aaronrene / knowtation public
hosted-allowed-vaults.test.mjs
95 lines 2.9 KB
Raw
sha256:700fafdd1afa490919f9515d660ca6e75456bcd5bb67513abcd8757a634c01f6 docs: record AIP-b SD-21 land (KN #308) Human 11 days ago
1 import test from 'node:test';
2 import assert from 'node:assert';
3 import {
4 resolveAllowedVaultIdsForHostedContext,
5 resolveAllowedVaultIdsForSessionBoundActor,
6 } from '../hub/lib/hosted-workspace-resolve.mjs';
7
8 test('non-delegate without access row: all canister vaults', () => {
9 const out = resolveAllowedVaultIdsForHostedContext({
10 delegate: false,
11 actorUid: 'owner',
12 accessMap: {},
13 canisterIds: ['default', 'work', 'personal'],
14 });
15 assert.deepStrictEqual(out, ['default', 'work', 'personal']);
16 });
17
18 test('non-delegate with explicit access: intersect with canister list', () => {
19 const out = resolveAllowedVaultIdsForHostedContext({
20 delegate: false,
21 actorUid: 'owner',
22 accessMap: { owner: ['default'] },
23 canisterIds: ['default', 'work'],
24 });
25 assert.deepStrictEqual(out, ['default']);
26 });
27
28 test('delegate without access row: default only', () => {
29 const out = resolveAllowedVaultIdsForHostedContext({
30 delegate: true,
31 actorUid: 'editor1',
32 accessMap: {},
33 canisterIds: ['default', 'work'],
34 });
35 assert.deepStrictEqual(out, ['default']);
36 });
37
38 test('delegate with explicit access', () => {
39 const out = resolveAllowedVaultIdsForHostedContext({
40 delegate: true,
41 actorUid: 'editor1',
42 accessMap: { editor1: ['work'] },
43 canisterIds: ['default', 'work'],
44 });
45 assert.deepStrictEqual(out, ['work']);
46 });
47
48 test('session-bound delegate may use Business on owner partition', () => {
49 const base = resolveAllowedVaultIdsForHostedContext({
50 delegate: true,
51 actorUid: 'google:learner',
52 accessMap: {},
53 canisterIds: ['default', 'Business'],
54 });
55 assert.deepStrictEqual(base, ['default']);
56 const expanded = resolveAllowedVaultIdsForSessionBoundActor({
57 sessionBound: true,
58 allowedVaultIds: base,
59 canisterIds: ['default', 'Business'],
60 vaultId: 'Business',
61 });
62 assert.deepStrictEqual(expanded, ['default', 'Business']);
63 });
64
65 test('session-bound does not expand to vault absent from canister', () => {
66 const base = resolveAllowedVaultIdsForHostedContext({
67 delegate: true,
68 actorUid: 'google:learner',
69 accessMap: { 'google:learner': ['default'] },
70 canisterIds: ['default'],
71 });
72 const expanded = resolveAllowedVaultIdsForSessionBoundActor({
73 sessionBound: true,
74 allowedVaultIds: base,
75 canisterIds: ['default'],
76 vaultId: 'Business',
77 });
78 assert.deepStrictEqual(expanded, ['default']);
79 });
80
81 test('integration token (non-session) keeps delegate vault map', () => {
82 const base = resolveAllowedVaultIdsForHostedContext({
83 delegate: true,
84 actorUid: 'google:learner',
85 accessMap: {},
86 canisterIds: ['default', 'Business'],
87 });
88 const unchanged = resolveAllowedVaultIdsForSessionBoundActor({
89 sessionBound: false,
90 allowedVaultIds: base,
91 canisterIds: ['default', 'Business'],
92 vaultId: 'Business',
93 });
94 assert.deepStrictEqual(unchanged, ['default']);
95 });
File History 1 commit
sha256:700fafdd1afa490919f9515d660ca6e75456bcd5bb67513abcd8757a634c01f6 docs: record AIP-b SD-21 land (KN #308) Human 11 days ago