48 lines
3.4 KiB
JavaScript
48 lines
3.4 KiB
JavaScript
'use strict';
|
|
|
|
const assert = require('node:assert/strict');
|
|
const fs = require('fs');
|
|
const path = require('path');
|
|
const test = require('node:test');
|
|
const contract = require('../../renderer/modules/navigation-routes');
|
|
const { CommandRegistry, inferredPermission } = require('../../src/core/command-registry');
|
|
|
|
test('raw live, files, package, mount, SQL, diagnostics and system-action routes are Expert-only', () => {
|
|
const expertRoutes = ['console/live', 'console/files', 'tools/package-services', 'library/mounts', 'tools/database', 'tools/diagnostics', 'console/power'];
|
|
for (const id of expertRoutes) assert.equal(contract.routes.find(route => route.id === id)?.expert, true, `${id} must be Expert-only`);
|
|
assert.equal(contract.routes.find(route => route.id === 'console/status')?.expert, undefined);
|
|
assert.equal(contract.routes.find(route => route.id === 'library/games')?.expert, undefined);
|
|
assert.equal(contract.routes.find(route => route.id === 'library/packages')?.expert, undefined);
|
|
});
|
|
|
|
test('deep links are gated and expert mode requires explicit session activation', () => {
|
|
const source = fs.readFileSync(path.join(__dirname, '../../renderer/modules/navigation.js'), 'utf8');
|
|
assert.match(source, /route\.expert && !expertMode[^]*defaultRoute/);
|
|
assert.match(source, /let expertMode = false/);
|
|
assert.doesNotMatch(source, /localStorage\.(?:getItem|setItem)\('chimera\.expertMode'/);
|
|
assert.match(source, /sessionExpertMode\(expertMode, expertMode \? 'ENABLE EXPERT MODE' : undefined\)/);
|
|
assert.match(source, /!expertMode && routeById\.get\(currentRouteId\)\?\.expert[^]*history: 'replace'/);
|
|
});
|
|
|
|
test('server permissions reject Expert commands independently from route hiding', async () => {
|
|
const registry = new CommandRegistry({ platform: 'server' });
|
|
registry.register({ name: 'database:query', classification: 'read-only', handler: () => 'rows' });
|
|
registry.register({ name: 'shadowmount:status', classification: 'read-only', handler: () => 'mounts' });
|
|
registry.register({ name: 'system-state:command', classification: 'destructive', confirmation: 'CONFIRM POWER', handler: () => 'powered' });
|
|
registry.register({ name: 'console:status', classification: 'read-only', handler: () => 'simple' });
|
|
const standard = { session: { id: 'session-1', expertMode: false } };
|
|
await assert.rejects(registry.invoke('database:query', null, standard), error => error.statusCode === 403 && error.code === 'EXPERT_MODE_REQUIRED');
|
|
await assert.rejects(registry.invoke('shadowmount:status', null, standard), error => error.statusCode === 403);
|
|
assert.equal(await registry.invoke('console:status', null, standard), 'simple');
|
|
const expert = { session: { id: 'session-1', expertMode: true } };
|
|
assert.equal(await registry.invoke('database:query', null, expert), 'rows');
|
|
assert.equal(await registry.invoke('system-state:command', { confirmation: 'CONFIRM POWER' }, expert), 'powered');
|
|
});
|
|
|
|
test('Expert command families have explicit inferred permission coverage', () => {
|
|
for (const name of ['database:read', 'shadowmount:status', 'packages:list', 'diagnostics:bundle', 'monitoring:prometheus', 'ecosystem:files:list', 'ecosystem:live:status', 'system:service-matrix', 'system-state:deploy', 'power:shutdown']) {
|
|
assert.equal(inferredPermission(name), 'expert', name);
|
|
}
|
|
for (const name of ['library:list', 'console:status', 'transfer:state']) assert.equal(inferredPermission(name), 'authenticated', name);
|
|
});
|