mirror of
https://github.com/ruvnet/RuView.git
synced 2026-08-27 18:46:09 +00:00
46 lines
2.2 KiB
JavaScript
46 lines
2.2 KiB
JavaScript
import test from 'node:test';
|
|
import assert from 'node:assert/strict';
|
|
import { authorizeTool, validateArguments } from '../src/policy.js';
|
|
import { runTool } from '../src/tools.js';
|
|
|
|
test('schema validation rejects unknown and mistyped arguments', async () => {
|
|
const result = await runTool('ruview_onboard', { path: 7, injected: true });
|
|
assert.equal(result.ok, false);
|
|
assert.equal(result.reason, 'invalid_arguments');
|
|
assert.ok(result.errors.some((error) => error.includes('injected')));
|
|
});
|
|
|
|
test('MCP workspace writes require confirmation and an explicit grant', () => {
|
|
assert.equal(authorizeTool('ruview_calibrate', {}, { source: 'mcp', grants: [] }).reason, 'not_confirmed');
|
|
assert.equal(authorizeTool('ruview_calibrate', { confirm: true }, { source: 'mcp', grants: [] }).reason, 'authority_denied');
|
|
assert.equal(authorizeTool('ruview_calibrate', { confirm: true }, { source: 'mcp', grants: ['workspace-write'] }).ok, true);
|
|
});
|
|
|
|
test('read-only tools remain available with no mutation grants', () => {
|
|
assert.equal(authorizeTool('ruview_claim_check', { text: 'safe' }, { source: 'mcp', grants: [] }).ok, true);
|
|
assert.equal(authorizeTool('ruview_guidance', {}, { source: 'mcp', grants: [] }).ok, true);
|
|
assert.deepEqual(validateArguments({ type: 'object', properties: {} }, {}), []);
|
|
});
|
|
|
|
test('credentialed external reads require an explicit MCP grant', () => {
|
|
const denied = authorizeTool('ruview_spaces_list', {}, { source: 'mcp', grants: [] });
|
|
assert.equal(denied.reason, 'authority_denied');
|
|
assert.equal(denied.requiredGrant, 'credential-use');
|
|
assert.equal(authorizeTool('ruview_spaces_list', {}, { source: 'mcp', grants: ['credential-use'] }).ok, true);
|
|
assert.equal(authorizeTool('ruview_spaces_list', {}, { source: 'cli', grants: [] }).ok, true);
|
|
});
|
|
|
|
test('Spaces schema never accepts raw credentials', async () => {
|
|
for (const credential of [
|
|
{ token: 'secret' },
|
|
{ access_token: 'secret' },
|
|
{ api_key: 'cog_secret' },
|
|
{ authorization: 'Bearer secret' },
|
|
{ base_url: 'https://attacker.example' },
|
|
]) {
|
|
const result = await runTool('ruview_spaces_list', credential);
|
|
assert.equal(result.ok, false);
|
|
assert.equal(result.reason, 'invalid_arguments');
|
|
}
|
|
});
|