aaronrene / knowtation public
proposal-approve-rbac-fix-unit.test.mjs
180 lines 8.8 KB
Raw
sha256:e4c529f14a0bb908c1caaaeb3f95f3623a1a82e636e7e3722ca2cd3dc9821263 security: npm audit fix pre-bridge 2026-07-29 Human 40 days ago
1 /**
2 * Unit tests — proposal approve RBAC fix.
3 *
4 * Covers the structural changes to resolveHostedActorRole in hub/gateway/server.mjs:
5 * 1. Bridge unreachable (network error) → falls back to JWT payload role.
6 * 2. Bridge returns non-OK (e.g. 401, SESSION_SECRET mismatch) → falls back to JWT payload.
7 * 3. Bridge returns OK with 'admin' → normal path, no override needed.
8 * 4. Gateway admin override: HUB_ADMIN_USER_IDS trumps bridge 'member'.
9 * 5. approveProposal error path uses showToast, not a silent muted paragraph.
10 * 6. discardProposal error path uses showToast, not a silent muted paragraph.
11 */
12
13 import { test, describe } from 'node:test';
14 import assert from 'node:assert/strict';
15 import fs from 'node:fs';
16 import path from 'node:path';
17 import { fileURLToPath } from 'node:url';
18
19 const __dirname = path.dirname(fileURLToPath(import.meta.url));
20 const ROOT = path.resolve(__dirname, '..');
21
22 const SERVER_SRC = path.join(ROOT, 'hub/gateway/server.mjs');
23 const HUB_SRC = path.join(ROOT, 'web/hub/hub.js');
24
25 describe('resolveHostedActorRole — unit wiring', () => {
26 let src;
27 const load = () => {
28 if (!src) src = fs.readFileSync(SERVER_SRC, 'utf8');
29 return src;
30 };
31
32 test('resolveHostedActorRole exists in server.mjs', () => {
33 const s = load();
34 assert.ok(s.includes('async function resolveHostedActorRole'), 'function is defined');
35 });
36
37 test('bridge fallback: bridgeResolved flag is declared and checked', () => {
38 const s = load();
39 const fn = s.slice(s.indexOf('async function resolveHostedActorRole'), s.indexOf('\n}\n', s.indexOf('async function resolveHostedActorRole')));
40 assert.ok(fn.includes('bridgeResolved'), 'bridgeResolved flag present');
41 assert.ok(fn.includes('!bridgeResolved'), 'fallback check on bridgeResolved');
42 });
43
44 test('bridge fallback path: uses once-verified bearerPayload (not raw header parse)', () => {
45 const s = load();
46 const fn = s.slice(s.indexOf('async function resolveHostedActorRole'), s.indexOf('\n}\n', s.indexOf('async function resolveHostedActorRole')) + 3);
47 // SEC-KN-3: jwt.verify runs once at the top into bearerPayload; fallback reuses it.
48 const verifyCount = (fn.match(/jwt\.verify/g) || []).length;
49 assert.equal(verifyCount, 1, `jwt.verify called exactly once at entry (got ${verifyCount})`);
50 const fallbackBlock = fn.slice(fn.indexOf('!bridgeResolved'));
51 assert.ok(
52 fallbackBlock.includes('roleFromVerifiedAccessPayload(bearerPayload'),
53 'bridge fallback resolves role from verified bearerPayload',
54 );
55 assert.ok(!fallbackBlock.includes('JSON.parse'), 'bridge fallback does not JSON.parse the raw header');
56 });
57
58 test('gateway admin override: roleForSub check present after bridge/else branches', () => {
59 const s = load();
60 const fn = s.slice(s.indexOf('async function resolveHostedActorRole'), s.indexOf('\n}\n', s.indexOf('async function resolveHostedActorRole')) + 3);
61 assert.ok(fn.includes('roleForSub(actorSub)'), 'roleForSub used in gateway admin override');
62 assert.ok(fn.includes("role !== 'admin'"), 'override is guarded by role !== admin');
63 assert.ok(fn.includes("role = 'admin'"), 'override sets role to admin');
64 assert.ok(fn.includes('mayApproveProposals = true'), 'override sets mayApproveProposals true');
65 });
66
67 test('gateway admin override: comment explains the lockout-prevention rationale', () => {
68 const s = load();
69 const fn = s.slice(s.indexOf('async function resolveHostedActorRole'), s.indexOf('\n}\n', s.indexOf('async function resolveHostedActorRole')) + 3);
70 assert.ok(fn.includes('locked out'), 'comment explains lockout-prevention intent');
71 });
72
73 test('bridge fallback: placed inside the BRIDGE_URL branch, not outside', () => {
74 const s = load();
75 const fnStart = s.indexOf('async function resolveHostedActorRole');
76 const fnEnd = s.indexOf('\n}\n', fnStart) + 3;
77 const fn = s.slice(fnStart, fnEnd);
78 // The bridgeResolved fallback block should appear before the final gateway override block
79 const bridgeFallbackIdx = fn.indexOf('!bridgeResolved');
80 const overrideIdx = fn.indexOf('Gateway-level admin override');
81 assert.ok(bridgeFallbackIdx < overrideIdx, 'bridge fallback block appears before gateway override');
82 });
83 });
84
85 describe('hub.js approveProposal — error visibility wiring', () => {
86 let src;
87 const load = () => {
88 if (!src) src = fs.readFileSync(HUB_SRC, 'utf8');
89 return src;
90 };
91
92 test('approveProposal catch uses showToast, not appendChild', () => {
93 const s = load();
94 const fnStart = s.indexOf('async function approveProposal');
95 assert.ok(fnStart > 0, 'approveProposal function exists');
96 const fnEnd = s.indexOf('\n }\n', fnStart + 100);
97 const fn = s.slice(fnStart, fnEnd + 5);
98 assert.ok(fn.includes('showToast'), 'showToast used in approveProposal catch');
99 assert.ok(!fn.includes("className = 'muted'"), 'muted paragraph removed from approveProposal');
100 assert.ok(!fn.includes('db.appendChild'), 'appendChild pattern removed from approveProposal catch');
101 });
102
103 test('discardProposal catch uses showToast, not appendChild', () => {
104 const s = load();
105 const fnStart = s.indexOf('async function discardProposal');
106 assert.ok(fnStart > 0, 'discardProposal function exists');
107 const fnEnd = s.indexOf('\n }\n', fnStart + 100);
108 const fn = s.slice(fnStart, fnEnd + 5);
109 assert.ok(fn.includes('showToast'), 'showToast used in discardProposal catch');
110 assert.ok(!fn.includes("className = 'muted'"), 'muted paragraph removed from discardProposal');
111 assert.ok(!fn.includes('db.appendChild'), 'appendChild pattern removed from discardProposal catch');
112 });
113
114 test('approveProposal toast passes isError=true', () => {
115 const s = load();
116 const fnStart = s.indexOf('async function approveProposal');
117 const fn = s.slice(fnStart, s.indexOf('\n async function discardProposal', fnStart));
118 assert.ok(fn.includes('showToast(') && fn.includes(', true)'), 'approveProposal toast marks error=true');
119 });
120
121 test('discardProposal toast passes isError=true', () => {
122 const s = load();
123 const fnStart = s.indexOf('async function discardProposal');
124 const fn = s.slice(fnStart, s.indexOf('\n el(', fnStart));
125 assert.ok(fn.includes('showToast(') && fn.includes(', true)'), 'discardProposal toast marks error=true');
126 });
127
128 test('approveProposal still closes the panel on success (hideDetailPanelChrome present)', () => {
129 const s = load();
130 const fnStart = s.indexOf('async function approveProposal');
131 const fn = s.slice(fnStart, s.indexOf('\n async function discardProposal', fnStart));
132 assert.ok(fn.includes('hideDetailPanelChrome()'), 'panel close preserved in success path');
133 assert.ok(fn.includes('loadProposals()'), 'proposals reload preserved in success path');
134 });
135 });
136
137 describe('resolveHostedActorRole — logic invariants (structural)', () => {
138 const load = () => fs.readFileSync(SERVER_SRC, 'utf8');
139
140 test('bridge fallback only runs when bridge did not resolve (guards are symmetric)', () => {
141 const s = load();
142 const fnStart = s.indexOf('async function resolveHostedActorRole');
143 const fn = s.slice(fnStart, s.indexOf('\n}\n', fnStart) + 3);
144 // bridgeResolved = false precedes the fallback block
145 const resolvedFalse = fn.indexOf('bridgeResolved = false');
146 const resolvedTrue = fn.indexOf('bridgeResolved = true');
147 const fallback = fn.indexOf('!bridgeResolved');
148 assert.ok(resolvedFalse < fallback, 'bridgeResolved initially false before fallback');
149 assert.ok(resolvedTrue < fallback, 'bridgeResolved set true on success before fallback guard');
150 });
151
152 test('mayApproveProposals defaults to false (fail-closed)', () => {
153 const s = load();
154 const fnStart = s.indexOf('async function resolveHostedActorRole');
155 const fn = s.slice(fnStart, s.indexOf('\n}\n', fnStart) + 3);
156 // Default must be false (fail-closed)
157 assert.ok(fn.includes('let mayApproveProposals = false'), 'mayApproveProposals defaults to false');
158 });
159
160 test('role defaults to member (fail-closed)', () => {
161 const s = load();
162 const fnStart = s.indexOf('async function resolveHostedActorRole');
163 const fn = s.slice(fnStart, s.indexOf('\n}\n', fnStart) + 3);
164 assert.ok(fn.includes("let role = 'member'"), "role defaults to 'member'");
165 });
166
167 test('function returns role, mayApproveProposals, and isMcpAccess', () => {
168 const s = load();
169 // SEC-KN-3: isMcpAccess is required so callers can bar agent tokens from self-apply.
170 // SEC-SEAM-1: payload accompanies both returns for sessionBound classification.
171 assert.ok(
172 s.includes('return { role, mayApproveProposals, isMcpAccess: true, payload: bearerPayload }'),
173 'mcp_access early-return includes isMcpAccess: true',
174 );
175 assert.ok(
176 s.includes('return { role, mayApproveProposals, isMcpAccess: false, payload: bearerPayload }'),
177 'non-agent path returns isMcpAccess: false',
178 );
179 });
180 });
File History 4 commits
sha256:e4c529f14a0bb908c1caaaeb3f95f3623a1a82e636e7e3722ca2cd3dc9821263 security: npm audit fix pre-bridge 2026-07-29 Human 40 days ago
sha256:b5f647cb9c409f563d4671fe3fc05ddea01fabfed9b41fc11cb923588e1c1baf mirror: GitHub Phase A durable MCP OAuth (#270) Human minor ⚠ 56 days ago
sha256:873e30b7fafe601346295f8f4289f388f21d8f715f28584d5481899ba2b714fc Merge pull request #249 from aaronrene/muse-mirror Agent 74 days ago
sha256:d8c648b20a4d53b2673c5c082ee7edfa7b2fc9b11080832da1f38807b6bf940b fix(7C-L1b): route hosted delegation proposals through cani… Human minor ⚠ 76 days ago