60 lines
2.7 KiB
TypeScript
60 lines
2.7 KiB
TypeScript
import { describe, expect, it } from "vitest";
|
|
import { createCapabilityReviewDigest } from "./capabilityReviewDigest";
|
|
|
|
function plugin(overrides: Partial<{ pluginId: string; version: string; scope: string | null }> = {}) {
|
|
return {
|
|
pluginId: overrides.pluginId ?? "com.example.digest",
|
|
version: overrides.version ?? "1.0.0",
|
|
manifest: {
|
|
capabilities: [
|
|
{ name: "secret.read", scope: overrides.scope ?? "tenant" },
|
|
{ name: "http.outbound", scope: "tenant" },
|
|
{ name: "log", scope: null },
|
|
],
|
|
hooks: [{ name: "workflow.executed", export: "onWorkflowExecuted" }],
|
|
},
|
|
};
|
|
}
|
|
|
|
describe("createCapabilityReviewDigest", () => {
|
|
it("is stable regardless of requested capability order", () => {
|
|
expect(createCapabilityReviewDigest(plugin(), ["secret.read", "http.outbound"])).toBe(
|
|
createCapabilityReviewDigest(plugin(), ["http.outbound", "secret.read"])
|
|
);
|
|
});
|
|
|
|
it("only binds selected capabilities into the review digest", () => {
|
|
const selected = createCapabilityReviewDigest(plugin(), ["log"]);
|
|
const selectedWithUnmanifested = createCapabilityReviewDigest(plugin(), ["log", "db.write"]);
|
|
const broaderGrant = createCapabilityReviewDigest(plugin(), ["log", "secret.read"]);
|
|
|
|
expect(selectedWithUnmanifested).toBe(selected);
|
|
expect(broaderGrant).not.toBe(selected);
|
|
});
|
|
|
|
it("binds manifest hook consent items into the review digest", () => {
|
|
const hookReviewDigest = createCapabilityReviewDigest(plugin(), ["hook:workflow.executed"]);
|
|
const capabilityReviewDigest = createCapabilityReviewDigest(plugin(), ["log"]);
|
|
const combinedReviewDigest = createCapabilityReviewDigest(plugin(), ["log", "hook:workflow.executed"]);
|
|
|
|
expect(hookReviewDigest).not.toBe(capabilityReviewDigest);
|
|
expect(combinedReviewDigest).not.toBe(capabilityReviewDigest);
|
|
expect(combinedReviewDigest).not.toBe(hookReviewDigest);
|
|
});
|
|
|
|
it("does not allow a partial review digest to stand in for a broader submitted grant set", () => {
|
|
const partialReviewDigest = createCapabilityReviewDigest(plugin(), ["log"]);
|
|
const submittedGrantSetDigest = createCapabilityReviewDigest(plugin(), ["log", "secret.read"]);
|
|
|
|
expect(submittedGrantSetDigest).not.toBe(partialReviewDigest);
|
|
});
|
|
|
|
it("changes when plugin identity version or capability scope changes", () => {
|
|
const baseline = createCapabilityReviewDigest(plugin(), ["secret.read"]);
|
|
|
|
expect(createCapabilityReviewDigest(plugin({ pluginId: "com.example.other" }), ["secret.read"])).not.toBe(baseline);
|
|
expect(createCapabilityReviewDigest(plugin({ version: "1.0.1" }), ["secret.read"])).not.toBe(baseline);
|
|
expect(createCapabilityReviewDigest(plugin({ scope: "workspace" }), ["secret.read"])).not.toBe(baseline);
|
|
});
|
|
});
|