139 lines · 4 KBtext/plain; charset=utf-8
The Coline App SDK: apps, tools, file types and surfaces that run inside Coline workspaces, and public websites with Coline Sites. TypeScript, with an in-memory test workspace. MIT.
| 5 |
| evaluateCapabilityGate, |
| 6 | } from "./gate"; |
| 7 |
| 8 | const fullConfig = { |
| 9 | manifestPermissions: [ |
| 10 | "files.read", |
| 11 | "files.write", |
| 12 | "storage.app", |
| 13 | "notifications.write", |
| 14 | ], |
| 15 | grantedPermissions: [ |
| 16 | "files.read", |
| 17 | "files.write", |
| 18 | "storage.app", |
| 19 | "notifications.write", |
| 20 | ], |
| 21 | } as const; |
| 22 |
| 23 | describe("evaluateCapabilityGate", () => { |
| 24 | it("allows a declared, granted, within-ceiling operation", () => { |
| 25 | const decision = evaluateCapabilityGate("files.create", { |
| 26 | ...fullConfig, |
| 27 | effectCeiling: "write", |
| 28 | }); |
| 29 | expect(decision.allowed).toBe(true); |
| 30 | }); |
| 31 |
| 32 | it("rejects unknown operations", () => { |
| 33 | const decision = evaluateCapabilityGate("files.obliterate", { |
| 34 | ...fullConfig, |
| 35 | effectCeiling: "destructive", |
| 36 | }); |
| 37 | expect(decision).toMatchObject({ allowed: false, code: "unknown_operation" }); |
| 38 | }); |
| 39 |
| 40 | it("rejects operations whose permission is not declared in the manifest", () => { |
| 41 | const decision = evaluateCapabilityGate("members.list", { |
| 42 | ...fullConfig, |
| 43 | effectCeiling: "read", |
| 44 | }); |
| 45 | expect(decision).toMatchObject({ |
| 46 | allowed: false, |
| 47 | code: "permission_not_declared", |
| 48 | }); |
| 49 | }); |
| 50 |
| 51 | it("rejects operations declared but not granted to the install", () => { |
| 52 | const decision = evaluateCapabilityGate("notifications.create", { |
| 53 | manifestPermissions: fullConfig.manifestPermissions, |
| 54 | grantedPermissions: ["files.read"], |
| 55 | effectCeiling: "write", |
| 56 | }); |
| 57 | expect(decision).toMatchObject({ |
| 58 | allowed: false, |
| 59 | code: "permission_not_granted", |
| 60 | }); |
| 61 | }); |
| 62 |
| 63 | describe("effect ceilings (the §10.3 invariant)", () => { |
| 64 | it("a read tool cannot call write capabilities", () => { |
| 65 | const decision = evaluateCapabilityGate("files.create", { |
| 66 | ...fullConfig, |
| 67 | effectCeiling: "read", |
| 68 | }); |
| 69 | expect(decision).toMatchObject({ |
| 70 | allowed: false, |
| 71 | code: "effect_ceiling_exceeded", |
| 72 | }); |
| 73 | }); |
| 74 |
| 75 | it("a write tool cannot call destructive capabilities", () => { |
| 76 | const decision = evaluateCapabilityGate("files.trash", { |
| 77 | ...fullConfig, |
| 78 | effectCeiling: "write", |
| 79 | }); |
| 80 | expect(decision).toMatchObject({ |
| 81 | allowed: false, |
| 82 | code: "effect_ceiling_exceeded", |
| 83 | }); |
| 84 | }); |
| 85 |
| 86 | it("a destructive tool can call destructive capabilities", () => { |
| 87 | const decision = evaluateCapabilityGate("files.trash", { |
| 88 | ...fullConfig, |
| 89 | effectCeiling: "destructive", |
| 90 | }); |
| 91 | expect(decision.allowed).toBe(true); |
| 92 | }); |
| 93 |
| 94 | it("an external tool is ceilinged at write for workspace mutations", () => { |
| 95 | expect( |
| 96 | evaluateCapabilityGate("files.create", { |
| 97 | ...fullConfig, |
| 98 | effectCeiling: "external", |
| 99 | }).allowed, |
| 100 | ).toBe(true); |
| 101 | expect( |
| 102 | evaluateCapabilityGate("files.trash", { |
| 103 | ...fullConfig, |
| 104 | effectCeiling: "external", |
| 105 | }), |
| 106 | ).toMatchObject({ allowed: false, code: "effect_ceiling_exceeded" }); |
| 107 | }); |
| 108 |
| 109 | it("render contexts (no ceiling supplied) are read-only", () => { |
| 110 | const decision = evaluateCapabilityGate("files.create", fullConfig); |
| 111 | expect(decision).toMatchObject({ |
| 112 | allowed: false, |
| 113 | code: "effect_ceiling_exceeded", |
| 114 | }); |
| 115 | expect(evaluateCapabilityGate("files.list", fullConfig).allowed).toBe(true); |
| 116 | }); |
| 117 | }); |
| 118 |
| 119 | it("permissionless operations pass without grants but respect ceilings", () => { |
| 120 | const config = { manifestPermissions: [], grantedPermissions: [] } as const; |
| 121 | expect(evaluateCapabilityGate("workspace.get", config).allowed).toBe(true); |
| 122 | expect(evaluateCapabilityGate("pickers.file", config).allowed).toBe(true); |
| 123 | expect(evaluateCapabilityGate("navigation.openFile", config).allowed).toBe(true); |
| 124 | }); |
| 125 | }); |
| 126 |
| 127 | describe("createCapabilityGate", () => { |
| 128 | it("assert throws CapabilityDeniedError with the denial code", () => { |
| 129 | const gate = createCapabilityGate({ ...fullConfig, effectCeiling: "read" }); |
| 130 | expect(gate.assert("files.list")).toBe("files.list"); |
| 131 | expect(() => gate.assert("files.create")).toThrowError(CapabilityDeniedError); |
| 132 | try { |
| 133 | gate.assert("files.create"); |
| 134 | } catch (error) { |
| 135 | expect((error as CapabilityDeniedError).code).toBe("effect_ceiling_exceeded"); |
| 136 | } |
| 137 | }); |
| 138 | }); |
| 139 |