my-pi/pi-permission-system/test/extension-config.test.ts

import { chmodSync, mkdirSync, mkdtempSync, rmSync, statSync } from "node:fs";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { afterEach, beforeEach, describe, expect, it, test } from "vitest";

import type { PermissionSystemExtensionConfig } from "#src/extension-config";
import {
  detectMisplacedPermissionKeys,
  ensurePermissionSystemLogsDirectory,
  isYoloModeEnabled,
  normalizePermissionSystemConfig,
} from "#src/extension-config";

function makeConfig(
  yoloMode: boolean | undefined,
): PermissionSystemExtensionConfig {
  return { yoloMode } as PermissionSystemExtensionConfig;
}

describe("detectMisplacedPermissionKeys", () => {
  it("returns an empty array for a record with only valid extension keys", () => {
    const result = detectMisplacedPermissionKeys({
      debugLog: true,
      permissionReviewLog: true,
      yoloMode: false,
    });
    expect(result).toEqual([]);
  });

  it("returns an empty array for an empty record", () => {
    const result = detectMisplacedPermissionKeys({});
    expect(result).toEqual([]);
  });

  it("returns misplaced key names when legacy permission-rule keys are present", () => {
    const result = detectMisplacedPermissionKeys({
      debugLog: true,
      defaultPolicy: { tools: "ask" },
      bash: { "git status": "allow" },
    });
    expect(result).toEqual(["defaultPolicy", "bash"]);
  });

  it("detects all known legacy permission-rule keys", () => {
    const result = detectMisplacedPermissionKeys({
      defaultPolicy: {},
      tools: {},
      bash: {},
      mcp: {},
      skills: {},
      special: {},
    });
    expect(result).toEqual([
      "defaultPolicy",
      "tools",
      "bash",
      "mcp",
      "skills",
      "special",
    ]);
  });

  it("does not detect doom_loop as a misplaced permission key", () => {
    const result = detectMisplacedPermissionKeys({
      doom_loop: {},
    });
    expect(result).toEqual([]);
  });

  it("does not flag the new flat-format permission key as misplaced", () => {
    const result = detectMisplacedPermissionKeys({
      debugLog: false,
      permission: { "*": "ask" },
    });
    expect(result).toEqual([]);
  });

  it("ignores unknown keys that are not permission-rule keys", () => {
    const result = detectMisplacedPermissionKeys({
      debugLog: true,
      someRandomKey: "value",
    });
    expect(result).toEqual([]);
  });
});

describe("normalizePermissionSystemConfig", () => {
  it("normalizes a valid config object", () => {
    const result = normalizePermissionSystemConfig({
      debugLog: true,
      permissionReviewLog: false,
      yoloMode: true,
    });
    expect(result).toEqual({
      debugLog: true,
      permissionReviewLog: false,
      yoloMode: true,
      doublePressToConfirm: true,
    });
  });

  it("applies the documented defaults for missing runtime knobs", () => {
    const result = normalizePermissionSystemConfig({});
    expect(result).toMatchObject({
      debugLog: false,
      permissionReviewLog: true,
      yoloMode: false,
      doublePressToConfirm: true,
    });
  });

  it("sets doublePressToConfirm false when explicitly disabled", () => {
    const result = normalizePermissionSystemConfig({
      doublePressToConfirm: false,
    });
    expect(result.doublePressToConfirm).toBe(false);
  });

  it("includes the optional scalar knobs when provided", () => {
    const result = normalizePermissionSystemConfig({
      forwardingTimeoutMs: 120_000,
      promptMaxRows: 12,
      promptFieldMaxWidth: 80,
      reviewLogFieldMaxWidth: 200,
    });
    expect(result.forwardingTimeoutMs).toBe(120_000);
    expect(result.promptMaxRows).toBe(12);
    expect(result.promptFieldMaxWidth).toBe(80);
    expect(result.reviewLogFieldMaxWidth).toBe(200);
  });

  it("omits the optional scalar knobs when absent, leaving consumer defaults", () => {
    const result = normalizePermissionSystemConfig({});
    for (const key of [
      "forwardingTimeoutMs",
      "promptMaxRows",
      "promptFieldMaxWidth",
      "reviewLogFieldMaxWidth",
    ]) {
      expect(key in result).toBe(false);
    }
  });

  // Deliberately dropped rather than carried: a declared config field no
  // runtime consumer reads is a maintenance trap, so the deprecated caps stop
  // at the merge intermediate the detector reads (#745).
  it("drops the deprecated preview caps even when the config sets them", () => {
    const result = normalizePermissionSystemConfig({
      toolInputPreviewMaxLength: 400,
      toolTextSummaryMaxLength: 120,
    });
    expect("toolInputPreviewMaxLength" in result).toBe(false);
    expect("toolTextSummaryMaxLength" in result).toBe(false);
  });

  it("includes shellTools when provided", () => {
    const result = normalizePermissionSystemConfig({
      shellTools: {
        exec_command: { commandArgument: "cmd", workdirArgument: "workdir" },
      },
    });
    expect(result.shellTools).toEqual({
      exec_command: { commandArgument: "cmd", workdirArgument: "workdir" },
    });
    expect("shellTools" in normalizePermissionSystemConfig({})).toBe(false);
  });

  it("includes authorizerChain when provided", () => {
    const result = normalizePermissionSystemConfig({
      authorizerChain: ["model-judge", "typo-reviewer"],
    });
    expect(result.authorizerChain).toEqual(["model-judge", "typo-reviewer"]);
    expect("authorizerChain" in normalizePermissionSystemConfig({})).toBe(false);
  });
});

describe("ensurePermissionSystemLogsDirectory", () => {
  let baseDir: string;

  beforeEach(() => {
    baseDir = mkdtempSync(join(tmpdir(), "pi-permission-system-logsdir-"));
  });

  afterEach(() => {
    rmSync(baseDir, { recursive: true, force: true });
  });

  test("creates the logs directory owner-only", () => {
    const logsDir = join(baseDir, "extensions", "pi-permission-system", "logs");

    expect(ensurePermissionSystemLogsDirectory(logsDir)).toBe(undefined);
    expect(statSync(logsDir).mode & 0o777).toBe(0o700);
  });

  test("tightens a directory inherited from an earlier version", () => {
    const logsDir = join(baseDir, "logs");
    mkdirSync(logsDir);
    chmodSync(logsDir, 0o755);

    expect(ensurePermissionSystemLogsDirectory(logsDir)).toBe(undefined);
    expect(statSync(logsDir).mode & 0o777).toBe(0o700);
  });
});

describe("isYoloModeEnabled", () => {
  it("returns true when yoloMode is true", () => {
    expect(isYoloModeEnabled(makeConfig(true))).toBe(true);
  });

  it("returns false when yoloMode is false", () => {
    expect(isYoloModeEnabled(makeConfig(false))).toBe(false);
  });

  it("returns false when yoloMode is undefined", () => {
    expect(isYoloModeEnabled(makeConfig(undefined))).toBe(false);
  });
});