aaronrene / knowtation public
hosted-write-eval-hints-budget-security.test.mjs
48 lines 1.7 KB
Raw
sha256:4215cecbbabf5591b1ff69053cc938b4b6c800f0d487be40618c1d4254d8b67b security: npm audit fix pre-bridge 2026-09-05 Human 3 days ago
1 /**
2 * HOSTED-WRITE-EVAL hints budget — Tier 7 security: no elevation via forged fields; disabled stays off.
3 */
4 import { describe, it } from 'node:test';
5 import assert from 'node:assert/strict';
6 import { SCOOLING_REVIEW_TRAY_INTENT } from '../lib/hub-proposal-personal-self-apply.mjs';
7 import {
8 maybeScheduleHostedProposalReviewHints,
9 shouldSkipInlineReviewHintsOnCreate,
10 } from '../hub/gateway/proposal-review-hints-async.mjs';
11
12 describe('hosted review-hints budget (security)', () => {
13 it('hintsEnabled false never schedules even for non-self-apply', async () => {
14 const t0 = Date.now();
15 await maybeScheduleHostedProposalReviewHints({
16 method: 'POST',
17 pathOnly: '/api/v1/proposals',
18 upstreamStatus: 200,
19 responseText: JSON.stringify({ proposal_id: 'prop-sec-1' }),
20 canisterUrl: 'https://example.invalid',
21 effectiveUserId: 'u',
22 actorUserId: 'u',
23 vaultId: 'default',
24 hintsEnabled: false,
25 createBody: { intent: 'note.update' },
26 });
27 assert.ok(Date.now() - t0 < 100);
28 });
29
30 it('Buffer createBody does not throw and does not skip as self-apply', () => {
31 assert.equal(shouldSkipInlineReviewHintsOnCreate(Buffer.from(SCOOLING_REVIEW_TRAY_INTENT)), false);
32 });
33
34 it('non-create methods are ignored', async () => {
35 await maybeScheduleHostedProposalReviewHints({
36 method: 'GET',
37 pathOnly: '/api/v1/proposals',
38 upstreamStatus: 200,
39 responseText: JSON.stringify({ proposal_id: 'prop-sec-2' }),
40 canisterUrl: 'https://example.invalid',
41 effectiveUserId: 'u',
42 actorUserId: 'u',
43 vaultId: 'default',
44 hintsEnabled: true,
45 createBody: { intent: 'note.update' },
46 });
47 });
48 });
File History 3 commits
sha256:4215cecbbabf5591b1ff69053cc938b4b6c800f0d487be40618c1d4254d8b67b security: npm audit fix pre-bridge 2026-09-05 Human 3 days ago
sha256:9eaa2a7ec9aaf5866cd03d0deadf843cca97778299d1857b5452f71d92a1880a feat(f24): flip DOCS_NOTION_HUB_KEY_AUTHORIZED=true (Tier 3) Human minor ⚠ 16 days ago
sha256:e4c529f14a0bb908c1caaaeb3f95f3623a1a82e636e7e3722ca2cd3dc9821263 security: npm audit fix pre-bridge 2026-07-29 Human 41 days ago