Track HiveGrid Cloud planning reference

hivegrid-cloud/apps/web/app/modules/plugins/utils/capabilityReviewDigest.test.ts

@@ -0,0 +1,59 @@
+import { describe, expect, it } from "vitest";
+import { createCapabilityReviewDigest } from "./capabilityReviewDigest";
+
+function plugin(overrides: Partial<{ pluginId: string; version: string; scope: string | null }> = {}) {
+  return {
+    pluginId: overrides.pluginId ?? "com.example.digest",
+    version: overrides.version ?? "1.0.0",
+    manifest: {
+      capabilities: [
+        { name: "secret.read", scope: overrides.scope ?? "tenant" },
+        { name: "http.outbound", scope: "tenant" },
+        { name: "log", scope: null },
+      ],
+      hooks: [{ name: "workflow.executed", export: "onWorkflowExecuted" }],
+    },
+  };
+}
+
+describe("createCapabilityReviewDigest", () => {
+  it("is stable regardless of requested capability order", () => {
+    expect(createCapabilityReviewDigest(plugin(), ["secret.read", "http.outbound"])).toBe(
+      createCapabilityReviewDigest(plugin(), ["http.outbound", "secret.read"])
+    );
+  });
+
+  it("only binds selected capabilities into the review digest", () => {
+    const selected = createCapabilityReviewDigest(plugin(), ["log"]);
+    const selectedWithUnmanifested = createCapabilityReviewDigest(plugin(), ["log", "db.write"]);
+    const broaderGrant = createCapabilityReviewDigest(plugin(), ["log", "secret.read"]);
+
+    expect(selectedWithUnmanifested).toBe(selected);
+    expect(broaderGrant).not.toBe(selected);
+  });
+
+  it("binds manifest hook consent items into the review digest", () => {
+    const hookReviewDigest = createCapabilityReviewDigest(plugin(), ["hook:workflow.executed"]);
+    const capabilityReviewDigest = createCapabilityReviewDigest(plugin(), ["log"]);
+    const combinedReviewDigest = createCapabilityReviewDigest(plugin(), ["log", "hook:workflow.executed"]);
+
+    expect(hookReviewDigest).not.toBe(capabilityReviewDigest);
+    expect(combinedReviewDigest).not.toBe(capabilityReviewDigest);
+    expect(combinedReviewDigest).not.toBe(hookReviewDigest);
+  });
+
+  it("does not allow a partial review digest to stand in for a broader submitted grant set", () => {
+    const partialReviewDigest = createCapabilityReviewDigest(plugin(), ["log"]);
+    const submittedGrantSetDigest = createCapabilityReviewDigest(plugin(), ["log", "secret.read"]);
+
+    expect(submittedGrantSetDigest).not.toBe(partialReviewDigest);
+  });
+
+  it("changes when plugin identity version or capability scope changes", () => {
+    const baseline = createCapabilityReviewDigest(plugin(), ["secret.read"]);
+
+    expect(createCapabilityReviewDigest(plugin({ pluginId: "com.example.other" }), ["secret.read"])).not.toBe(baseline);
+    expect(createCapabilityReviewDigest(plugin({ version: "1.0.1" }), ["secret.read"])).not.toBe(baseline);
+    expect(createCapabilityReviewDigest(plugin({ scope: "workspace" }), ["secret.read"])).not.toBe(baseline);
+  });
+});