aaronrene / knowtation public
proposal-approve-rbac-fix-unit.test.mjs
184 lines 9.2 KB
Raw
sha256:700fafdd1afa490919f9515d660ca6e75456bcd5bb67513abcd8757a634c01f6 docs: record AIP-b SD-21 land (KN #308) Human 9 days ago
1 /**
2 * Unit tests — proposal approve RBAC fix.
3 *
4 * Covers the structural changes to resolveHostedActorRole in hub/gateway/server.mjs:
5 * 1. Bridge unreachable (network error) → falls back to JWT payload role.
6 * 2. Bridge returns non-OK (e.g. 401, SESSION_SECRET mismatch) → falls back to JWT payload.
7 * 3. Bridge returns OK with 'admin' → normal path, no override needed.
8 * 4. Gateway admin override: HUB_ADMIN_USER_IDS trumps bridge 'member'.
9 * 5. approveProposal error path uses showToast, not a silent muted paragraph.
10 * 6. discardProposal error path uses showToast, not a silent muted paragraph.
11 */
12
13 import { test, describe } from 'node:test';
14 import assert from 'node:assert/strict';
15 import fs from 'node:fs';
16 import path from 'node:path';
17 import { fileURLToPath } from 'node:url';
18
19 const __dirname = path.dirname(fileURLToPath(import.meta.url));
20 const ROOT = path.resolve(__dirname, '..');
21
22 const SERVER_SRC = path.join(ROOT, 'hub/gateway/server.mjs');
23 const HUB_SRC = path.join(ROOT, 'web/hub/hub.js');
24
25 describe('resolveHostedActorRole — unit wiring', () => {
26 let src;
27 const load = () => {
28 if (!src) src = fs.readFileSync(SERVER_SRC, 'utf8');
29 return src;
30 };
31
32 test('resolveHostedActorRole exists in server.mjs', () => {
33 const s = load();
34 assert.ok(s.includes('async function resolveHostedActorRole'), 'function is defined');
35 });
36
37 test('bridge fallback: bridgeResolved flag is declared and checked', () => {
38 const s = load();
39 const fn = s.slice(s.indexOf('async function resolveHostedActorRole'), s.indexOf('\n}\n', s.indexOf('async function resolveHostedActorRole')));
40 assert.ok(fn.includes('bridgeResolved'), 'bridgeResolved flag present');
41 assert.ok(fn.includes('!bridgeResolved'), 'fallback check on bridgeResolved');
42 });
43
44 test('bridge fallback path: uses once-verified bearerPayload (not raw header parse)', () => {
45 const s = load();
46 const fn = s.slice(s.indexOf('async function resolveHostedActorRole'), s.indexOf('\n}\n', s.indexOf('async function resolveHostedActorRole')) + 3);
47 // SEC-KN-3: verify runs once at the top into bearerPayload; fallback reuses it.
48 // SEC-KN-P6-ROTATE: the entry verify is the dual-secret rotation helper
49 // (verifyJwtWithSecretRotation), replacing the raw single-secret jwt.verify.
50 const helperCount = (fn.match(/verifyJwtWithSecretRotation/g) || []).length;
51 assert.equal(helperCount, 1, `rotation-helper verify called exactly once at entry (got ${helperCount})`);
52 const rawVerifyCount = (fn.match(/jwt\.verify/g) || []).length;
53 assert.equal(rawVerifyCount, 0, `no raw jwt.verify remains in resolveHostedActorRole (got ${rawVerifyCount})`);
54 const fallbackBlock = fn.slice(fn.indexOf('!bridgeResolved'));
55 assert.ok(
56 fallbackBlock.includes('roleFromVerifiedAccessPayload(bearerPayload'),
57 'bridge fallback resolves role from verified bearerPayload',
58 );
59 assert.ok(!fallbackBlock.includes('JSON.parse'), 'bridge fallback does not JSON.parse the raw header');
60 });
61
62 test('gateway admin override: roleForSub check present after bridge/else branches', () => {
63 const s = load();
64 const fn = s.slice(s.indexOf('async function resolveHostedActorRole'), s.indexOf('\n}\n', s.indexOf('async function resolveHostedActorRole')) + 3);
65 assert.ok(fn.includes('roleForSub(actorSub)'), 'roleForSub used in gateway admin override');
66 assert.ok(fn.includes("role !== 'admin'"), 'override is guarded by role !== admin');
67 assert.ok(fn.includes("role = 'admin'"), 'override sets role to admin');
68 assert.ok(fn.includes('mayApproveProposals = true'), 'override sets mayApproveProposals true');
69 });
70
71 test('gateway admin override: comment explains the lockout-prevention rationale', () => {
72 const s = load();
73 const fn = s.slice(s.indexOf('async function resolveHostedActorRole'), s.indexOf('\n}\n', s.indexOf('async function resolveHostedActorRole')) + 3);
74 assert.ok(fn.includes('locked out'), 'comment explains lockout-prevention intent');
75 });
76
77 test('bridge fallback: placed inside the BRIDGE_URL branch, not outside', () => {
78 const s = load();
79 const fnStart = s.indexOf('async function resolveHostedActorRole');
80 const fnEnd = s.indexOf('\n}\n', fnStart) + 3;
81 const fn = s.slice(fnStart, fnEnd);
82 // The bridgeResolved fallback block should appear before the final gateway override block
83 const bridgeFallbackIdx = fn.indexOf('!bridgeResolved');
84 const overrideIdx = fn.indexOf('Gateway-level admin override');
85 assert.ok(bridgeFallbackIdx < overrideIdx, 'bridge fallback block appears before gateway override');
86 });
87 });
88
89 describe('hub.js approveProposal — error visibility wiring', () => {
90 let src;
91 const load = () => {
92 if (!src) src = fs.readFileSync(HUB_SRC, 'utf8');
93 return src;
94 };
95
96 test('approveProposal catch uses showToast, not appendChild', () => {
97 const s = load();
98 const fnStart = s.indexOf('async function approveProposal');
99 assert.ok(fnStart > 0, 'approveProposal function exists');
100 const fnEnd = s.indexOf('\n }\n', fnStart + 100);
101 const fn = s.slice(fnStart, fnEnd + 5);
102 assert.ok(fn.includes('showToast'), 'showToast used in approveProposal catch');
103 assert.ok(!fn.includes("className = 'muted'"), 'muted paragraph removed from approveProposal');
104 assert.ok(!fn.includes('db.appendChild'), 'appendChild pattern removed from approveProposal catch');
105 });
106
107 test('discardProposal catch uses showToast, not appendChild', () => {
108 const s = load();
109 const fnStart = s.indexOf('async function discardProposal');
110 assert.ok(fnStart > 0, 'discardProposal function exists');
111 const fnEnd = s.indexOf('\n }\n', fnStart + 100);
112 const fn = s.slice(fnStart, fnEnd + 5);
113 assert.ok(fn.includes('showToast'), 'showToast used in discardProposal catch');
114 assert.ok(!fn.includes("className = 'muted'"), 'muted paragraph removed from discardProposal');
115 assert.ok(!fn.includes('db.appendChild'), 'appendChild pattern removed from discardProposal catch');
116 });
117
118 test('approveProposal toast passes isError=true', () => {
119 const s = load();
120 const fnStart = s.indexOf('async function approveProposal');
121 const fn = s.slice(fnStart, s.indexOf('\n async function discardProposal', fnStart));
122 assert.ok(fn.includes('showToast(') && fn.includes(', true)'), 'approveProposal toast marks error=true');
123 });
124
125 test('discardProposal toast passes isError=true', () => {
126 const s = load();
127 const fnStart = s.indexOf('async function discardProposal');
128 const fn = s.slice(fnStart, s.indexOf('\n el(', fnStart));
129 assert.ok(fn.includes('showToast(') && fn.includes(', true)'), 'discardProposal toast marks error=true');
130 });
131
132 test('approveProposal still closes the panel on success (hideDetailPanelChrome present)', () => {
133 const s = load();
134 const fnStart = s.indexOf('async function approveProposal');
135 const fn = s.slice(fnStart, s.indexOf('\n async function discardProposal', fnStart));
136 assert.ok(fn.includes('hideDetailPanelChrome()'), 'panel close preserved in success path');
137 assert.ok(fn.includes('loadProposals()'), 'proposals reload preserved in success path');
138 });
139 });
140
141 describe('resolveHostedActorRole — logic invariants (structural)', () => {
142 const load = () => fs.readFileSync(SERVER_SRC, 'utf8');
143
144 test('bridge fallback only runs when bridge did not resolve (guards are symmetric)', () => {
145 const s = load();
146 const fnStart = s.indexOf('async function resolveHostedActorRole');
147 const fn = s.slice(fnStart, s.indexOf('\n}\n', fnStart) + 3);
148 // bridgeResolved = false precedes the fallback block
149 const resolvedFalse = fn.indexOf('bridgeResolved = false');
150 const resolvedTrue = fn.indexOf('bridgeResolved = true');
151 const fallback = fn.indexOf('!bridgeResolved');
152 assert.ok(resolvedFalse < fallback, 'bridgeResolved initially false before fallback');
153 assert.ok(resolvedTrue < fallback, 'bridgeResolved set true on success before fallback guard');
154 });
155
156 test('mayApproveProposals defaults to false (fail-closed)', () => {
157 const s = load();
158 const fnStart = s.indexOf('async function resolveHostedActorRole');
159 const fn = s.slice(fnStart, s.indexOf('\n}\n', fnStart) + 3);
160 // Default must be false (fail-closed)
161 assert.ok(fn.includes('let mayApproveProposals = false'), 'mayApproveProposals defaults to false');
162 });
163
164 test('role defaults to member (fail-closed)', () => {
165 const s = load();
166 const fnStart = s.indexOf('async function resolveHostedActorRole');
167 const fn = s.slice(fnStart, s.indexOf('\n}\n', fnStart) + 3);
168 assert.ok(fn.includes("let role = 'member'"), "role defaults to 'member'");
169 });
170
171 test('function returns role, mayApproveProposals, and isMcpAccess', () => {
172 const s = load();
173 // SEC-KN-3: isMcpAccess is required so callers can bar agent tokens from self-apply.
174 // SEC-SEAM-1: payload accompanies both returns for sessionBound classification.
175 assert.ok(
176 s.includes('return { role, mayApproveProposals, isMcpAccess: true, payload: bearerPayload }'),
177 'mcp_access early-return includes isMcpAccess: true',
178 );
179 assert.ok(
180 s.includes('return { role, mayApproveProposals, isMcpAccess: false, payload: bearerPayload }'),
181 'non-agent path returns isMcpAccess: false',
182 );
183 });
184 });
File History 1 commit
sha256:700fafdd1afa490919f9515d660ca6e75456bcd5bb67513abcd8757a634c01f6 docs: record AIP-b SD-21 land (KN #308) Human 9 days ago