| 1 | import assert from "node:assert/strict"; |
| 2 | import { test } from "node:test"; |
| 3 | import { RpcError } from "../rpc.js"; |
| 4 | import { BROWSER_ERR_NO_GRANT } from "./errors.js"; |
| 5 | import { GrantRegistry } from "./grants.js"; |
| 6 | |
| 7 | const noGrant = (error: unknown) => error instanceof RpcError && error.code === BROWSER_ERR_NO_GRANT; |
| 8 | |
| 9 | test("grants are verified against the task and the service generation", () => { |
| 10 | let generation = "g-1"; |
| 11 | const revoked: string[] = []; |
| 12 | const grants = new GrantRegistry({ generation: () => generation, now: () => 5, onRevoked: (grant) => revoked.push(grant.grantId) }); |
| 13 | assert.throws(() => grants.verify("grant-a"), noGrant); |
| 14 | const grant = grants.install({ grantId: "grant-a", taskId: "task-a", sessionId: "s" }); |
| 15 | assert.deepEqual(grant, { grantId: "grant-a", taskId: "task-a", sessionId: "s", generation: "g-1", createdAt: 5 }); |
| 16 | assert.equal(grants.verify("grant-a").taskId, "task-a"); |
| 17 | assert.equal(grants.verifyTab("grant-a", "task-a", "s").grantId, "grant-a"); |
| 18 | assert.throws(() => grants.verifyTab("grant-a", "task-b"), noGrant); |
| 19 | assert.throws(() => grants.verifyTab("grant-a", "task-a", "other"), noGrant); |
| 20 | assert.throws(() => grants.verifyTab("grant-a", undefined), noGrant); |
| 21 | assert.throws(() => grants.install({ grantId: "", taskId: "t", sessionId: "" }), noGrant); |
| 22 | |
| 23 | generation = "g-2"; |
| 24 | assert.throws(() => grants.verify("grant-a"), noGrant); |
| 25 | assert.deepEqual(revoked, ["grant-a"]); |
| 26 | assert.equal(grants.size, 0); |
| 27 | }); |
| 28 | |
| 29 | test("revoke removes the grant and a generation change revokes every grant", () => { |
| 30 | let generation = "g-1"; |
| 31 | const revoked: string[] = []; |
| 32 | const grants = new GrantRegistry({ generation: () => generation, onRevoked: (grant) => revoked.push(grant.grantId) }); |
| 33 | grants.install({ grantId: "a", taskId: "ta", sessionId: "" }); |
| 34 | grants.install({ grantId: "b", taskId: "tb", sessionId: "" }); |
| 35 | assert.equal(grants.revoke("a")?.taskId, "ta"); |
| 36 | assert.equal(grants.revoke("a"), null); |
| 37 | assert.throws(() => grants.verify("a"), noGrant); |
| 38 | grants.observeGeneration("g-1"); |
| 39 | assert.equal(grants.size, 1, "the same generation changes nothing"); |
| 40 | generation = ""; |
| 41 | grants.observeGeneration(""); |
| 42 | assert.equal(grants.size, 0); |
| 43 | assert.deepEqual(revoked, ["a", "b"]); |
| 44 | assert.throws(() => grants.install({ grantId: "c", taskId: "t", sessionId: "" }), noGrant); |
| 45 | }); |
| 46 | |
| 47 | test("diagnostic lookup never guesses between scopes or stale generations", () => { |
| 48 | let generation = "g1"; |
| 49 | const grants = new GrantRegistry({ generation: () => generation }); |
| 50 | const a = "a".repeat(64), b = "b".repeat(64); |
| 51 | grants.install({ grantId: "a", taskId: "task", sessionId: "s", diagnosticScope: a }); |
| 52 | assert.equal(grants.diagnosticScopeForTab("task", "s"), a); |
| 53 | assert.equal(grants.diagnosticScopeForTab("other", "s"), undefined); |
| 54 | assert.equal(grants.diagnosticScopeForTab("task", "other"), undefined); |
| 55 | grants.install({ grantId: "b", taskId: "task", sessionId: "s", diagnosticScope: b }); |
| 56 | assert.equal(grants.diagnosticScopeForTab("task", "s"), undefined); |
| 57 | grants.revoke("b"); |
| 58 | assert.equal(grants.diagnosticScopeForTab("task", "s"), a); |
| 59 | generation = "g2"; |
| 60 | assert.equal(grants.diagnosticScopeForTab("task", "s"), undefined); |
| 61 | assert.equal(grants.size, 1, "diagnostic lookup is read-only"); |
| 62 | }); |
| 63 |