37 lines
2.9 KiB
JavaScript
37 lines
2.9 KiB
JavaScript
import assert from "node:assert/strict";
|
|
import { readFileSync } from "node:fs";
|
|
import {
|
|
buildPolicy, draftFromPolicy, inheritedControlDisabled, setDraftChannel,
|
|
setDraftMethod, stable
|
|
} from "../src/features/policy/archiveEncryptionDraft.ts";
|
|
|
|
const baseline = {
|
|
allowed_password_encryption_methods: ["aes"],
|
|
allowed_password_delivery_channels: ["separate_mail", "sms", "letter", "phone", "in_person"],
|
|
policy_hash: "baseline", source_path: [], reason: "Secure baseline", diagnostics: []
|
|
};
|
|
const initial = draftFromPolicy({}, baseline);
|
|
assert.deepEqual(buildPolicy(initial), {}, "Opening default system settings must not create an override or dirty state");
|
|
assert.equal(inheritedControlDisabled("system", initial.inheritMethods), false, "System defaults must be editable without a hidden inheritance toggle");
|
|
assert.equal(inheritedControlDisabled("system", initial.inheritChannels), false);
|
|
const enabled = setDraftMethod(initial, "zip_standard", true);
|
|
assert.deepEqual(buildPolicy(enabled), { allowed_password_encryption_methods: ["aes", "zip_standard"] }, "The first system Legacy click must produce an explicit override");
|
|
assert.notEqual(stable(buildPolicy(enabled)), stable({}));
|
|
assert.deepEqual(buildPolicy(initial), {}, "Changing a draft must preserve the original policy");
|
|
const narrowedChannels = setDraftChannel(initial, "sms", false);
|
|
assert.deepEqual(buildPolicy(narrowedChannels), { allowed_password_delivery_channels: ["separate_mail", "letter", "phone", "in_person"] });
|
|
assert.equal(inheritedControlDisabled("tenant", initial.inheritMethods), true, "Child scopes retain explicit inheritance controls");
|
|
assert.equal(inheritedControlDisabled("user", false), false);
|
|
assert.deepEqual(buildPolicy(draftFromPolicy(buildPolicy(enabled), baseline)), buildPolicy(enabled), "An explicit system policy survives save/reload");
|
|
assert.deepEqual(buildPolicy(setDraftMethod(enabled, "zip_standard", false)), { allowed_password_encryption_methods: ["aes"] });
|
|
|
|
const panel = readFileSync(new URL("../src/features/policy/ArchiveEncryptionPoliciesPanel.tsx", import.meta.url), "utf8");
|
|
assert.match(panel, /inheritedControlDisabled\(scopeType, draft\.inheritMethods\)/);
|
|
assert.match(panel, /inheritedControlDisabled\(scopeType, draft\.inheritChannels\)/);
|
|
assert.match(panel, /setDraft\(setDraftMethod\(draft, method\.id, checked\)\)/);
|
|
assert.match(panel, /setDraft\(setDraftChannel\(draft, channel\.id, checked\)\)/);
|
|
assert.match(panel, /scopeType !== "system" && !parentMethods\.includes\(method\.id\)/, "Child scopes must still respect parent ceilings");
|
|
const moduleSource = readFileSync(new URL("../src/module.ts", import.meta.url), "utf8");
|
|
assert.match(moduleSource, /scopeType: "system",\s*canWrite: hasScope\(auth, "system:settings:write"\) && hasScope\(auth, "admin:policies:write"\)/, "Tenant policy administration alone must not enable edits to the global system archive ceiling");
|
|
console.log("Archive encryption settings regressions passed.");
|