| 1 | import assert from "node:assert/strict"; |
| 2 | import { test } from "node:test"; |
| 3 | |
| 4 | import { DANGEROUS_SCOPES, OAUTH_DEFAULT_SCOPES, SCOPES, SCOPE_GROUPS } from "@g1t/contracts/scopes"; |
| 5 | |
| 6 | import { |
| 7 | accessSummary, |
| 8 | consentedScopes, |
| 9 | describeExpiry, |
| 10 | everyScope, |
| 11 | grantFromForm, |
| 12 | impliedBy, |
| 13 | matchingPreset, |
| 14 | normalizeScopes, |
| 15 | requestedScopes, |
| 16 | scopesFromForm, |
| 17 | } from "./token-scopes.ts"; |
| 18 | |
| 19 | function form(fields: Record<string, string | string[]>) { |
| 20 | return { |
| 21 | get: (name: string) => { |
| 22 | const value = fields[name]; |
| 23 | return Array.isArray(value) ? (value[0] ?? null) : (value ?? null); |
| 24 | }, |
| 25 | getAll: (name: string) => { |
| 26 | const value = fields[name]; |
| 27 | return value === undefined ? [] : Array.isArray(value) ? value : [value]; |
| 28 | }, |
| 29 | }; |
| 30 | } |
| 31 | |
| 32 | test("every scope is on the checklist exactly once, admin ones under Dangerous", () => { |
| 33 | const listed = [...SCOPE_GROUPS.flatMap((group) => group.scopes), ...DANGEROUS_SCOPES]; |
| 34 | assert.deepEqual([...listed].sort(), SCOPES.map((row) => row.scope).sort()); |
| 35 | assert.equal(new Set(listed).size, listed.length); |
| 36 | assert.ok(DANGEROUS_SCOPES.every((scope) => scope.endsWith(":admin") || scope.endsWith(":delete"))); |
| 37 | }); |
| 38 | |
| 39 | test("ticked boxes store the highest level of each resource", () => { |
| 40 | const parsed = scopesFromForm(form({ scope: ["work:read", "work:write", "code:read", "agents:run", "memory:write", "bogus:read"] })); |
| 41 | assert.deepEqual(parsed, { ok: true, value: ["code:read", "work:write"] }); |
| 42 | assert.deepEqual(normalizeScopes(["repo:read", "repo:admin", "repo:write"]), ["repo:admin"]); |
| 43 | }); |
| 44 | |
| 45 | test("full access is null, and nothing ticked is refused", () => { |
| 46 | assert.deepEqual(scopesFromForm(form({ preset: "full", scope: "work:read" })), { ok: true, value: null }); |
| 47 | assert.equal(scopesFromForm(form({ preset: "full" }), { allowFull: false }).ok, false); |
| 48 | assert.equal(scopesFromForm(form({ preset: "custom" })).ok, false); |
| 49 | assert.deepEqual(grantFromForm(form({ scope: "observability:read" })), { ok: true, value: { scopes: ["observability:read"] } }); |
| 50 | }); |
| 51 | |
| 52 | test("a higher level ticks the lower ones of its resource only", () => { |
| 53 | assert.equal(impliedBy(["work:write"], "work:read"), "work:write"); |
| 54 | assert.equal(impliedBy(["repo:admin"], "repo:write"), "repo:admin"); |
| 55 | assert.equal(impliedBy(["work:write"], "work:write"), null); |
| 56 | assert.equal(impliedBy(["work:write"], "pull_requests:read"), null); |
| 57 | assert.equal(impliedBy(["code:read"], "code:write"), null); |
| 58 | }); |
| 59 | |
| 60 | test("full access ticks the top level of everything", () => { |
| 61 | const all = everyScope(); |
| 62 | assert.ok(all.includes("repo:admin")); |
| 63 | assert.ok(!all.includes("agents:run"), "retired"); |
| 64 | assert.ok(!all.some((scope) => scope.startsWith("memory:")), "retired"); |
| 65 | assert.ok(all.includes("code:write")); |
| 66 | assert.ok(!all.includes("code:read")); |
| 67 | }); |
| 68 | |
| 69 | test("presets are recognised however their scopes are written", () => { |
| 70 | assert.equal(matchingPreset(null), "full"); |
| 71 | assert.equal(matchingPreset(["repo:read", "code:write", "packages:write", "workflows:write", "checks:write", "deployments:write"]), "ci"); |
| 72 | assert.equal(matchingPreset([...OAUTH_DEFAULT_SCOPES]), "agent"); |
| 73 | assert.equal(matchingPreset(["work:read"]), null); |
| 74 | }); |
| 75 | |
| 76 | test("a token's access reads plainly", () => { |
| 77 | assert.equal(accessSummary({ scopes: null, legacy: true }), "Legacy · full access"); |
| 78 | assert.equal(accessSummary({ scopes: null, legacy: false }), "Full access"); |
| 79 | assert.equal( |
| 80 | accessSummary({ |
| 81 | scopes: ["code:read", "code:write", "packages:write", "workflows:write", "checks:write", "deployments:write", "repo:read"], |
| 82 | legacy: false, |
| 83 | }), |
| 84 | "CI", |
| 85 | ); |
| 86 | assert.equal(accessSummary({ scopes: ["work:read", "work:write", "pull_requests:read"], legacy: false }), "2 scopes"); |
| 87 | assert.equal(accessSummary({ scopes: [], legacy: false }), "No scopes"); |
| 88 | }); |
| 89 | |
| 90 | test("an application asking for nothing usable gets the default set, never admin", () => { |
| 91 | assert.deepEqual(requestedScopes(null), OAUTH_DEFAULT_SCOPES); |
| 92 | assert.deepEqual(requestedScopes("openid profile *"), OAUTH_DEFAULT_SCOPES); |
| 93 | assert.ok(!requestedScopes("").some((scope) => scope.endsWith(":admin"))); |
| 94 | assert.deepEqual(requestedScopes("work:write nonsense repo:read"), ["repo:read", "work:write"]); |
| 95 | }); |
| 96 | |
| 97 | test("consent keeps only what was asked for", () => { |
| 98 | const requested = requestedScopes("repo:read work:read work:write"); |
| 99 | assert.deepEqual(consentedScopes(form({ scope: ["work:write", "repo:admin", "secrets:admin"] }), requested), ["work:write"]); |
| 100 | assert.deepEqual(consentedScopes(form({ scope: ["work:read", "repo:read"] }), requested), ["repo:read", "work:read"]); |
| 101 | assert.deepEqual(consentedScopes(form({}), requested), []); |
| 102 | }); |
| 103 | |
| 104 | test("expiry words", () => { |
| 105 | const now = Date.parse("2026-10-05T00:00:00Z"); |
| 106 | assert.equal(describeExpiry(null, now), "No expiry"); |
| 107 | assert.equal(describeExpiry("2026-10-04T00:00:00Z", now), "Expired"); |
| 108 | assert.equal(describeExpiry("2026-10-12T00:00:00Z", now), "Expires in 7 days"); |
| 109 | assert.equal(describeExpiry("2026-10-05T01:00:00Z", now), "Expires in 1 hour"); |
| 110 | assert.equal(describeExpiry("2027-01-03T00:00:00Z", now), "Expires in 3 months"); |
| 111 | }); |