mirror of
https://bitbucket.org/siakitem/my-pi.git
synced 2026-08-28 16:45:22 +00:00
feat: vendor permission system source
This commit is contained in:
云服务部-叶林立
@@ -0,0 +1,437 @@
|
||||
import { afterEach, describe, expect, it, vi } from "vitest";
|
||||
|
||||
// Mock node:os so tilde-expansion is deterministic across platforms.
|
||||
vi.mock("node:os", () => {
|
||||
const homedir = vi.fn(() => "/mock/home");
|
||||
return {
|
||||
homedir,
|
||||
default: { homedir },
|
||||
};
|
||||
});
|
||||
|
||||
import { AccessPath } from "#src/access-intent/access-path";
|
||||
import { BashProgram } from "#src/access-intent/bash/program";
|
||||
import { describeBashPathGate } from "#src/handlers/gates/bash-path";
|
||||
import type {
|
||||
GateBypass,
|
||||
GateDescriptor,
|
||||
GateResult,
|
||||
} from "#src/handlers/gates/descriptor";
|
||||
import { isGateBypass, isGateDescriptor } from "#src/handlers/gates/descriptor";
|
||||
import type { ToolCallContext } from "#src/handlers/gates/types";
|
||||
import { pathFlavorForPlatform, posixPathFlavor } from "#src/path/path-flavor";
|
||||
import { PathNormalizer } from "#src/path-normalizer";
|
||||
import type { ScopedPermissionResolver } from "#src/permission-resolver";
|
||||
import { getNonEmptyString, toRecord } from "#src/value-guards";
|
||||
|
||||
import {
|
||||
makeGateCheckResult as makeCheckResult,
|
||||
makePathDispatchResolver,
|
||||
makeResolver,
|
||||
makeTcc,
|
||||
} from "#test/helpers/gate-fixtures";
|
||||
|
||||
afterEach(() => {
|
||||
vi.restoreAllMocks();
|
||||
});
|
||||
|
||||
/**
|
||||
* Mirror the handler's parse-once derivation: parse the bash command into a
|
||||
* shared `BashProgram` and inject it, exactly as `permission-gate-handler.ts`
|
||||
* does, so the gate is exercised through the production wiring.
|
||||
*/
|
||||
async function describeGate(
|
||||
tcc: ToolCallContext,
|
||||
resolver: ScopedPermissionResolver,
|
||||
): Promise<GateResult> {
|
||||
return describeGateOnPlatform(process.platform, tcc, resolver);
|
||||
}
|
||||
|
||||
/**
|
||||
* Variant of {@link describeGate} that injects an explicit host platform, so a
|
||||
* win32-specific decision can be exercised on a POSIX CI host (and vice versa)
|
||||
* without mocking `node:path` (#520).
|
||||
*/
|
||||
async function describeGateOnPlatform(
|
||||
platform: NodeJS.Platform,
|
||||
tcc: ToolCallContext,
|
||||
resolver: ScopedPermissionResolver,
|
||||
): Promise<GateResult> {
|
||||
const command = getNonEmptyString(toRecord(tcc.input).command);
|
||||
const bashProgram =
|
||||
tcc.toolName === "bash" && command
|
||||
? await BashProgram.parse(
|
||||
command,
|
||||
new PathNormalizer(pathFlavorForPlatform(platform), tcc.cwd),
|
||||
)
|
||||
: null;
|
||||
return describeBashPathGate(tcc, bashProgram, resolver);
|
||||
}
|
||||
|
||||
// ── tests ──────────────────────────────────────────────────────────────────
|
||||
|
||||
describe("describeBashPathGate", () => {
|
||||
it("returns null for non-bash tools", async () => {
|
||||
const result = await describeGate(
|
||||
makeTcc({ toolName: "read", input: { path: ".env" } }),
|
||||
makeResolver(),
|
||||
);
|
||||
expect(result).toBeNull();
|
||||
});
|
||||
|
||||
it("returns null when no tokens are extracted", async () => {
|
||||
const result = await describeGate(
|
||||
makeTcc({ input: { command: "echo hello" } }),
|
||||
makeResolver(),
|
||||
);
|
||||
expect(result).toBeNull();
|
||||
});
|
||||
|
||||
it("returns null when all tokens evaluate to allow", async () => {
|
||||
const result = await describeGate(
|
||||
makeTcc(),
|
||||
makeResolver(makeCheckResult({ state: "allow" })),
|
||||
);
|
||||
expect(result).toBeNull();
|
||||
});
|
||||
|
||||
it("returns GateDescriptor when a token evaluates to deny", async () => {
|
||||
const result = await describeGate(
|
||||
makeTcc(),
|
||||
makeResolver(makeCheckResult({ state: "deny", matchedPattern: "*.env" })),
|
||||
);
|
||||
expect(result).not.toBeNull();
|
||||
expect(isGateDescriptor(result)).toBe(true);
|
||||
const desc = result as GateDescriptor;
|
||||
expect(desc.surface).toBe("path");
|
||||
expect(desc.preCheck?.state).toBe("deny");
|
||||
});
|
||||
|
||||
it("returns GateDescriptor when a token evaluates to ask", async () => {
|
||||
const result = await describeGate(
|
||||
makeTcc(),
|
||||
makeResolver(makeCheckResult({ state: "ask", matchedPattern: "*" })),
|
||||
);
|
||||
expect(result).not.toBeNull();
|
||||
expect(isGateDescriptor(result)).toBe(true);
|
||||
const desc = result as GateDescriptor;
|
||||
expect(desc.preCheck?.state).toBe("ask");
|
||||
});
|
||||
|
||||
it("descriptor includes triggering token in prompt message", async () => {
|
||||
const result = (await describeGate(
|
||||
makeTcc(),
|
||||
makeResolver(makeCheckResult({ state: "deny", matchedPattern: "*.env" })),
|
||||
)) as GateDescriptor;
|
||||
expect(result.promptDetails.command).toBe("cat .env");
|
||||
// The bash path gate asks about the offending token, not the command.
|
||||
expect(result.payload.kind).toBe("path");
|
||||
expect(result.payload.request.value).toBe(".env");
|
||||
});
|
||||
|
||||
it("descriptor decision uses surface 'path'", async () => {
|
||||
const result = (await describeGate(
|
||||
makeTcc(),
|
||||
makeResolver(makeCheckResult({ state: "deny", matchedPattern: "*.env" })),
|
||||
)) as GateDescriptor;
|
||||
expect(result.decision.surface).toBe("path");
|
||||
});
|
||||
|
||||
it("carries the deciding token's access facts on promptDetails (bash path surface)", async () => {
|
||||
const resolver = makeResolver(
|
||||
makeCheckResult({ state: "deny", matchedPattern: "*.env" }),
|
||||
);
|
||||
const result = (await describeGate(makeTcc(), resolver)) as GateDescriptor;
|
||||
// The facts are the string projection of the same AccessPath the gate
|
||||
// resolved for the deciding token.
|
||||
const intent = resolver.resolve.mock.calls.at(-1)?.[0];
|
||||
const path = intent?.kind === "access-path" ? intent.path : undefined;
|
||||
expect(path).toBeDefined();
|
||||
expect(result.promptDetails.accessIntent).toEqual({
|
||||
surface: "path",
|
||||
matchValues: path?.matchValues(),
|
||||
boundaryValue: path?.boundaryValue(),
|
||||
});
|
||||
});
|
||||
|
||||
it("returns GateBypass when session rule covers the path", async () => {
|
||||
const result = await describeGate(
|
||||
makeTcc(),
|
||||
makeResolver(makeCheckResult({ state: "allow", source: "session" })),
|
||||
);
|
||||
expect(result).not.toBeNull();
|
||||
expect(isGateBypass(result)).toBe(true);
|
||||
expect((result as GateBypass).action).toBe("allow");
|
||||
expect((result as GateBypass).decidedBy).toEqual({
|
||||
kind: "session_approval",
|
||||
surface: "path",
|
||||
pattern: null,
|
||||
});
|
||||
});
|
||||
|
||||
it("returns null when command is missing", async () => {
|
||||
const result = await describeGate(makeTcc({ input: {} }), makeResolver());
|
||||
expect(result).toBeNull();
|
||||
});
|
||||
|
||||
it("evaluates most restrictive across multiple tokens", async () => {
|
||||
const resolver = makePathDispatchResolver(
|
||||
{ "src/foo.ts": makeCheckResult({ state: "allow" }) },
|
||||
makeCheckResult({ state: "deny", matchedPattern: "*.env" }),
|
||||
);
|
||||
const result = await describeGate(
|
||||
makeTcc({ input: { command: "cat src/foo.ts .env" } }),
|
||||
resolver,
|
||||
);
|
||||
expect(result).not.toBeNull();
|
||||
expect(isGateDescriptor(result)).toBe(true);
|
||||
expect((result as GateDescriptor).preCheck?.state).toBe("deny");
|
||||
});
|
||||
|
||||
it("deny wins in multi-token: cp .env README.md", async () => {
|
||||
const resolver = makePathDispatchResolver(
|
||||
{ ".env": makeCheckResult({ state: "deny", matchedPattern: "*.env" }) },
|
||||
makeCheckResult({ state: "allow" }),
|
||||
);
|
||||
const result = await describeGate(
|
||||
makeTcc({ input: { command: "cp .env README.md" } }),
|
||||
resolver,
|
||||
);
|
||||
expect(result).not.toBeNull();
|
||||
expect(isGateDescriptor(result)).toBe(true);
|
||||
const desc = result as GateDescriptor;
|
||||
expect(desc.preCheck?.state).toBe("deny");
|
||||
expect(desc.decision.value).toBe(".env");
|
||||
});
|
||||
|
||||
it("extracts redirect target: echo test > .env triggers deny", async () => {
|
||||
const resolver = makePathDispatchResolver(
|
||||
{ ".env": makeCheckResult({ state: "deny", matchedPattern: "*.env" }) },
|
||||
makeCheckResult({ state: "allow" }),
|
||||
);
|
||||
const result = await describeGate(
|
||||
makeTcc({ input: { command: "echo test > .env" } }),
|
||||
resolver,
|
||||
);
|
||||
expect(result).not.toBeNull();
|
||||
expect(isGateDescriptor(result)).toBe(true);
|
||||
expect((result as GateDescriptor).preCheck?.state).toBe("deny");
|
||||
});
|
||||
|
||||
it("returns null when all tokens match only the universal default", async () => {
|
||||
const result = await describeGate(
|
||||
makeTcc(),
|
||||
makeResolver(
|
||||
makeCheckResult({
|
||||
state: "ask",
|
||||
matchedPattern: undefined,
|
||||
source: "special",
|
||||
origin: "builtin",
|
||||
}),
|
||||
),
|
||||
);
|
||||
expect(result).toBeNull();
|
||||
});
|
||||
|
||||
it("ignores tokens matching universal default but fires for explicit rule matches", async () => {
|
||||
const resolver = makePathDispatchResolver(
|
||||
{ ".env": makeCheckResult({ state: "deny", matchedPattern: "*.env" }) },
|
||||
// Other tokens match only the universal default (no matchedPattern)
|
||||
makeCheckResult({
|
||||
state: "ask",
|
||||
matchedPattern: undefined,
|
||||
source: "special",
|
||||
origin: "builtin",
|
||||
}),
|
||||
);
|
||||
const result = await describeGate(
|
||||
makeTcc({ input: { command: "cat src/foo.ts .env" } }),
|
||||
resolver,
|
||||
);
|
||||
expect(result).not.toBeNull();
|
||||
expect(isGateDescriptor(result)).toBe(true);
|
||||
const desc = result as GateDescriptor;
|
||||
expect(desc.preCheck?.state).toBe("deny");
|
||||
expect(desc.decision.value).toBe(".env");
|
||||
});
|
||||
|
||||
it("resolves cd-aware policy values while keeping the raw prompt token", async () => {
|
||||
const resolver = makeResolver(
|
||||
makeCheckResult({ state: "deny", matchedPattern: "*" }),
|
||||
);
|
||||
const result = (await describeGate(
|
||||
makeTcc({
|
||||
input: { command: "cd nested && cat src/file.txt" },
|
||||
cwd: "/test/project",
|
||||
}),
|
||||
resolver,
|
||||
)) as GateDescriptor;
|
||||
|
||||
expect(resolver.resolve).toHaveBeenCalledWith({
|
||||
kind: "access-path",
|
||||
surface: "path",
|
||||
path: AccessPath.forPath("src/file.txt", {
|
||||
cwd: "/test/project",
|
||||
resolveBase: "/test/project/nested",
|
||||
flavor: posixPathFlavor,
|
||||
}),
|
||||
agentName: undefined,
|
||||
});
|
||||
// The raw token drives the prompt payload, the decision, and the approval.
|
||||
expect(result.payload.request.value).toBe("src/file.txt");
|
||||
expect(result.decision.value).toBe("src/file.txt");
|
||||
});
|
||||
|
||||
it("does not resolve relative policy values through an unknown cd", async () => {
|
||||
const resolver = makeResolver(
|
||||
makeCheckResult({ state: "deny", matchedPattern: "*" }),
|
||||
);
|
||||
await describeGate(
|
||||
makeTcc({
|
||||
input: { command: 'cd "$DIR" && cat src/foo.ts' },
|
||||
cwd: "/test/project",
|
||||
}),
|
||||
resolver,
|
||||
);
|
||||
|
||||
expect(resolver.resolve).toHaveBeenCalledWith({
|
||||
kind: "access-path",
|
||||
surface: "path",
|
||||
path: AccessPath.forLiteral("src/foo.ts"),
|
||||
agentName: undefined,
|
||||
});
|
||||
});
|
||||
|
||||
it("binds a current-directory token's session approval to the cwd subtree", async () => {
|
||||
const resolver = makeResolver(
|
||||
makeCheckResult({ state: "ask", matchedPattern: "*" }),
|
||||
);
|
||||
const result = (await describeGate(
|
||||
makeTcc({
|
||||
input: { command: "cat .env" },
|
||||
cwd: "/test/project",
|
||||
}),
|
||||
resolver,
|
||||
)) as GateDescriptor;
|
||||
|
||||
expect(result.decision.value).toBe(".env");
|
||||
expect(result.sessionApproval?.surface).toBe("path");
|
||||
expect(result.sessionApproval?.representativePattern).toBe(
|
||||
"/test/project/*",
|
||||
);
|
||||
});
|
||||
});
|
||||
|
||||
// Home-relative path characterization (#350) ──────────────────────────────
|
||||
//
|
||||
// The parser extracts ~/... tokens from bash commands; the resolver receives
|
||||
// the raw token and normalizeInput handles expansion. These tests verify the
|
||||
// gate correctly dispatches ~/... tokens through the deny/ask path.
|
||||
|
||||
describe("describeBashPathGate — home-relative paths", () => {
|
||||
it("extracts ~/... token and builds descriptor on deny", async () => {
|
||||
// node:os is mocked: homedir() returns "/mock/home".
|
||||
// cat ~/.ssh/config → token "~/.ssh/config" extracted.
|
||||
const resolver = makePathDispatchResolver(
|
||||
{
|
||||
"/mock/home/.ssh/config": makeCheckResult({
|
||||
state: "deny",
|
||||
matchedPattern: "~/.ssh/*",
|
||||
}),
|
||||
},
|
||||
makeCheckResult({ state: "allow" }),
|
||||
);
|
||||
const result = (await describeGate(
|
||||
makeTcc({ input: { command: "cat ~/.ssh/config" } }),
|
||||
resolver,
|
||||
)) as GateDescriptor;
|
||||
|
||||
expect(isGateDescriptor(result)).toBe(true);
|
||||
expect(result.preCheck?.state).toBe("deny");
|
||||
expect(result.promptDetails.command).toBe("cat ~/.ssh/config");
|
||||
expect(result.payload.request.value).toBe("~/.ssh/config");
|
||||
});
|
||||
|
||||
it("extracts $HOME/... token and builds descriptor on deny", async () => {
|
||||
const resolver = makePathDispatchResolver(
|
||||
{
|
||||
"/mock/home/.ssh/config": makeCheckResult({
|
||||
state: "deny",
|
||||
matchedPattern: "$HOME/.ssh/*",
|
||||
}),
|
||||
},
|
||||
makeCheckResult({ state: "allow" }),
|
||||
);
|
||||
const result = (await describeGate(
|
||||
makeTcc({ input: { command: "cat $HOME/.ssh/config" } }),
|
||||
resolver,
|
||||
)) as GateDescriptor;
|
||||
|
||||
expect(isGateDescriptor(result)).toBe(true);
|
||||
expect(result.preCheck?.state).toBe("deny");
|
||||
// A plain `$HOME` reference is resolved at token collection (#694), so the
|
||||
// displayed token is the path the shell will actually touch — and it now
|
||||
// agrees with the session-approval pattern, which has always been derived
|
||||
// from the expanded `AccessPath.value()`. A `~` token keeps its raw
|
||||
// spelling: it is shape-classified directly and never needed
|
||||
// collection-time expansion.
|
||||
expect(result.payload.request.value).toBe("/mock/home/.ssh/config");
|
||||
});
|
||||
});
|
||||
|
||||
// Win32 backslash-relative path gating (#520) ──────────────────────────────
|
||||
//
|
||||
// On Windows a backslash is a path separator, so a backslash-relative bash
|
||||
// argument (`cat dir\file`) must be gated by a `path` rule the same as its
|
||||
// forward-slash equivalent (`dir/file`). On POSIX `\` is a legal filename
|
||||
// character, so the token stays bare and is not gated.
|
||||
|
||||
describe("describeBashPathGate — win32 backslash-relative paths", () => {
|
||||
it("denies a backslash-relative token matching a path rule on win32", async () => {
|
||||
// The win32 normalizer resolves `dir\file` to matchValues including the
|
||||
// relative `dir\file` alias, which the rule (`dir/file`, folded to
|
||||
// `dir\file` under win32 separators) matches.
|
||||
const resolver = makePathDispatchResolver(
|
||||
{
|
||||
"dir\\file": makeCheckResult({
|
||||
state: "deny",
|
||||
matchedPattern: "dir/file",
|
||||
}),
|
||||
},
|
||||
makeCheckResult({ state: "allow" }),
|
||||
);
|
||||
const result = (await describeGateOnPlatform(
|
||||
"win32",
|
||||
makeTcc({
|
||||
input: { command: "cat dir\\file" },
|
||||
cwd: "C:\\Projects\\App",
|
||||
}),
|
||||
resolver,
|
||||
)) as GateDescriptor;
|
||||
|
||||
expect(isGateDescriptor(result)).toBe(true);
|
||||
expect(result.preCheck?.state).toBe("deny");
|
||||
expect(result.payload.request.value).toBe("dir\\file");
|
||||
});
|
||||
|
||||
it("does not gate a backslash-relative token on posix (stays bare)", async () => {
|
||||
const resolver = makePathDispatchResolver(
|
||||
{
|
||||
"dir\\file": makeCheckResult({
|
||||
state: "deny",
|
||||
matchedPattern: "dir/file",
|
||||
}),
|
||||
},
|
||||
makeCheckResult({ state: "allow" }),
|
||||
);
|
||||
const result = await describeGateOnPlatform(
|
||||
"linux",
|
||||
makeTcc({
|
||||
input: { command: "cat dir\\file" },
|
||||
cwd: "/projects/app",
|
||||
}),
|
||||
resolver,
|
||||
);
|
||||
expect(result).toBeNull();
|
||||
});
|
||||
});
|
||||
Reference in New Issue
Block a user