|
|
});
|
|
|
|
test('injectable witness with within constraint is enforced by partial graph manager', () => {
|
|
const arbiter = new Arbiter();
|
|
arbiter.addNode('user:1', 'user');
|
|
arbiter.addNode('doc:1', 'doc');
|
|
|
|
arbiter.setRelationConfig('mfa', {
|
|
type: 'source',
|
|
relation: 'mfa',
|
|
injectable: true,
|
|
provides: 'Proof',
|
|
within: { value: '1s', unit: 's' }
|
|
});
|
|
|
|
arbiter.setRelationConfig('can_delete', {
|
|
type: 'direct',
|
|
relation: 'mfa'
|
|
});
|
|
|
|
// The checker only checks presence — freshness is enforced
|
|
// at injection time by the higher-order partial graph manager.
|
|
arbiter.addRelation('user:1', 'mfa', 'doc:1', 1.0);
|
|
|
|
const result = arbiter.check('user:1', 'can_delete', 'doc:1');
|
|
assert.equal(result.possibility, 1);
|
|
});
|
|
});
|